I have read that to IP-restrict a website in IIS8 to allow only one or more IPs and deny everybody else, you do this:
- Set "Access for unspecified clients" to "Deny"
- Add IP-address for "Allow"
(as specified in below screenshot)
However, when I do this (as specified in below screenshot), I am still able to access the site from other IPs.
What is missing here? Is there something else, that needs to be done?
I tried iisreset and the page is not browser cached on the test-machines, that should not have access.