I am trying to restrict an application in IIS 7 by IP address on my web server behind a load balancer. The X-Forwarded-For header is set by the load balancer with the client's IP address.
What is the best way to extract that IP address in IIS 7 to setup IP address filtering on my application? If there is not a best way, I will end up using an HTTPModule to handle this for me.
IIS 7 and beyond include the Dynamic IP Restrictions module, which supports filtering client requests by their X-Forwarded-For header, which is added to a request when using an AWS load balancer:
Support for web servers behind a proxy - If your web server is behind a proxy, you can configure the module to use the client IP address from an X-Forwarded-For header.
You can enable Proxy Mode support by checking the "Proxy" checkbox in the module's configuration page, then write rules to allow/deny IPs/CIDR ranges via the module.
