What is the optimal way to configure IIS to block direct IP access to the server? Direct IP access is only used by malicious scanners that will troll the entire internet by ip looking for vulnerable servers.

I stood up a server only yesterday that is not used anywhere on the internet, and already have '/MyAdmin/scripts/setup.php' was not found in my error logs.


You can use the Url Rewrite feature of IIS to do that :

  1. Open the URL Rewrite feature :

URL Rewrite in IIS

  1. Add a rule of type "Request blocking" : enter image description here

  2. Block the requests based on host name :

If you know your IP address, you can use it to block requests which use it : enter image description here

Or you can block all requests which are not using the domain name : enter image description here

Hope this helps (It took me ages to find that).

Please note that I have no idea of the performance overhead of this usage.

  • 2
    Great solution, glad i can finally accept an answer to this question. I would imagine the overhead of Url Rewrite should be effectively zero, i would expect it to be a IASPI filter and that those can handle 10-20K/s vs ASP.NET's 500-1000/s in standard configurations. Maybe some level of impact if you actually write IASPI filters yourself but i imagine that is few and far inbetween. – Chris Marisic Jun 5 '15 at 15:38
  • It looks like your image got deleted from imgur – Chris Marisic May 4 '17 at 7:26
  • @ChrisMarisic : don't know why you said that, they're visible for me, event after a cache refresh. Are you behind a big bad company proxy, which don't allow imgur images ? – JYL May 6 '17 at 12:15
  • Imgur must've had some nodes down or something, they're visible again – Chris Marisic May 6 '17 at 17:42
  • great solution. thanks. – Mohammad Sadiqur Rahman Sep 30 '19 at 11:30

This is, frankly, beneath caring about, however...

  1. Set up the default site on the server to point to a blank directory, or static files, or something you don't care about getting hammered by "malicious scanners". [booga booga]
  2. Don't map any blank host headers to your sites in IIS.
  • I always host inside Default Web Site, can you elaborate on #2 – Chris Marisic Sep 26 '13 at 19:21
  • This. You can try adding your hostnames explicitly and removing the blank entries, and IIS should server errors for requests on just the IP address. – Sammitch Sep 26 '13 at 19:47
  • 1
    This is just poor workaround. It doesn't work when we need to accept all subdomains of a domain (*.mydomain.com) but deny pure IP address. – JYL Jun 5 '15 at 13:34
  • Emphasis on #2, don't have any blank or wildcard bindings. Only bind names to websites that will actually be served. Case in point, if I were to register mysite.foo to your IP address you now have to deal with these requests in a similar manner. URL Rewrite works but this means the request gets processed by the IIS pipeline. #2 will prevent it from even going to IIS. – user2320464 Jun 5 '15 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.