Issue with IP Addresses and Domain Restrictions in IIS

user_17633315 0
Viewed 756

i have windows server 2019 with iis 10 installed, ip and domain restriction enabled ip range 10.0.0.1=>10.0.0.240 - domain name : lo-server.com

the problem that am facing is : when adding a local ip address / Same ip with server / same network / example 10.0.0.66 to deny list it works perfectly it deny the access

but when i add an ip address outside the network / 192.168.20.10 / which is connected to a firewall ( FortiGate ) 10.0.0.200 the restriction doesn't work i need to add the firewall ip to deny it which i don't want to do it because i'll block all the ranges that are connected to the firewall.

how can i deny access to another network without adding the firewall

firewall iis
2 Answers

Microsoft considered the simplest case for you and implemented the so called Proxy mode, which you might try out,

https://docs.microsoft.com/en-us/iis/get-started/whats-new-in-iis-8/iis-80-dynamic-ip-address-restrictions#configuring-iis-for-proxy-mode

Deep down inside it checks x-forwarded-for header to see whether the incoming HTTP requests are through a proxy (the firewall in your case) and then apply the rules to decide whether to deny any request.

However, a real world proxy can manipulate the incoming requests in too many ways, so the proxy mode might fail you and you will have to switch to something like URL Rewrite module and write a more complicated rule to abort the desired requests.

user_111820

You can use the IP Address and Domain Restrictions feature page to define and manage rules that allow or deny access to content for a specific IP address, a range of IP addresses, or a domain name or names.

Opens the Add Deny Restriction Rule dialog box from which you can define rules that allow access to content for a specific IP address, a range of IP addresses, or a DNS domain name.

enter image description here

More information you can refer to this link: IP Address and Domain Restrictions.

user_133366420
Related