title: IIS | Block page specific url except for specific internal IP address
body: <p>I am trying to block a url page specific (<a href="http://www.testdomain.com/login" rel="nofollow noreferrer">http://www.testdomain.com/login</a>) for all IP addresses EXCEPT for an internal admin IP address. I have no issue blocking the pattern <em>login</em> but I want to test locally to make sure that the internal admin IP is excluded from the blocking rule for /login url. See what I have so far...
  </p>
  
  <pre class="lang-xml prettyprint-override"><code>&lt;rewrite&gt;
              &lt;rules&gt;
                  &lt;rule name="RequestBlockingRule1" enabled="true" patternSyntax="Wildcard" stopProcessing="true"&gt;
                      &lt;match url="*login*" negate="false" /&gt;
                      &lt;conditions logicalGrouping="MatchAny" trackAllCaptures="true"&gt;
                          &lt;add input="{HTTP_X_Forwarded_For}" pattern="92.102.130.65" /&gt;
                      &lt;/conditions&gt;
                      &lt;action type="None" /&gt;
                  &lt;/rule&gt;
                  &lt;rule name="RequestBlockingRule2" patternSyntax="Wildcard" stopProcessing="true"&gt;
                      &lt;match url="*" /&gt;
                      &lt;conditions&gt;
                          &lt;add input="{URL}" pattern="*login*" /&gt;
                      &lt;/conditions&gt;
                      &lt;action type="CustomResponse" statusCode="404" statusReason="File or directory not found." statusDescription="The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable." /&gt;
                  &lt;/rule&gt;
  </code></pre>
  
  <p>What I also want is to duplicate same rule but for a query string of <a href="http://www.testdomain.com/home.aspx" rel="nofollow noreferrer">http://www.testdomain.com/home.aspx</a><strong>?ctl=login</strong></p>
  
  <pre class="lang-xml prettyprint-override"><code>                &lt;rule name="RequestBlockingRule3" enabled="true" patternSyntax="Wildcard" stopProcessing="true"&gt;
                      &lt;match url="*ctl=login*" negate="false" /&gt;
                      &lt;conditions logicalGrouping="MatchAny" trackAllCaptures="true"&gt;
                          &lt;add input="{HTTP_X_Forwarded_For}" pattern="93.107.170.85" /&gt;
                      &lt;/conditions&gt;
                      &lt;action type="None" /&gt;
                  &lt;/rule&gt;
                  &lt;rule name="RequestBlockingRule4" patternSyntax="Wildcard" stopProcessing="true"&gt;
                      &lt;match url="*" /&gt;
                      &lt;conditions&gt;
                          &lt;add input="{QUERY_STRING}" pattern="*ctl=login*" /&gt;
                      &lt;/conditions&gt;
                      &lt;action type="CustomResponse" statusCode="404" statusReason="File or directory not found." statusDescription="The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable." /&gt;
                  &lt;/rule&gt;
              &lt;/rules&gt;
          &lt;/rewrite&gt;
  </code></pre>
  
  <p>What I've done is tried to exclude internal IP for specific pattern and then followed with the actual blocking rule. Does anyone know either a) a better alternative or b) see what I may or may not be doing wrong (ideally I'd like to test these rules out locally before I use them on actual server using real IP address). Thanks</p>