0

I have a multitenant windows 2012 machine running several IIS WebSites, each running it's own application pool with its own windows user identity, and I need to restrict the all outbound network access from each application pool.

I've been searching for a solution but with little success. I would think that one can either restrict the connection per windows user, or "map" an IP to a windows user and restrict by IP. But there doesn't seem anything that allows me to do either of the approaches. I've investigated:

  • Using Windows Firewall -> doesn't allow to create rules per user, only per IP/Port/process name
  • Using ASP.NET/IIS security restrictions -> They are all inbound and not outbound.
  • Using multiple IPs -> cannot assign an Outbound IP to the correspondent application pool
  • Using Containers -> Typically containers share same IPs as well ... and it's still Technology Preview for Windows 2016
  • Using .net proxy settings -> doesn't cover non-http/https connections, like ado.net.

I did found in Linux (iptables module ipt_owner) exactly what I need, but switching operating system is not an option. I need the same but for Windows.

I'm open to developing some IIS module or system service that runs in the machine to achieve this, but I don't see how an IIS module can manage the worker process outbound connections, and implementing a system service that manages processes network connections seems to me a very big project, with high risk of causing network issues in the machine ...

Do you have any other ideas worth investigating?

Thanks in advance for any help you can provide.

Cheers

Miguel João
  • 1
  • I had already gone through that post a few days ago, and it's the exact same need. Controlling outbound traffic by application pool. None of the ideas solve the problem, and as the last post suggests, either MS improves the IIS/FW integration to create outbound rules per worker process, or I'll need to develop a network driver that will implement it .... the effort on the latter is significant. Thanks for sharing though. – Miguel João Jan 24 '16 at 17:09

1 Answers1

0

ModSecurity will be able to accomplish what you need as it will have full visibility into the HTTP request/response stream. Just need to formulate the appropriate rules to limit access as you've described.

user2320464
  • 789
  • 5
  • 14
  • Thanks for the suggestion, but ModSecurity is simply a WAF module over Apache, and although allows very customizable sets of rules, its only for HTTP/HTTPS inbound traffic. My need is ALL outbound traffic restricted by process user. – Miguel João Jan 24 '16 at 17:14