Take the 2-minute tour ×

We've got a webserver running IIS. We'd like to run maybe a shared blog or something to keep track of information. Because of security issues, we'd like for that part to be only viewable from localhost so people have to remote in to use it.

So, to repeat my question, can part of a website be made viewable from localhost only?

share|improve this question
Did any of the answers help you? If so can you mark which one. I'd like to know how you actually solved this;-) –  JoshBerke Nov 8 '08 at 12:47
I'd be glad to, I still need to show the response to my friend who's going yo actually implement it. So it might be a few days but once I know, I'll accept an answer. –  Eugene M Nov 8 '08 at 15:30

7 Answers 7

up vote 4 down vote accepted

In IIS6 you can bring up the properties for the web and click on the directory security tab. Click the button in the middle of the tab for editing the IP and Domain restrictions. On this tab set all computers as denied, then add an exception for the IPs you want to allow access to this site.

I am not sure how to configure this on IIS7. I looked but couldn't find it, if I find it I will edit this answer.

Edit: Configuring IIS7

  • Josh
share|improve this answer

For some one doing it in IIS 8 / Windows 2012

1) In Server Manager, go to Manage, Add Roles and Features, Next, Next (get to Server Roles), scroll down to Web Server (IIS), expand that row, then expand Web Server, and finally expand Security. Make sure that IP and Domain Restrictions are installed.

2) In IIS Manager, drill down to the folder that you want to protect and left click select it. In the Features View of that folder select IP and Domain Restrictions In Actions choose Edit Feature Settings. Change 'Access for unspecified clients:' to 'Deny' then OK.

3) Finally go to 'Add Allow Entry' In the Actions menu. Type in the Specific IP address of your server.

Now only requests coming from your server will be allowed access. Or any server that shares that IP address. So in a small network, the office could share the IP address between all of the PCs in that offices, so all of those PCs could access that folder.

Last but not least is to remember that if your network with dynamic IP address, then if that IP changes, you will expose your URL to whoever is using that IP now. Also, everyone on that new IP address will lose access to your blog admin folder...

share|improve this answer

Depending on exactly what you want to happen if an unauthorized user tries to visit it.

You could try to setup the specific section as a virtual directory, then deny view to anonymous users. However, they will be prompted for login, and if they can login then they could see it.

share|improve this answer

Judging from the options present in the IIS MMC, you can also have a virtual directory only be accessible by certain IP-ranges. You could block everyone but I have not tried this, however.

share|improve this answer

You can grant or deny access to a site or folder from certain IPs to a site or folder. In IIS, go into properties for the site or folder in question.

(1) Click to the "Diectory Security" Tab

(2) Click Edit Under the "IP Address and Domain Name Restriction" frame.

(3) Click "Denied Access" (This tells IIS to block every IP except those you list)

(4) Click "Add..."

(5) Click "Single Computer"

(6) Enter (the IP of localhost)

Note that it is best to use an IP here (as I've described) rather than a domain name because domains can be easily forged using a hosts file.

share|improve this answer

I agree with the recommendations to use IIS "Directory Security" to block all IP address except (localhost).

That said, I'm wondering how this strategy of requiring users to remote in could possibly be more secure. Wouldn't it be more secure (as well as much simpler) to use standard IIS authentication mechanisms rather than have to manage Windows roles and permissions on the server machine?

share|improve this answer

You could simply add this .NET to the top of the page.

string MyWebServerName = currentContext.Request.ServerVariables["SERVER_NAME"];

if ( MyWebServerName == "" || MyWebServerName == "localhost" )
  // the user is local 
  // the user is NOT local
share|improve this answer
This isn't a scalable solution, as it requires access to source, has to be applied to every page, and doesn't allow for any flexibility after deployment. –  TheSoftwareDev May 16 at 13:07

Your Answer


