Select the product you need help with

HOW TO: Restrict Site Access by IP Address or Domain Name

Article ID: 324066 - View products that this article applies to.

This article was previously published under Q324066

SUMMARY

This article describes how to translate the Apache settings that restrict access to a folder or a Web site by Internet Protocol (IP) address or domain name to the settings that are required in IIS.

Setting Folder Security by IP Address or Domain Name

Apache uses the Allow and Deny directives to determine the sites that can access a particular Web site or folder. However, Apache provides discretionary access control; you must either deny all sites and provide a specific list of sites or IP addresses that can access a folder or allow all sites and deny only those sites that you do not want to have access. For example, if you use the following directive, all client computers are denied access unless they are recognized as part of the domain.com domain:

Deny from all
Allow from .domain.com

IIS works the same way. All clients are specifically denied or granted access, except for those that are listed.

Define Access Control for Specific Folder or Site

Log on to the Web server computer as an administrator.
Click Start, point to Settings, and then click Control Panel.
Double-click Administrative Tools, and then double click Internet Services Manager.
If you want to limit access for the whole site, select the Web site from the list of different served sites in the left pane.

If you want to limit access only for a specific folder, click the folder you want to control.
Right-click the Web site or folder, and then click Properties.
Click the Directory Security panel.
If you want to limit access to a specific set of sites but deny access to all other sites, click Denied Access.
If you want to grant access to all clients by default but exclude a specific list of clients, click Granted Access.
To update the list of hosts or domains in the Except list, click Add.
To add a single computer to the list, click Single computer, type the IP address in the appropriate box, and then click OK.
To add a range of computers in a specific address range, click Group of computers, type the IP address for the network in the appropriate box, type the subnet mask for the network range you want to configure, and then click OK.
To add computers by their identified domain name, click Domain name, and then type the domain name in the appropriate box.
Click Properties, type the domain name, and then click OK.
Click OK, and then click OK.

NOTE: If you use domain name restrictions, the server has to perform a reverse DNS lookup for each request to check the host's registered domain name. Microsoft recommends that you use an IP address or network range whenever you can.

Back to the top | Give Feedback

REFERENCES

For additional information about securing IIS for a migration from UNIX to Windows, click the article number below to view the article in the Microsoft Knowledge Base:

324216

(http://support.microsoft.com/kb/324216/EN-US/ )

HOW TO: Secure IIS in a UNIX-to-Windows Migration

Back to the top | Give Feedback