Whitelisting HTTP traffic on Windows Server/IIS

Question

I'm deploying an ASP.NET application in beta and would like to limit HTTP access to a few select IPs. Given the configuration of our environment, the easiest way for me to accomplish this is through some form of IP whitelisting on the web servers themselves. There may be implications relating to performance, configuration, and possibly more depending on which process is responsible for handling this on the box.

Would it be best to configure the accepted IP addresses in IIS, Windows Firewall, or another alternative?

Answer 1

You can use IP Restrictions.

Open IIS Manager > Under IPv4 Address Restrictions

Click Allow to allow an IPv4 address or range of IPv4 addresses to connect to the management service.

In the Add Allow Connection Rule dialog box > click Specific IPv4 address, and then type the IPv4 address in the box.

To allow a range of IP addresses, click IPv4 address range, type an IPv4 address in the box, and then type a subnet mask in the Subnet mask box. In the Actions pane, click Apply and then click Start.

Answer 2

Another option would be an access list on a switch or router depending on where these source IP's are located.

My preference is always to do this sort of thing on a bit of network equipment (Switch, Router, hardware firewall) I have know it in the past where someone used Windows firewall to apply a similar restriction only for it to become useless when at a later date another technician disabled Windows firewall on all server by GPO.

Answer 3

You should probably set this up in the firewall, and not rely on IIS to filter by IP Addresses.