阻塞IIS改写IP地址

Question

I have been using Win Server 2008 running IIS 7 as a reverse proxy server which allows me to have multiple web servers behind a single public IP address. I have configured IIS 7 with rewrite rules for each of the web servers like this:

{HTTP_HOST} Matches the pattern (domain_A.com) Rewrite http://<Server #1 IP>/{R:1}

Surprisingly, this works.

I'd like to employ IIS ipSecurity to create deny rules that block the rewrite rules for various IP addresses (a poor man's firewall). I tried adding deny rules to the ipSecurity section of applicationHost.config like this:

<ipSecurity allowUnlisted="true"> <add ipAddress="1.0.0.0" su.netMask="8" allowed="false" /> </ipSecurity>

The rewrite rules are still triggering for my denied IP addresses, so I suspect that IIS is processing rewrite before ipSecurity.

Is there a way to configure IIS rewrite so that it obeys the deny rules in ipSecurity?

Answer 1

You could try adding a condition to the rule that retrieves the host header value by reading the server variable {HTTP_HOST}, matches it against the pattern "domain_A.com", and then negates the result of matching.

<rule name="Fail bad requests">
  <match url=".*"/>
    <conditions>
      <add input="{HTTP_HOST}" pattern="domain_A.com" negate="true" />
    </conditions>
  <action type="AbortRequest" />
</rule>

More information you can refer to this link: Creating an access block rule .