Azure - Web Roles - Filtering out requests based on host

Question

Recently we encountered issue that our web role on Azure got an IP address that was previously associated with thepiratebay tracker. That meant to around 5 000 000 requests that were 404. Problem of the DNS server I believe.

What I would like to do is to filter out requests that point to different hosts than our sites are. Is it possible to achieve this through hostHeader attribute in

<ServiceDefinition name="AB.AzureSite" xmlns="http://schemas.microsoft.com/ServiceHosting/2008/10/ServiceDefinition" schemaVersion="2014-06.2.4">
  <WebRole name="AllBlacksdotcom" vmsize="Medium">
    <Sites>
      <Site name="Web">
        <Bindings>
          <Binding name="Endpoint1" endpointName="Endpoint1"  hostHeader=""/>
        </Bindings>
      </Site>
    </Sites>

We would like to avoid the requests hitting our sites at all (for example the request that are meant for host track.thepiratebay.org). Is this possible?

This should be posted on ServerFault, since it's an Azure infrastructure question, not a programming question. — David Makogon, Feb 11 '15 at 06:29

score 2 · Accepted Answer · edited May 23 '17 at 10:25

There is no way to entirely skip /turn off processing of unwanted requests. However using the hostHeader attribute will take you pretty close with some trade-offs. Check the documentation here.

There is at least one catch:

When you use host header, your site will only reply to requests with this header.
You cannot use wildcards in the hostHeader attribute.

That attribute is directly applied to the host header binding property of the web site in IIS. And as such - no wildcards are supported.

So only requests that describe what you defined in hostHeader will land on your site. Rest of the requests however will anyway land on the Default Web Site in IIS.

You can turn off the Default Web Site via a start-up task (some example for changing IIS settings via Startup Tasks).

score 2 · Answer 2 · answered Feb 11 '15 at 12:36

If you're at the host header level, traffic is already hitting your role instances. The only way to block traffic prior to that is with Access Control Lists (ACLs) on your endpoints.

If the issue is solely based on a specific IP address that you happened to end up with, you can delete and then redeploy your cloud service package, which will assign a new IP address.

Azure - Web Roles - Filtering out requests based on host

2 Answers2