1

I'm restricting access to certain folders in an IIS 7.5 web application based on IP address. Here is a segment from applicationHost.config:

<ipSecurity allowUnlisted="false">
     <add ipAddress="172.16.0.0" subnetMask="255.255.0.0" allowed="true" />
</ipSecurity>

This returns a 403 Forbidden page and works as expected. But, I want it to return 404 Not Found instead. When I try the following code, however, I instead get a 500 error:

<ipSecurity allowUnlisted="false" denyAction="NotFound">
     <add ipAddress="172.16.0.0" subnetMask="255.255.0.0" allowed="true" />
</ipSecurity>

I've searched on Google but have found no answer.

0

denyAction feature was introduced in IIS 8.0; you're using an older version so it will always return HTTP error code 500.

https://docs.microsoft.com/en-us/iis/configuration/system.webserver/security/ipsecurity/

Nevertheless, I'm using 8.5 and still finding that it doesn't function and a 500 is always returned.

1
  • For denyAction to work on IIS; the server needs to allow the delegation of that setting to the individual sites. At the top level of IIS server, select "Feature Delegation". – drodecker Oct 8 '17 at 22:07
0

For denyAction to work on IIS version 8.0+; the server needs to allow the delegation of that setting to the individual sites. At the top level of IIS server, select "Feature Delegation".

Make sure the IP Address and Domain Restrictions is set to Read/Write. enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.