We're looking at deploying CloudFlare as a WAF for our site. One of the requirements is that we restrict access to the site from outside North America. Fortunately, CloudFlare supports GeoLocation, and stamps requests to the origin server with a location header.

Now, however, I need to figure out how to whitelist countries. Ideally, I'd like to specify CA and US or whatever as permissible values, and reject everything else, but in IIS, it seems to only support blacklisting.

Is there a way to do this in IIS alone, or does anyone know of a third part module that does this?


You could use the IIS Rewrite Module.

Use a rule to match all URLs and use a condition to check for the http header injected by CloudFlare, check for the country value and reject all requests not from the US or Canada.

A sample rule would be something like this:

        <rule name="RequestBlockingRule1" stopProcessing="true">
            <match url=".*" />
                <add input="{HTTP_CF_IPCOUNTRY}" pattern="^CA|US$" negate="true" />
            <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="Using this site from your location is not supported." />

CF-IPCountry would be the name of the header injected by CloudFlare.

  • Ooh, this looks promising! Let me give it a shot – Mike Caron Oct 20 '16 at 19:12
  • This was very close! The header is actually CF-IPCountry, so the input had to be HTTP_CF_IPCOUNTRY. Other than that, this seems to work great! – Mike Caron Oct 20 '16 at 19:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.