We have a web service that we are trying to impose access restrictions on in production. This web service lies on LAN based internal server. It is called from web applications sitting on the same server and web applications sitting on a DMZ server. These are the only two places we want to give access to this service. I.E. Localhost (127.0.0.1 IP) and the IP of the DMZ server.
In IIS 7.5 I have set the feature setting to
Deny for unspecified clients. Then entered in two allow entries similar to :
%windir%\system32\inetsrv\appcmd.exe set config "Default Web Site" -section:system.webServer/security/ipSecurity /+"[ipAddress='127.0.0.1',allowed='True']" /commit:apphost
With the two IP addresses. For the actual server I have tried 127.0.0.1 and the actual IP of the server - neither made a difference. I have also entered these via command line and via the IIS manager. Again, neither made a difference.
This setup allowed access from the DMZ but not from the localhost.
However if I check the box for
Enable domain name restrictions, do a reverse look up with
nslookup using the server IP and add an allow entry for this domain. This then works. However as the warning states when you check this box, this is a much more costly option as every incoming request needs to be reverse looked up.
These are all HTTPS calls to the web service if it matters, but I don't suspect it does.
There must be something I'm doing wrong here but I don't just know? Any help is appreciated.