Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Consider an IIS7 deployment with multiple Applications under a Web Site. Each is running under its own AppPool. We want to disallow all outside visitors access to one Application in particular. All internal users should be allowed access.

The current strategy is to check the requesting IP address. This likely could be done in IIS7 and a web.config. The screenshot is the first stab at allowing internal users. Those who present from:

  • 192.168.0.X should be allowed.
  • an external IP, (i.e. a public address) should be denied.

    First stab at IIS7 settings

Question: How would you configure your Application to suit this requirement, either by:

  • inetmgr or
  • web.config
share|improve this question
I think you answered your own question. Using inetmgr you would do exactly what you have done. And all inetmgr does is write this in to your web.config file... – Mark Henderson Aug 23 '09 at 21:48
You're already doing it correctly. What else do you need, exactly? – Massimo Aug 24 '09 at 9:39
Thanks everyone; I need to determine how to block outside addresses. I think I've figured out the 'allow inside visitors' rule, but the deny is still the issue. – p.campbell Aug 24 '09 at 14:08

Use the IIS Manager and deny all access except from your private IP subnet.

That or host the site on a second different IP and setup internal DNS to handle the name lookup, and not make the app available from the outside at all.

share|improve this answer
+1 Seems simple enough... I'd use an ISA/TMG or some other good publishing firewall for this though. – Oskar Duveborn Sep 8 '09 at 7:52

I think I understand what you are asking as I am having the same issue. To try and describe this another way, I want to restrict access to "one" of the Applications on my Site, to a specific list of IP addresses and ranges. However, when you configure this in InetMgr, the restriction is placed on the Site, not the specific Application. I also tried adding the IP address restriction rules manually to my web.config in the Application and that did not work either.

How do you add an IP address restriction to the Application and leave the rest of the Site open?

share|improve this answer
@Mark, yes, thanks for posting! – p.campbell Sep 8 '09 at 13:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.