IIS |阻止页面特定的URL(特定内部IP地址除外) [英] IIS | Block page specific url except for specific internal IP address

问题描述

我正在尝试阻止特定的网址页面( http://www.testdomain.com/login)的所有IP地址(内部管理员IP地址除外).我没有阻止模式 login 的问题，但是我想在本地进行测试，以确保内部管理IP已从/login url的阻止规则中排除.看看我到目前为止有什么...

I am trying to block a url page specific (http://www.testdomain.com/login) for all IP addresses EXCEPT for an internal admin IP address. I have no issue blocking the pattern login but I want to test locally to make sure that the internal admin IP is excluded from the blocking rule for /login url. See what I have so far...

<rewrite>
            <rules>
                <rule name="RequestBlockingRule1" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*login*" negate="false" />
                    <conditions logicalGrouping="MatchAny" trackAllCaptures="true">
                        <add input="{HTTP_X_Forwarded_For}" pattern="92.102.130.65" />
                    </conditions>
                    <action type="None" />
                </rule>
                <rule name="RequestBlockingRule2" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*" />
                    <conditions>
                        <add input="{URL}" pattern="*login*" />
                    </conditions>
                    <action type="CustomResponse" statusCode="404" statusReason="File or directory not found." statusDescription="The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable." />
                </rule>

我还想要重复相同的规则，但要查询 http://www的查询字符串. testdomain.com/home.aspx ?ctl = login

What I also want is to duplicate same rule but for a query string of http://www.testdomain.com/home.aspx?ctl=login

                <rule name="RequestBlockingRule3" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*ctl=login*" negate="false" />
                    <conditions logicalGrouping="MatchAny" trackAllCaptures="true">
                        <add input="{HTTP_X_Forwarded_For}" pattern="93.107.170.85" />
                    </conditions>
                    <action type="None" />
                </rule>
                <rule name="RequestBlockingRule4" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*" />
                    <conditions>
                        <add input="{QUERY_STRING}" pattern="*ctl=login*" />
                    </conditions>
                    <action type="CustomResponse" statusCode="404" statusReason="File or directory not found." statusDescription="The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable." />
                </rule>
            </rules>
        </rewrite>

我所做的是尝试排除特定模式的内部IP，然后执行实际的阻止规则.有谁知道a)更好的选择或b)看到我可能做错的事情或可能做错的事情(理想情况下，我想先在本地使用实际IP地址在实际服务器上使用这些规则，然后再对这些规则进行测试).谢谢

What I've done is tried to exclude internal IP for specific pattern and then followed with the actual blocking rule. Does anyone know either a) a better alternative or b) see what I may or may not be doing wrong (ideally I'd like to test these rules out locally before I use them on actual server using real IP address). Thanks

推荐答案

我建议使用一些不同的方法:

I want to suggest to use a bit different way:

• 将重写映射用于白名单的IP列表
• 仅使用两个规则，而不使用<action type="None" />

配置代码为:

<rewrite>
   <rules>
         <rule name="Block login page" stopProcessing="true">
            <match url="^login$" />
            <conditions>
              <add input="{Authorised Admin IPs:{REMOTE_ADDR}}" pattern="1" negate="true" />
            </conditions>
            <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
          </rule>
          <rule name="Block query string" stopProcessing="true">
            <match url=".*" />
            <conditions>
                <add input="{Authorised Admin IPs:{REMOTE_ADDR}}" pattern="1" negate="true" />
                <add input="{QUERY_STRING}" pattern="ctl=login" />
            </conditions>
            <action type="CustomResponse" statusCode="403" statusReason="Forbidden" statusDescription="Forbidden" />
        </rule>
    </rules>
    <rewriteMaps> 
        <!-- This is your list of white-listed IP's-->
        <rewriteMap name="Authorised Admin IPs">
            <add key="92.102.130.65" value="1" />
            <add key="93.107.170.85" value="1" />
            <!-- local IPs-->
            <add key="127.0.0.1" value="1" />
            <add key="localhost" value="1" />
            <add key="::1" value="1" />
        </rewriteMap>         
    </rewriteMaps>
</rewrite>

此规则禁止所有IP地址不在白名单中的用户对该URL的所有请求

This rule is blocking all requests to this URLs for all users, which has non white-listed IPs

• http://www.testdomain.com/login
• 任何网址，其中查询字符串中包含ctl=login

• http://www.testdomain.com/login
• Any url, which has ctl=login in query string

在上面的配置中，我正在使用{REMOTE_ADDR}.但是您可能需要使用{HTTP_X_Forwarded_For}.这取决于您的网络基础架构(如果您有代理或负载均衡器)

In my config above, i am using {REMOTE_ADDR}. But you might need to use {HTTP_X_Forwarded_For}. It depends on you network infrastructure (if you have proxies or load balancers)

您可以通过添加/删除本地IP表单重写映射来在本地测试此规则

You can test this rules locally by adding/removing your local IP form rewrite map

这篇关于IIS |阻止页面特定的URL(特定内部IP地址除外)的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！