IP Address Restrictions with Web.Config

If you want to restrict website access to certain IP address, you have to do it in the web.config file. In this article I will give you an updated step-by-step guide on how to blog IP addresses in web.configOverview

On a previous article I demonstrated how to block IP addresses using the<ipSecurity> tag. However this tag element is locked by default and, for security reasons, not available for shared hosting environments. Instead we will use another shared hosting-friendly method.

Getting Started

1. Open the web.config file of your ASP application:

web config file asp arvixe tutorials hosting

2. This time, instead of the ipSecurity tag, we will use the <rewrite> tag. We will set a forbidden status to any page the blocked IP tries to access. Add this code to your webconfig file:

                <rule name=”Blocked Users” stopProcessing=”true”>
                    <match url=”.*” />
                        <add input=”{Bad Ips:{REMOTE_ADDR}}” pattern=”1″ />
                    <action type=”CustomResponse” statusCode=”403″ statusReason=”Forbidden” statusDescription=”Forbidden” />
                <rewriteMap name=”Bad Ips”>
                    <add key=”108.166.*.*” value=”1″ />
                    <add key=”″ value=”1″ />

In the code above, First we set a rule to block all URLs to the offending IP address (match url=”.*”). Then we set inside the <condition> tag the <action> to return a 403 Forbidden status. Finally, inside the <rewriteMaps> we add the IP addresses that we want to block, inside the <add key> tag with a value of 1.

editing web config rewrite rules ip block arvixe tutorials asp hosting

3. Save your changes and that’s it! Now IP addresses has been blocked:

403 forbidden ip blocked arvixe tutorials asp hosting websitepanel hostingThis concludes IP address Restrictions with Web.Config

Looking for quality ASP Web Hosting? Look no further than Arvixe Web Hosting!

Happy Hosting!

Rodolfo Hernandez

Tags: , , , , , , , , , , , , , , , , , , , , , | Posted under WebsitePanel Tutorials | RSS 2.0

Author Spotlight

Rodolfo Hernandez

I like photography and reading books. Currently working for Arvixe as Elgg Community Liaison. Elgg Security Expert Web Security Expert CEO of UDP SW Social Web

4 Comments on IP Address Restrictions with Web.Config

  1. vladimir says:


    Is there a way to enable “Dynamic IP Address Restrictions” in Arvixe hosting
    as it is described here: http://www.iis.net/learn/get-started/whats-new-in-iis-8/iis-80-dynamic-ip-address-restrictions


  2. Michael Y says:

    This is great. However, what if I want only certain IP to access the website and block all the rest?

Leave a Reply

Your email address will not be published. Required fields are marked *