Introduction
The Dynamic IP Restrictions for IIS 7.0 is a module that provides protection against denial of service and brute force attacks on web server and web sites. Such protection is provided by temporarily blocking IP addresses of the HTTP clients who make unusually high number of concurrent requests or who make large number of requests over small period of time.
Features
The Dynamic IP Restrictions includes these key features:
- Blocking of IP addresses based on number of concurrent requests - If HTTP client makes many concurrent requests then that client's IP address gets temporarily blocked.
- Blocking of IP address based on number of requests over a period of time - If HTTP client makes many requests over short period of time then that client's IP address gets temporarily blocked.
- Various deny actions - it is possible to specify what response to return to an HTTP client whose IP address is blocked. The module can return status codes 403 and 404 or just drop the HTTP connection and do not return any response.
- Logging of denied requests - all denied requests can be logged into a W3C formatted log file.
- Displaying currently blocked IP addresses - a list of currently blocked IP addresses can be obtained by using IIS Manager or by using IIS RSCA API's.
- IPv6 - the module fully supports IPv6 addresses.
In additions to these features, the Dynamic IP Restrictions for IIS 7.0 provides the same functionality that exists in IIS 7.0 built-in IPv4 and Domain Restrictions. Because of that the Dynamic IP Restrictions is provided as a replacement for IPv4 and Domain Restrictions.
Installation Instructions
Getting Dynamic IP Restrictions
Prerequisites
Windows Server 2008, Windows Vista SP1, Windows Server 2008 R2 or Windows 7
Installation on a machine with IPv4 and Domain Restrictions
If IIS already has IPv4 Address and IP restrictions module enabled then Dynamic IP Restrictions installer will need to un-install the existing module in order to continue the setup process. Note that the existing IPv4 configuration will be preserved while old module is removed and new module is installed.
Configuring Dynamic IP Restrictions
The Dynamic IP Restrictions can be configured by using either IIS Manager, IIS configuration APIs or by using command line tool appcmd.
To access Dynamic IP Restriction settings in IIS Manager follow these steps:
- Open IIS Manager
- In the left-hand side tree view select server node if you want to configure server-wide settings, or select a site node to configure site-specific settings.
- In the Features View click "Dynamic IP Address and Domain Restrictions"
- In the "Dynamic IP Address and Domain Restrictions" main page you can specify the IP addresses that needs to be either always allowed or always denied. Adding an Allow entry for an IP address ensures that the address will never be blocked even if its request pattern fits the request deny criteria specified in Dynamic Restrictions settings. Adding a Deny entry for an IP address ensures that the address will always be blocked regardless of Dynamic Restrictions settings.
The actual Dynamic Restrictions settings can be accessed by clicking "Edit Dynamic Restrictions" in the Actions pane on right hand side:
- Use the Dynamic IP Restrictions page to configure the settings for dynamically blocking IP addresses:
Blocking of IP address based on number of concurrent requests
When using this option, the server will allow any client's IP address to make only a configurable number of concurrent requests. Any additional requests that exceed the specified limit will be denied.
A simple way to test this feature is to set the maximum number of concurrent requests to 2 by either using UI or by executing appcmd command:
%WINDIR%\system32\inetsrv\appcmd.exe set config -section:system.webServer/security/ipSecurity /dynamicRestrictions.denyByConcurrentRequests.enabled:"True" /dynamicRestrictions.denyByConcurrentRequests.maxConcurrentRequests:"2" /commit:apphost
In the root folder of your web site create a file test.aspx and paste the following content into it:
<%@ Page Language="C#" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<script runat="server">
protected void Page_Load(object sender, EventArgs e)
{
System.Threading.Thread.Sleep(3000);
}
</script>
<html xmlns="http://www.w3.org/1999/xhtml">
<head runat="server">
<title>Dynamic IP Restrictions Test</title>
</head>
<body>
<form id="form1" runat="server">
<div>
<h1>Hello World!</h1>
</div>
</form>
</body>
</html>
This ASP.NET page for 3 seconds before returning any response. Save the file and then open web browser, request http://localhost/test.aspx and then continuously hit F5 to refresh the browser. This will result in browser making more than 2 concurrent requests so as a result you will see the 403 - Forbidden error from server:
Important: When configuring number of concurrent requests for a real web application, thoroughly test the limit that you pick to ensure that valid HTTP clients do not get blocked. This is especially important for Rich Internet Applications that have AJAX enabled web pages and serve media content.
Blocking of IP addresses based on number of requests over time
When using this option the server will deny requests from any HTTP client's IP address that makes more than configurable number of requests over a period of time. The IP address will remain blocked until the number of requests within a time period drops below the configured limit.
To test this feature set the "Maximum number of requests" to 5 and "Time period" to 5 by using either IIS Manager or by executing appcmd command:
%WINDIR%\system32\inetsrv\appcmd.exe set config -section:system.webServer/security/ipSecurity /dynamicRestrictions.denyByRequestsOverTime.enabled:"True" /dynamicRestrictions.denyByRequestsOverTime.maxRequests:"5" /dynamicRestrictions.denyByRequestsOverTime.timeout:"00:00:05" /commit:apphost
Open web browser, request http://localhost/welcome.png and then hit F5 to continuously refresh the page. This will generate more than 5 requests over 5 seconds so as a result you will see server responding with 403 - Forbidden status code:
If you wait for 10 seconds and then make a request then the request will succeed as the IP Address will be removed from the deny list.
Important: When configuring number of allowed requests over time for a real web application, thoroughly test the limits that you pick to ensure that valid HTTP clients do not get blocked. This is especially important for Rich Internet Applications that have AJAX enabled web pages and serve media content.
Deny Actions
The module can be configured to perform the following actions when denying requests for IP addresses:
- Send 403 (Forbidden) response to the client;
- Send 404 (File not found) response to the client;
- Abort request by closing the HTTP connection, without sending any response to the client.
Displaying currently blocked IP addresses
To display currently blocked IP addresses in IIS Manager, open the "Dynamic IP and Domain Restrictions" feature view and click "Show Blocked Addresses..." action:
The IIS manager will display the currently blocked IP addresses with the reasons of why they are blocked. Note that you can permanently allow or deny a particular temporarily blocked IP address by using "Add to allow list" and "Add to deny list" actions:
Related Content
Comments