IP Security <ipSecurity>

Overview

The <ipSecurity> element defines a list of IP-based security restrictions in Internet Information Services (IIS) 7. These restrictions can be based on the IP version 4 address, a range of IP version 4 addresses, or a DNS domain name.

Compatibility

Version Notes
IIS 7.5 The <ipSecurity> element was not modified in IIS 7.5.
IIS 7.0 The <ipSecurity> element was introduced in IIS 7.0.
IIS 6.0 The <ipSecurity> element replaces the IIS 6.0 IPSecurity metabase property.

Setup

The default installation of IIS 7 does not include the role service for IP security. To use IP security on IIS, you must install the role service using the following steps:

Windows Server 2008 or Windows Server 2008 R2

  1. On the taskbar, click Start, point to Administrative Tools, and then click Server Manager.
  2. In the Server Manager hierarchy pane, expand Roles, and then click Web Server (IIS).
  3. In the Web Server (IIS) pane, scroll to the Role Services section, and then click Add Role Services.
  4. On the Select Role Services page of the Add Role Services Wizard, select IP and Domain Restrictions, and then click Next.

  5. On the Confirm Installation Selections page, click Install.
  6. On the Results page, click Close.

Windows Vista or Windows 7

  1. On the taskbar, click Start, and then click Control Panel.
  2. In Control Panel, click Programs and Features, and then click Turn Windows Features on or off.
  3. Expand Internet Information Services, then World Wide Web Services, then Security.
  4. Select IP Security, and then click OK.

How To

How to add IP restrictions to deny access for a Web site

  1. Open Internet Information Services (IIS) Manager:
    • If you are using Windows Server 2008 or Windows Server 2008 R2:
      • On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
    • If you are using Windows Vista or Windows 7:
      • On the taskbar, click Start, and then click Control Panel.
      • Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
  2. In the Connections pane, expand the server name, expand Sites, and then site, application or Web service for which you want to add IP restrictions.
  3. In the Home pane, double-click the IPv4 Address and Domain Restrictions feature.

  4. In the IPv4 Address and Domain Restrictions feature, click Add Deny Entry... in the Actions pane.

  5. Enter the IP address that you wish to deny, and then click OK.


How to edit the IP restrictions feature settings for a Web site

  1. Open Internet Information Services (IIS) Manager:
    • If you are using Windows Server 2008 or Windows Server 2008 R2:
      • On the taskbar, click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
    • If you are using Windows Vista or Windows 7:
      • On the taskbar, click Start, and then click Control Panel.
      • Double-click Administrative Tools, and then double-click Internet Information Services (IIS) Manager.
  2. In the Connections pane, expand the server name, expand Sites, and then site, application or Web service for which you want to add IP restrictions.
  3. In the Home pane, double-click the IPv4 Address and Domain Restrictions feature.

  4. In the IPv4 Address and Domain Restrictions feature, click Edit Feature Settings... in the Actions pane.

  5. Choose the default access behavior for unspecified clients, specify whether to enable restrictions by domain name, and then click OK.

Configuration

Rules are processed from top to bottom, in the order they appear in the list. The allowunlisted attribute is processed last. Best practice for Internet Protocol security (IPsec) restrictions is to list Deny rules first. You cannot clear the allowunlisted attribute if it is set to false.

The following default <ipSecurity> element is configured in the root ApplicationHost.config file in IIS 7. This configuration section inherits the default configuration settings unless you use the <clear> element.

<ipSecurity allowUnlisted="true" />

Attributes

Attribute Description
allowUnlisted Optional Boolean attribute.

Specifies whether to allow unlisted IP addresses. Setting the allowUnlisted attribute to true allows an unlisted IP address to access the server. Setting the allowUnlisted attribute to false locks down the server, preventing access to all IP address unless they are listed. If you were to set this attribute to false and do not list the local loopback address (127.0.0.1) as an allowed IP address, you would not be able to access your server by using a browser from a local console.

This attribute can also affect delegation. If you were to set this attribute to false in a parent configuration, you would not be able use the <clear> element to clear this configuration in child configuration files.

The default value is true.
enableReverseDns Optional Boolean attribute.

Specifies whether to enable or disable reverse Domain Name System (DNS) lookups for the Web server. Reverse lookups involve looking up the domain name when the IP address is known.

Caution: Reverse DNS lookups will use significant resources and time.

The default value is false.

Child Elements

Element Description
add Optional element.

Adds an IP restriction to the collection of IP address restrictions.
remove Optional element.

Removes a reference to a restriction from the <ipSecurity> collection.
clear Optional element.

Removes all references to restrictions from the <ipSecurity> collection.

Configuration Sample

The following configuration sample adds two IP restrictions to the Default Web Site; the first restriction denies access to the IP address 192.168.100.1, and the second restriction denies access to the entire 169.254.0.0 network.

<location path="Default Web Site">
   <system.webServer>
      <security>
         <ipSecurity>
            <add ipAddress="192.168.100.1" />
            <add ipAddress="169.254.0.0" subnetMask="255.255.0.0" />
         </ipSecurity>
      </security>
   </system.webServer>
</location>

Sample Code

The following code samples enble reverse DNS lookups for the default web site.

AppCmd.exe

appcmd.exe set config "Default Web Site" -section:system.webServer/security/ipSecurity /enableReverseDns:true /commit:apphost

Note: You must be sure to set the commit parameter to apphost when you use AppCmd.exe to configure these settings. This commits the configuration settings to the appropriate location section in the ApplicationHost.config file.

C#

using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample
{
   private static void Main()
   {
      using (ServerManager serverManager = new ServerManager())
      {
         Configuration config = serverManager.GetApplicationHostConfiguration();
         ConfigurationSection ipSecuritySection = config.GetSection("system.webServer/security/ipSecurity", "Default Web Site");
         ipSecuritySection["enableReverseDns"]=true;

         serverManager.CommitChanges();
      }
   }
}

VB.NET

Imports System
Imports System.Text
Imports Microsoft.Web.Administration

Module Sample

   Sub Main()
      Dim serverManager As ServerManager = New ServerManager
      Dim config As Configuration = serverManager.GetApplicationHostConfiguration
      Dim ipSecuritySection As ConfigurationSection = config.GetSection("system.webServer/security/ipSecurity", "Default Web Site")
      
      ipSecuritySection("enableReverseDns") = True
      
      serverManager.CommitChanges()
   End Sub

End Module

JavaScript

var adminManager = new ActiveXObject('Microsoft.ApplicationHost.WritableAdminManager');
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST";
var ipSecuritySection = adminManager.GetAdminSection("system.webServer/security/ipSecurity", "MACHINE/WEBROOT/APPHOST/Default Web Site");

ipSecuritySection.Properties.Item("enableReverseDns").Value = True;

adminManager.CommitChanges();

VBScript

Set adminManager = WScript.CreateObject("Microsoft.ApplicationHost.WritableAdminManager")
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST"
Set ipSecuritySection = adminManager.GetAdminSection("system.webServer/security/ipSecurity", "MACHINE/WEBROOT/APPHOST/Default Web Site")

ipSecuritySection.Properties.Item("enableReverseDns").Value = True

adminManager.CommitChanges()
Deprecated Elements