I know this has been reported before, but is there any possible way to get the IP Address and Domain Restrictions to actually DENY and IP Address or IP Address range? Is this just a bug in Windows Server 2012? I've seen answers for this, but all involve either putting in a router rule or using the Windows Firewall - both are good answers, however, what would be the point of having domain restrictions in IIS if it does not work at all? Any help would be appreciated. I figure this is a bug that simply has not been patched by MS (whether I recycle the app pool or restart IIS, the DENY rules are simply ignored!)

  • Denying an IP address access to a web-site in IIS works just fine for me. If you have a problem with it, you need to describe exactly what you are doing. – Peter Hahndorf Jul 1 at 19:05
  • Exactly. Ok. Open IIS 8.5, Select the website in question. Dbl Click the "IP Address And Domain Restrictions" icon. On the right hand side, click "Add Deny Entry". Add an IP address in the "Specific IP Address" textbox and click OK. Restart the application pool for that website. Telnet to the website port from the command prompt from a denied IP - use telnet 80 (or 443) and it connects just fine. It connects. Try this in a browser - it connects. I discovered this on a client's server log (an ASP.Net website) and they were being attacked. IIS8.5 let traffic through! – MC9000 Jul 2 at 20:40
  • There must be some setup issue (the one I tested was on Windows Server 2012 R2 Standard). Google this issue, and there are thousands of hits regarding this flaw (but only with 8.5). DotNetCore 2.2 is installed as well - the only machine that worked did not have Core installed (coincidence, perhaps). I'll keep trying different configs and report a working solution. – MC9000 Jul 2 at 20:44
  • You say you have one server where this doesn't happen and also suggest a setup-issue but still blame a IIS bug. I just restored an old IIS8.5 server and denying an IP address works perfectly fine for me. I also don't see widespread reporting on this. A http 400 error is a different matter. Check your http logs and make sure you are blocking the correct address. – Peter Hahndorf Jul 4 at 17:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.