I've been told that I might have more luck posting here than on Stack Exchange, so here goes:
I'm looking for a way to lock down a 3rd party application in IIS. It's a web service, so there's no login page or anything, it's meant for use in a VPN environment. I'm trying to put it online without a VPN and am thinking of ways to add some sort of security to it. I need to restrict it to certain networks, its a business product, so I can probably get away with saying that you need to be on a private network (ie not public wifi) to use it. My idea is to use IP Address Restriction in IIS, and write an app that the users install and have it update the server with their current IP every few minutes, the server then blocks all except the ones recently updated.
How secure would this be? Is there a major flaw in this idea? Or is there perhaps a better way to do this in IIS?
edit: To clarify - the software is not modifiable by me. It consists of a few web applications in IIS, that are WCF web services. Then the client computer has a program which connects to those. I am not able to edit the client program or the server, I'm merely hoping to either allow or deny the connection by injecting some sort of security measures onto IIS, or perhaps intercept the packets in conjunction with my own custom software that could be installed on the client PC to do the authentication.