How to filter request using IP restrictions OR a filtering rule

Question

We have an IIS site right now that has an allow list for a specific list of IP addresses, and all other IPs denied by default. We want to add another rule, that states that if the request coming in as a user-agent of a specific value, then allow it, regardless of if the IP is on the allow list or not. Is this possible?

What version of IIS are you using? – Evan Anderson Oct 23 '14 at 15:09 — Evan Anderson, Oct 23 '14 at 15:09

score 1 · Accepted Answer · answered Oct 23 '14 at 15:31

I don't see an easy solution for you in the stock IIS functionality. The <ipSecurity> HTTP module doesn't support factoring-in the User-Agent as part of the block decision, and the <filteringRules> module doesn't support using the client IP address.

I think you're going to be stuck writing a custom IIS module to do what you want.

Do remember that the User-Agent field is under the control of the client, so basing some kind of security decision on it is probably ill advised.

How to filter request using IP restrictions OR a filtering rule

1 Answers1