0

We have a web service that we are trying to impose access restrictions on in production. This web service lies on LAN based internal server. It is called from web applications sitting on the same server and web applications sitting on a DMZ server. These are the only two places we want to give access to this service. I.E. Localhost (127.0.0.1 IP) and the IP of the DMZ server.

In IIS 7.5 I have set the feature setting to Deny for unspecified clients. Then entered in two allow entries similar to :

%windir%\system32\inetsrv\appcmd.exe set config "Default Web Site" -section:system.webServer/security/ipSecurity /+"[ipAddress='127.0.0.1',allowed='True']" /commit:apphost

With the two IP addresses. For the actual server I have tried 127.0.0.1 and the actual IP of the server - neither made a difference. I have also entered these via command line and via the IIS manager. Again, neither made a difference.

This setup allowed access from the DMZ but not from the localhost.

However if I check the box for Enable domain name restrictions, do a reverse look up with nslookup using the server IP and add an allow entry for this domain. This then works. However as the warning states when you check this box, this is a much more costly option as every incoming request needs to be reverse looked up.

These are all HTTPS calls to the web service if it matters, but I don't suspect it does.

There must be something I'm doing wrong here but I don't just know? Any help is appreciated.

Improve this question
2
  • I don't really understand this - you want to allow requests for <DMZ-IP> but deny request for <DMZ-IP>?
    – bjoster
    Jun 13, 2018 at 10:08
  • @bjoster I want to allow requests for <DMZ-IP>, allow requests for <localhost> but deny requests for any other IP.
    – Ben
    Jun 13, 2018 at 10:40

2 Answers 2

Reset to default
0

You maybe want to edit your bindings, not the IIS IP security. The security settings determines from where the request is allowed to come, bindings are there to tell a site to what requets (names, adresses, protocols, ports ...) to answer to. It looks to me like you want to allow requests just for two IP-Adresses for your Site.

Click on your site (like "Default Web Site" from your question) and "Bindings" on the right side. There you can configure each binding: enter image description here

(sorry for my german windows)

you can also do this on the command line:

appcmd add site /name:WEBSITENAME /physicalpath:C:\inetpub\WEBSITENAME /bindings:https/<DMZ-IP>:<PORT>:
Improve this answer
0

Just use the Windows-Firewall to configure who is allowed to connect.

  • Set IIS to 'default' and remove all restrictions
  • Make sure Incomming Traffic for port 80 or the IIS-Server is not allowd.
  • Create a FW-Rule for the IP of the DMZ.

https://www.howtogeek.com/112564/how-to-create-advanced-firewall-rules-in-the-windows-firewall/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .