Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm deploying an ASP.NET application in beta and would like to limit HTTP access to a few select IPs. Given the configuration of our environment, the easiest way for me to accomplish this is through some form of IP whitelisting on the web servers themselves. There may be implications relating to performance, configuration, and possibly more depending on which process is responsible for handling this on the box.

Would it be best to configure the accepted IP addresses in IIS, Windows Firewall, or another alternative?

share|improve this question

3 Answers 3

You can use IP Restrictions.

Open IIS Manager > Under IPv4 Address Restrictions

Click Allow to allow an IPv4 address or range of IPv4 addresses to connect to the management service.

In the Add Allow Connection Rule dialog box > click Specific IPv4 address, and then type the IPv4 address in the box.

To allow a range of IP addresses, click IPv4 address range, type an IPv4 address in the box, and then type a subnet mask in the Subnet mask box. In the Actions pane, click Apply and then click Start.

share|improve this answer
    
I'm curious to know what advantages this offers over configuring the restrictions in Windows Firewall –  JonathanK Dec 31 '12 at 16:10

Another option would be an access list on a switch or router depending on where these source IP's are located.

My preference is always to do this sort of thing on a bit of network equipment (Switch, Router, hardware firewall) I have know it in the past where someone used Windows firewall to apply a similar restriction only for it to become useless when at a later date another technician disabled Windows firewall on all server by GPO.

share|improve this answer
    
Unfortunately this is not an option given the environment, otherwise it would be my preference, as well. Access to the servers is severely limited (HTTP-only cloud instances w/no RDP) so I hope to avoid the human issue you ran into. –  JonathanK Dec 31 '12 at 16:13

You should probably set this up in the firewall, and not rely on IIS to filter by IP Addresses.

share|improve this answer
    
Would you explain the reasoning behind your advice? –  Deer Hunter Jan 11 '13 at 12:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.