Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

As an extra layer of security I use "Integrated Windows authentication" in IIS to protecte our admin tool.

To setup new user accounts I got to "Computer Management" -> "Local User and Groups" -> "Users".

To my question: Is it possible to restrict access for a specific user to a certain ip address. For example I only want my consultants to be able to login from our office?

I've tried Select User -> "Properties" -> "Dial-in" -> "Assign a static IP Address" but it didn't work. Do I need to change something else too?

share|improve this question

3 Answers 3

up vote 1 down vote accepted

You could do this with a URL Rewriter, like IIRF.

IIRF provides examples of how to block requests based on the IP address of the remote machine.

# Iirf.ini
#
# ini file for blocking by IP address
#

RewriteLogLevel 1
RewriteLog c:\inetpub\iirfLogs\Iirf
RewriteEngine ON
StatusUrl /iirfStatus
IterationLimit 5

RewriteCond %{REMOTE_ADDR} ^24\.132\.226\.94$  [OR]
RewriteRule ^/(.*)$ /$1 [F]

I think what you're doing is allowing based on IP address, so .. the reverse.

# Iirf.ini
#
# ini file for allowing requests by IP address range
#

RewriteLogLevel 1
RewriteLog c:\inetpub\iirfLogs\iirf
RewriteEngine ON
StatusUrl /iirfStatus
IterationLimit 5

# If the IP address is not in the specified range, return 404
# (NF = Not Found)
RewriteCond %{REMOTE_ADDR} ^(?!24\.132\.(\d+)\.(\d+))
RewriteRule ^/.*$ - [NF]

# If URL processing has gotten this far, do nothing (no rewrite),
# which means, implicitly, allow the request.

If you also want to allow access for authenticated users, you would have to modify that ini file to also consider an authentication cookie, or something.

share|improve this answer

You can use the windows firewall to restriction traffic on the web server port(s) to only your local office network. You can also set up IP restrictions within IIS directly. But in both cases, the restriction in place is for everyone. There's no to make it so that it only applies to certain users. There might be a third party tool that can accomplish it. But if there is, I've never heard of one.

If you control the source code of your admin tool, it's shouldn't be too hard to add support for this yourself. On login, you can check the client IP address. If it's not in your network and it's one of the restricted users, you can just funnel them to an error page.

share|improve this answer
    
I had hoped to avoid this. –  Niels Bosma Dec 1 '09 at 16:45

You could try to have multiple sites rather than one. An "internal use" site has IP restrictions for the office but allows all users. The "external site" only allows users in a certain Windows Group. You can enforce this through NTFS permissions on the file system.

Of course this means you need to maintain two copies of the site, but it should be easy to synchronize them after an update.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.