2

A have an application server that serves a number of IIS 8.5 applications on a number of IP's. Some use port 80 only, some use port 443 only, some use 80 & 443.

For the sites that use 443 only, we do not want IIS to listen on port 80 for those IP addresses. If someone tries to access http://securesite.domain.com we do not want them to get a 404 not found, we do not want the server to respond at all (e.g. Server not found)

One option would be to use a firewall, including Windows firewall, but I was hoping I could just stop IIS from listing on port 80 for those specific IP's, while still listening on port 443, or any other bound port for that matter. I hoped iplisten had a port option, but alas it does not.

Note: I have ensured there are no sites using a wildcard biding on port 80. All sites are bound to specific IPs/ports. Am I missing somthing simple?

Improve this question
5
  • 1
    The server has to accept the request and examine the header to determine where (what site) the request should go to. Could you arrange the sites into 3 groups. Port 80, port 443 and both? If these were grouped across say 3 ips, you could simply not listen on the one not in use.
    – Drifter104
    Jun 4, 2015 at 22:41
  • Thank you Michael Lewis. On that IP address we do not want the server to accept the request and inspect any traffic on port 80. You say "you could simply not listen on the one not in use."... How do I do that? My entire question is: how do I tell IIS not to listen on at all port 80 for the IP that we want 443 only?
    – Curtis
    Jun 5, 2015 at 16:33
  • Suppose you have 3 ips on the server 1.1.1.1 2.2.2.2 3.3.3.3 On the binding for each site you pick an ip/interface and a port. If all your port 80 sites used 1.1.1.1 for example you would not need a bind on that ip for 443. When the request to that IP the server would ignore it. You do the same for 443 sites but use ip 2.2.2.2 but only configure a binding for 443. I'm assuming you know how to do bindings in IIS from "no sites using a wildcard biding on port 80"
    – Drifter104
    Jun 5, 2015 at 16:39
  • In your scenario, the server does not "ignore it". It responds to requests to 2.2.2.2 (which is only bound to a site on port 443) with a 404 Not found. We want it not to listen on port 80 for that IP at all. "The 404 or Not Found error message is an HTTP standard response code indicating that the client was able to communicate with a given server, but the server could not find what was requested."
    – Curtis
    Jun 5, 2015 at 21:23
  • "Server not found" would be a DNS failure, so you won't be able to get that exact message by changing settings on the IIS server, and I'm not sure if there's a way to make DNS work for one port and not for another. I'm 99% sure you can't do that, but there might be some kind of new SRV record trick or something that I'm not aware of. Using a firewall is the best way to drop packets sent to a port while accepting packets sent to another port.
    – Todd Wilcox
    Dec 15, 2017 at 16:35

2 Answers 2

Reset to default
1

Here is a Microsoft TechNet article showing how to add a binding. Just do the opposite to remove.

For SSL only websites, why not redirect the requests? Or you could require SSL for a website.

Improve this answer
3
  • Thank you user2320464. I tried to be as clear as possible on what we have done, and what we are trying to accomplish. We could redirect, and in fact previously were. The sites do requires SSL. We want the server to NOT listen nor respond at all to HTTP requires coming in on port 80 for the specific IPs that are for SSL sites only. We want a client browser to to respond "Server not found"
    – Curtis
    Jun 5, 2015 at 16:35
  • If you want the server to "NOT listen nor respond" then block TCP80 in windows firewall (wf.msc) for that IP. If you want "Server not found" (actually HTTP 404) remove the host name binding from the website. If you don't have that level of access, enabling "Require SSL" will return an HTTP 403 for non-ssl requests. This was tested on IIS7.5 so it will have similar results as IIS8.5. Returned HTTP codes may be different.
    – user2320464
    Jun 5, 2015 at 21:29
  • Thank you @user2320464. I mentioned I was considering using Windows Firewall, and I do have that access. Chances are this is what we will do since we cant figure out how to get the server to not respond at all in our scenarios. You are correct that if "Require SSL" is set on that site, the server will respond with a HTTP 403 Forbidden, IFF port 80 is bound to that site. The server responds with HTTP 404 Not found if port 80 is not bound.
    – Curtis
    Jun 5, 2015 at 22:12
1

Its odd that removing the binding for port 80 in IIS did not do the trick. I ended up blocking port 80 in the Windows Firewall as a work-around.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .