asp.netiisrequestfiltering

IIS: Let pass only allowed requests

How can i configure IIS so all requests are blocked except those that I allow?

So for example www.mypage.com is reachable and everything else is blocked except all requests starting with wwwroot

Allow:

www.mypage.com*
www.mypage.com/wwwroot/*
Solution

  • There are 2 options to do this

    Option 1 - Using Request Filtering.

    1. Open IIS Manager.
    2. Select the Web Site.
    3. Double Click Request Filtering.
    4. In the Actions pane click on Deny Sequence and add the URL you want to block.

    Downside of this approach is you need to add all the URLs that you want to block. I am not sure if we can add a regular expression here.

    Option 2 - Using URL Rewrite (Preferable method)

    1. Install URL Rewrite from here
    2. Open IIS Manger and select the site you want to deny access and double click the URL Rewrite module
    3. On the right hand side in the actions pane click Add Rule(s)
    4. Select Request Blocking template in Inbound Rules. Set the values as below and click ok.This will add a URL Rewrite Rule

    enter image description here

    1. What I am doing is adding a regular expression that matches everything but wwwroot.

    With this anything other then wwwroot will be blocked. You can double click the Rule under URL-Rewrite and customize accordingly. Also make sure to disable the rule for static files/folders (.js,.css, images)

    Reference - http://www.iis.net/learn/extensions/url-rewrite-module/request-blocking-rule-template

    Hope this helps.