I'm deploying an ASP.NET application in beta and would like to limit HTTP access to a few select IPs. Given the configuration of our environment, the easiest way for me to accomplish this is through some form of IP whitelisting on the web servers themselves. There may be implications relating to performance, configuration, and possibly more depending on which process is responsible for handling this on the box.
Would it be best to configure the accepted IP addresses in IIS, Windows Firewall, or another alternative?