Member Avatar for winbatch

I sometimes get a lot of traffic from certain ip's that are clearly trying to break in/snoop. Is there a way in IIS to block access for certain ip's? (or ranges?). I can do this in my ftp server software (non IIS)...

  • 6 Contributors
  • 6 Replies
  • 333 Views
  • 5 Years Discussion Span
  • Latest Post Latest Post by donnidore

Dani AI

Generated

As originally asked, the practical way to deny visitors by IP depends on the Windows/IIS version and how many addresses you need to block. was right that IIS can do per-IP rules, but modern IIS exposes that as the configurable <ipSecurity> / IP Address and Domain Restrictions feature (it’s an installable feature on IIS 7+). (learn.microsoft.com)

A low-impact, server-side option is to use IIS’s IP restrictions in configuration rather than per-request code. Example (put under the site’s <system.webServer> section in web.config):

<security>
  <ipSecurity allowUnlisted="true" denyAction="Abort" enableProxyMode="true">
    <add ipAddress="198.51.100.23" />
    <add ipAddress="203.0.113.0" subnetMask="255.255.255.0" />
  </ipSecurity>
</security>

Use allowUnlisted carefully (locking to false can cut access if you forget localhost), and enable enableProxyMode only when behind a trusted proxy/load‑balancer. (learn.microsoft.com)

Blocking at the host firewall avoids touching IIS config and scales better for very large lists. Examples:

# PowerShell (modern Windows)
New-NetFirewallRule -DisplayName "BlockBadIP" -Direction Inbound -Action Block -RemoteAddress "198.51.100.23"

# netsh (cmd)
netsh advfirewall firewall add rule name="BlockBadIP" dir=in action=block remoteip=198.51.100.23

Run elevated and test from an external host. (learn.microsoft.com)

For automated/dynamic blocking, IIS has a Dynamic IP Restrictions module and many people (see , , ) have used scripts/tools to update lists — that works for small/occasional attacks. For high-volume or distributed attacks, block at the edge (CDN/WAF/ firewall) instead — it reduces server load and centralizes lists. Always test rules in logging-only mode first and keep an emergency “allow” (e.g., your admin IP or 127.0.0.1). (learn.microsoft.com)

Recommended Answers

All 6 Replies

Member Avatar for kc0arf

Hello,

Using IIS under Windows 2003, yes there is. Unfortunately, I cannot paste the screen print here.

Go into the IIS manager, and right click on your website. Look at the properties. Look at the Website Security tab. Click on the IP Address or Domain restrictions, where you can place IP Addresses to block.

Then again, you can also setup this functionality in most firewall software.

Christian

Member Avatar for winbatch

I have xp, guess I'll have to upgrade. Thanks for the info.

Member Avatar for DaveLauderdale

This script does just what you are asking:

The original is found at www.digi-dl.com

Member Avatar for LTG1

I've just written a easy to use app to do this.

It's free, open source, works on XP/2003/Vista, and 64-bit 32-bit. It also automatically downloads a high quality list of chinese addresses to block which account for a lot of attacks.

Feedback appreciated -
Regards,
LTG

Member Avatar for SiCk minD

hey everyone !
question : can someone block acces on a forum without being registered ?
(with my IP or forum address)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.