IP and URL analysis in IIS 10

Question

IP and URL analysis in IIS 10

Sergey Knyazev 60

Good afternoon! It is necessary to filter connections to the server by IP address and the presence of a certain phrase in the URL. For example, there are two users: one connects by URL https:\animals.eu\cats\1513515 , and the other one connects by URL https:\animals.eu\dogs\43434 . I need to analyze the ip address from which the connection is going on, and then if the URL contains \dogs, then prohibit access to it, display a separate page. In other cases, allow connection. Is it possible to do this via IIS 10 version?

Accepted answer

1 additional answer

Your answer

Answer 1

Anonymous

Hi @Sergey Knyazev,

It is necessary to filter connections to the server by IP address and the presence of a certain phrase in the URL.

There are two directions:

If you filter by IP address, you can use the IP and Domain Restrictions module.
1. Select your website -> double click module IP and Domain Restrictions -> Add Deny Entry... - > Enter the <IP address you want> in Specific IP address textbox.
If you filter by URL, you can use the URL Rewrite module.
1. Download and install URL Rewrite Module via: https://www.iis.net/downloads/microsoft/url-rewrite
2. Open the URL Rewrite module, Click the Add Rules option, select Request Blocking rule template and click the OK button.
3. Set configuration like this (You can modify it according to your needs):
4. Click "OK" to finish the configuration.

For more details, you can refer to relevant docs: https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/creating-rewrite-rules-for-the-url-rewrite-module

Best regards,

Xudong Peng

If the answer is the right solution, please click "Accept Answer" and kindly upvote. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Sergey Knyazev 60 Reputation points

2025-02-11T17:09:48.36+00:00

The thing is, I need a compound condition - when the IP from the list and the URL are specific. And in your solution, separately for IP, separately for URL. How do I make a compound condition?
Anonymous

2025-02-12T02:07:38.8866667+00:00

Hi @Sergey Knyazev,

How do I make a compound condition?

If this is the case, you can create conditions using URL Rewrite module. Based on the module configuration I mentioned above, add filtering conditions for IP address, similar to this:

And change the logical grouping to "Match Any".
Sergey Knyazev 60 Reputation points

2025-02-13T15:56:52.86+00:00

Thanks for the help. Now there's another problem - I'm trying to save the rule, but the apply button is unavailable.

I found information on the Internet that requires the installation of AR 3.0 https://www.iis.net/downloads/microsoft/application-request-routing .

It was not possible to install via Web Installer 5.1 - it is empty. I downloaded the file from the website and it doesn't start either.

What should I do?
Anonymous

2025-02-14T01:34:52.4466667+00:00

Hi @Sergey Knyazev,

I'm trying to save the rule, but the apply button is unavailable.

Please review your configuration to check if there are other sections that are not populated. Something like this (mainly in Match URL and Actions sections):

In addition, Web Platform Installer you mentioned already retired on December 31, 2022. You can refer to this link to download the .msi installation package for ARR module.
Sergey Knyazev 60 Reputation points

2025-02-14T08:20:19.38+00:00

Hooray. I managed to save the rule. I didn't add the Match URL last time. I added the rule with the URL '/mobile', but for some reason it doesn't work. I'm going to the address https://test.ru/mobile/51515 - skips it. I don't understand what's the matter(

I downloaded the file .msi to install the ARR 3.0 module - but how to install it? it outputs an error at startup.

Anonymous

Hi @Sergey Knyazev,

I'm not sure if you have it configured correctly, it looks like you have applied two rewrite rules (these two conditions can exist in one rule at the same time). Check if the configuration file is correct, follow these steps: Right click on your website -> Click Explore -> Find the Web.config file and open it -> Check the configuration in System.webserver node:

<system.webServer>
    <rewrite>
        <rules>
            <rule name="RequestBlockingRule1" enabled="false" stopProcessing="true">
                <match url=".*" />
                <conditions logicalGrouping="MatchAny">
                    <add input="{URL}" pattern="/dogs" />
                    <add input="{REMOTE_ADDR}" pattern="127.0.0.2" />
                </conditions>
                <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
            </rule>
        </rules>
    </rewrite>
</system.webServer>

For the error about the installation of ARR module, I cannot reproduce your issue, it works for me locally. Which installation package did you download, x86 or x64? This depends on your operating system.

Sergey Knyazev 60 Reputation points

2025-02-14T12:00:06.5433333+00:00

here is my configuration file. We have a general rule for the server to switch from http:// to https://

And for the site there is a rule for /mobile access prohibition.

The server is running Windows Server 2019 Standard (10.0.17763) build 17763 64-bit. I'm also downloading the x64 file.
Anonymous

2025-02-17T02:47:29.61+00:00

Hi @Sergey Knyazev,

We have a general rule for the server to switch from http:// to https://

It looks like this is a new question, maybe you can refer to this similar case, or post a new thread.

In addition, I noticed that your conditional screening only has one path judgment. Do you need to separate them again?

The server is running Windows Server 2019 Standard (10.0.17763) build 17763 64-bit. I'm also downloading the x64 file.

I tried to install them (URL Rewrite and ARR) in my test environment (Windows Server 2019 version 1809 (x64)), they all work fine. Have you tried other .msi installers and do you have the same problem?
Sergey Knyazev 60 Reputation points

2025-02-17T18:10:42.4433333+00:00

I made one condition on /mobile as an example. I understood how to combine 2 conditions in one rule. But since I already had one rule for rewriting URLs from http to https, when adding a second rule from /mobile, the second one doesn't work. I have sent the configuration file. The link that was sent is how I made the first rule. It's working. My question is, why doesn't the second rule work?

Anonymous

Hi @Sergey Knyazev,

My question is, why doesn't the second rule work?

The problem is with the <HttpRedirect> you configured. If it redirects to another website, then you need to configure the filter on that website. If it's the same site (http to https), it should work fine.

Example: website1: testmobile.com -> website2: testMvcApp.com

In web.config of testmobile.com

<system.webServer>
  <httpRedirect enabled="true" destination ="https://testMvcApp.com/dogs/1" exactDestination="true" />
</system.webServer>

In web.config of testMvcApp.com

<rewrite>
  <rules>
    <rule name="RequestBlockingRule2" stopProcessing="true">
      <match url=".*" />
      <conditions logicalGrouping="MatchAny">
        <add input="{URL}" pattern="/dogs" />
      </conditions>
      <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
    </rule>
  </rules>
</rewrite>

Result (when I access the website1):

User's image

Sergey Knyazev 60 Reputation points

2025-02-19T06:38:55.3033333+00:00

I figured out what the problem was.

Redirection from http to https has nothing to do with it, since the service is the same. Here it just changes to https, the rest of the link remains as it was.

The difficulty is that our application is Power BI Report Server, and it apparently has reserved URLs. IIS simply does not see them, here you need to enable a reverse proxy server in front of IIS, which will control connections and most likely - this is nginx for windows server 2019.

Do you support this solution?
Anonymous

2025-02-20T03:44:02.9766667+00:00
Hi @Sergey Knyazev,

Yes, if the redirect destination is the same site, it will still be affected by the rule.

which will control connections and most likely - this is nginx for windows server 2019.

If you use the nginx, you can try to add the configuration below:

location /mobile { deny all; return 403; }

Answer 2

Sergey Knyazev 60

aaaaaaaaaaaaaa

Share via

IP and URL analysis in IIS 10

1 additional answer

Your answer