I was wondering if it's possible to make a VPN to connect to IIS on a single server. I want IIS to refuse connection if it's connecting from another address than the VPN.

Is that possible?

I've searched on google, but nothing came up...

  • 1
    Define "access IIS". Do you mean access a web site running in IIS? – joeqwerty Jul 23 '13 at 2:45
  • 1
    What version of IIS and what is your network setup? Do you also want the internal network to access this website? If not, then your internal network has to be in a different IP range than your VPN. Please be more specific regarding your question. – Renegade91127 Jul 23 '13 at 2:57
  • if your answer to joeqwerty's question is no, then do you mean access the IIS configuration? or I'm guessing both...? – BeowulfNode42 Jul 23 '13 at 3:08

You can set up a VPN whichever way you want as long as it consistently gives the same IP address (or one of a range of IP addresses if you are alright with setting a firewall rule for the whole range). There are lots of ways to do this (RRAS, openvpn, etc.). The VPN server endpoint could be on the IIS server or elsewhere depending on your preference.

You could then use windows firewall to block traffic to your IIS ports if it doesn't come from that IP address or block.

You won't find a recipe for doing that, because it is an unusual thing to do, but there are lots of different ways to accomplish it.

You can't do this with only IIS; you will need other components.

  • You certainly can do this with only IIS, by settings IP restrictions on the site or VirDir, that match up with the IPs that VPN users are assigned. – mfinni Jul 23 '13 at 19:10
  • Yes, you can do that. You can't do the VPN part with only IIS. Also, if you're going for security, the firewall is a much better place to do this. – Falcon Momot Jul 23 '13 at 19:57
  • Of course he can't use IIS to create a VPN; I didn't think that was what he was asking for. As regarding the best choice of restricting it it in IIS vs a firewall, that wasn't the question. The question was can it be done, which it can. – mfinni Jul 23 '13 at 20:12

If you are trying to deny access to your website to anyone but your VPN users, you could lock down your entire network from the outside world and only allow the VPN connection.

Once your users connect to the VPN, they could access any internal websites you have running by either accessing them by IP address or url and validate their referring IP address either in code or by way of IIS to allow or disallow further access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.