asp.net blocking IP range

Question

I want to do a IP range block on a asp.net mvc website, and I have this in my web.config:

  <system.webServer>
<security>
  <ipSecurity allowUnlisted="false">
    <add ipAddress="1.1.1.1" subnetMask="255.255.0.0" />
    <add ipAddress="2.2.2.2" subnetMask="255.255.0.0" />
  </ipSecurity>
</security>


<handlers>
  ...
</handlers>

But when i try to run the page I get this

How should i do the ip range block?

http://stackoverflow.com/questions/23204788/trying-to-secure-all-aspx-files-in-a-folder-secure-by-ip-address — CodeCaster, Sep 03 '15 at 11:35

score 0 · Answer 1 · answered Sep 03 '15 at 11:36

0

Sounds like you need the IP Security module installed on your local IIS (and your server when you go live). The error has a problem with the line:

<ipSecurity allowUnlisted="false">

Which is correct, although currently with allowUnlisted set to false, you're currently only allowing the IPs specified in your rule, and looks like you want the opposite, so set that to true.

answered Sep 03 '15 at 11:36

ediblecode

11,701
19
68
116

i explained myself wrong, i want to only allow 2 ranges of ips and block the rest. – Thought Sep 03 '15 at 13:17
Ah then just ignore the latter part of my answer :) – ediblecode Sep 03 '15 at 13:17

score 0 · Answer 2 · edited Oct 20 '22 at 01:20

From documentation:

First, create a command file that runs when your role starts which unlocks the ipSecurity section of the ApplicationHost.config file. Create a new folder at the root level of your web role called startup and, within this folder, create a batch file called startup.cmd. Set the properties of this file to Copy Always to ensure that it will be deployed.

Add the following code to the startup.cmd file:
%windir%\system32\inetsrv\AppCmd.exe unlock config -section:system.webServer/security/ipSecurity
Next, open the ServiceDefinition.csdef file in your web role project and add the following element:
<Startup>
   <Task commandLine=”startup\startup.cmd” executionContext=”elevated” />
</Startup>
This causes the startup.cmd batch file to be run every time the web role is initialized, ensuring that the required ipSecurity section is unlocked.

In case if you didn't load module.

Then if you want black list you should change <ipSecurity allowUnlisted="false"> to <ipSecurity allowUnlisted="true">

Really good article of how it works could be found here.

asp.net blocking IP range

2 Answers2