Security

Ask something
Discussion Locked

Restrict access in IIS 5.0

0 helpful
5 replies

by swomack 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I am running a Windows 2000 web server with IIS 5. We have to allow anonymous access. I notice in the log file that a lot of cmd.exe attempts are being made from different ip addresses in a particular range. Let's say they all start with 201 and every address resolves back to a provider in which I know we do not have valid users, say South Pole Network Information Center. WhoIs shows their NetRange as 201.0.0.0 - 201.255.255.255 ( it is not really 201 ). How can I block that NetRange in IIS 5. I have gone into the properties of the website and under Directory Security chosen IP address and domain restriction. When I go to add a Group of Computers to deny access to, it asks for Network ID and Subnet Mask. What network ID and subnet mask should I used to block the NetRange described above? The CIDR is 201.0.0.0/8 and I still don't understand CIDR and supernetting.

5 replies

by joseph moore

Do you have a firewall in front of this web server? That would be a better way of blocking connectivity is have the firewall block it.

If not, then I guess you could try blocking Network ID 201.0.0.0 with a subnet mask of 255.0.0.0

I have never tried blocking a range of IP addresses from accessing a web site using IIS tools. The firewall usually is used for this type of task.

hope this helps

by sgt_shultz

yes, i agree, a firewall. because even if you get South Pole blocked somebody from the North Pole is going to get bored and have a swing at you...imho at a minimum you need to harden your os by being up to date on your critical updates and service packs for win2k and iis. and consider a dmz for your public servers like the webserver. check out os hardening tips and dmz tips at www.cert.org

This discussion is closed to new replies.