Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

All the traffic gets to my IIS server through a proxy. I can't block or white list IP addresses because all the traffic comes from the proxy's IP address.

Can I use the X-Forwarded-For header with IIS?

share|improve this question
    
You should be blocking people at the proxy instead. –  vcsjones Jul 12 '11 at 14:07
add comment

3 Answers

I would proceed with caution using a HTTP header for IP filtering considering they can be controlled by the client unless your webserver takes this in account when it forwards your request.

What happens if I as not authorized send X-Forwarded-For in my headers? Will your webserver add an extra X-Forwarded-For? Will it add it below or above mine? Which one will the IIS use to validate on?

These are questions you need to be able to answer before implementing any trust in the header value.

Edit: I dont know of a better alternative, but if you are going for the one you're question you should be able to answer the questions first. I am not talking about passing through multiple proxies, but instead what happens if I put my own X-Forwarder-For header on the bottom of my request? Will your proxy add another one further up? Will there be two X-Forwarder-For? Which one will the webserver look at?

share|improve this answer
    
First, can you suggest a better alternative? Second, it does not work like this, the web server wont add this header at all!! this header is added by proxies.And it does not work like this, if the request passes through multiple proxies, each proxy wont add another "x-forwarded-for" header, it would append to the value of the first header. –  Bahi Jul 12 '11 at 6:32
2  
on the proxy, strip any X-Forwarded-For prior to appending one with the clients IP. –  3molo Jul 12 '11 at 17:32
1  
If you manually add the x-forwarded header to your request when you send it, my proxy wont add another header, it will add its IP to the header value that you added, it will look like this (X-Forwarded-For: 192.168.0.1, 172.16.0.1, 10.0.0.1). In addition, some proxies can be configured to accept requests with x-forwarded-header from specific IPs as well. –  Bahi Jul 13 '11 at 7:04
    
@Bahi, Then you need to know what IP address to look for in that chain. Because I spoof my X-Header-For, and you add my real one then your IIS need to know which one to use. Both in normal cases and in extreme cases (for example if I add another 2 X-Header-For). –  Chris Andrè Dale Jul 13 '11 at 7:14
    
I hope my question gets answered first, if IIS can use XFF header to block IPs....Then I promise you I will pay attention to the other stuff :) –  Bahi Jul 13 '11 at 9:12
show 1 more comment

Windows server 2012 can.

Source: http://spiffy.sg/general/why-i-love-windows-server-2012-part-1-iis-8-0/

share|improve this answer
1  
welcome to Information Security. Can you elaborate a bit more than just an anonymous link? Perhaps summarize a bit from that site (assuming it's not a problem of plagiarism...) E.g. please see the FAQ regarding posting links, and you can also read How to Answer. –  AviD Oct 15 '12 at 21:07
add comment

ModSecurity has this capability since it has full visibility of the transaction. Meaning it can inspect headers and payload in both the request and response. Just need to create a rule for this condition. There's one caveat, although ModSecurity was written by Microsoft and Trustwave it is considered community support. If this is a production application, you won't be able to call Microsoft Support for assistance. With that, the mailing lists for ModSecurity are great and the Trustwave engineers are very helpful. If you need paid support for rules, Trustwave has a service offering this as well as a commercial ruleset (similar to the snort model).

Other Web Application Firewalls (WAF) would work but ModSecurity is free.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.