Скачать или смотреть How to Deny IPs for Specific URLs in IIS with URL Rewriting

Learn how to effectively deny access to specific IPs for specific URLs in IIS without disrupting existing URL rewriting functions.
---
This video is based on the question https://stackoverflow.com/q/64174544/ asked by the user 'Hidak' ( https://stackoverflow.com/u/14380096/ ) and on the answer https://stackoverflow.com/a/64396173/ provided by the user 'ValB' ( https://stackoverflow.com/u/5376930/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: How to deny IP for a specific url from IIS when you have a rewrite url with path (.*)?

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
How to Deny IPs for Specific URLs in IIS with URL Rewriting

When managing a web server using Internet Information Services (IIS), you might encounter situations where you need to block certain IP addresses from accessing specific URLs. This task can become confusing, especially if those URLs have rewriting rules already established. In this post, we’ll explore how to achieve IP restrictions for specific URLs while preserving existing rewrite rules.

The Problem

As an example, imagine you have a rewrite rule set up in your web.config file for all URLs that begin with foo/. This rule functions correctly, allowing various requests to be rewritten as needed. Now, you find yourself in a position where you need to deny access to specific IPs for a particular URL pattern—let's say foo/rest/API/getName.

Original Rewrite Rule

To clarify the existing rule, here’s what you might have in your web.config:

[[See Video to Reveal this Text or Code Snippet]]

The Challenge

The challenge is to introduce a new rule that can simultaneously block specific IPs from accessing foo/rest/API/getName while not changing or disrupting the behavior of the FOO_RULE.

The Solution

To effectively accomplish this, you can rearrange your existing rules. Below, we’ll outline a simple and efficient way to create an exception rule for the specific URL before the primary rewriting rule.

Step-by-Step Implementation

Create an Exception Rule:
This new rule will specifically target the URL foo/rest/API/getName and block requests coming from specific IP addresses. Here’s how you can define this rule in your web.config:

[[See Video to Reveal this Text or Code Snippet]]

Rule Explanation:

The EXCEPTION_FOO_PATH rule matches requests made to the URL foo/rest/API/getName.

It checks if the IP address is 111.222.333.444 using conditions with a logical grouping of MatchAny. If a match is found, the request is aborted.

The FOO_RULE then takes effect for all other requests under foo/, rewriting them as previously designed.

Understanding the Flow:

When a request for foo/rest/API/getName comes in from the blocked IP, the first rule handles it and prevents it from being processed further.

For any other requests that start with foo/, the second rule executes, allowing them to be rewritten appropriately.

Conclusion

By appropriately structuring your rules in the web.config, you can effectively deny specific IPs from accessing certain URLs without losing your initial rewrite functionalities. Just remember to keep your rules organized and clear, so they perform as expected.

If you encounter challenges along the way or have further questions, don’t hesitate to reach out or leave comments below!