I have read that to IP-restrict a website in IIS8 to allow only one or more IPs and deny everybody else, you do this:

  1. Set "Access for unspecified clients" to "Deny"
  2. Add IP-address for "Allow"

(as specified in below screenshot)

However, when I do this (as specified in below screenshot), I am still able to access the site from other IPs.

What is missing here? Is there something else, that needs to be done?

enter image description here

I tried iisreset and the page is not browser cached on the test-machines, that should not have access.

  • When you say test machines, do you mean internal machines? If so could you provide us with the real IP's and the real restriction / allow rules? (or just obfuscate them using the guidelines in this post)
    – Reaces
    Dec 19 '14 at 11:45
  • That test machines are just PC's that are also internal to the network, and I can see the same IP in the IIS logs, so they are not being NAT'ed, proxied or anything like that.
    – Kjensen
    Dec 19 '14 at 17:35
  • These steps should work, make sure the installation of the IP Security is valid
    – Cerveser
    Dec 22 '14 at 16:22

If the IP Security under IIS Windows Features is installed you could add this to your web.config to block IP's:

<location path="Default Web Site">
         <ipSecurity allowUnlisted="false"><!-- this line blocks everybody, except those listed below -->                
            <clear/> <!-- removes all upstream restrictions -->
            <add ipAddress="" />
            <add ipAddress="" subnetMask="" />

After a lot of messing about, I found the following worked for me (IIS 8.5.X on win server 2012 R2)

Ensure Feature enabled for web.config management

  • In IIS
  • Click on the root server
  • Double click Feature Delegation (under management)
  • Scroll down to IP Address and Domain Restrictions
  • Change to Read/Write

(in my case it was Read Only, which was the issue)

Then edit web.config to include

            <!-- this line blocks everybody, except those listed below -->                
            <ipSecurity allowUnlisted="false">
                <!-- removes all upstream restrictions -->            
                <clear />
                <add ipAddress="X.X.X.X" allowed="true" />
                <add ipAddress="" allowed="true" /> 

Where X.X.X.X is the IP you wish to allow (add a line like this for every IP or IP subnet combo you wish to allow)

Noteworthy is the the documentation seems to miss the allowed="true" and any mention of the requirement to allow the feature to be delegated. Thanks to @Summit for that tip here


Do you have a proxy between Clients and your IIS Server? You can show in IIS Logs with which IP your Client is coming.

  • Good idea, but that was not it. No proxy in between, no. I double-checked in the logs as you suggested.
    – Kjensen
    Dec 19 '14 at 11:41
  • Sorry that i can't help you. But i have a similar problem. I have the same rule as you. But my problem is that IIS restrict every IP. Sorry :o|
    – Martin
    Dec 19 '14 at 12:41

I found a work around for my situation.

SITUATION: Need to block IPs on network, but allow IIS access to website for server local applications. Occasional individual and total sub-net access to IIS website.

PROBLEM: Setting "Edit Feature Settings" to Deny does not work properly. It does not respect the "Allow" list. Nothing, local or network, is allowed to access the hosted website.

WORKAROUND: Leave "Edit Feature Settings" at "Allow". Last entry of "Allow/Deny" list is "Deny" to full sub-net. "Allow" entry for local server IP precedes the sub-net "Deny". Any individual computers on sub-net to be allowed access have "Allow" entries preceding the "Deny" to full sub-net.


Steps to do file level IP restriction in IIS 7 & above

In IIS manager->In the Content view ,highlight the specific file->Click "Switch to Features view" on Actions pane->In Features View,Double-click "IP Address and Domain restrictions" and then set restriction

I think it works with classic ASP pages as well.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.