Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 5 down vote favorite

All the traffic gets to the IIS server through a proxy, I cant block or white list IPs, because all the traffic comes from the proxy's IP, Can I use the X-Forwarded-For header with IIS?

share|improve this question
You should be blocking people at the proxy instead. – vcsjones Jul 12 '11 at 14:07

2 Answers

up vote 3 down vote

I would proceed with caution using a HTTP header for IP filtering considering they can be controlled by the client unless your webserver takes this in account when it forwards your request.

What happens if I as not authorized send X-Forwarded-For in my headers? Will your webserver add an extra X-Forwarded-For? Will it add it below or above mine? Which one will the IIS use to validate on?

These are questions you need to be able to answer before implementing any trust in the header value.

Edit: I dont know of a better alternative, but if you are going for the one you're question you should be able to answer the questions first. I am not talking about passing through multiple proxies, but instead what happens if I put my own X-Forwarder-For header on the bottom of my request? Will your proxy add another one further up? Will there be two X-Forwarder-For? Which one will the webserver look at?

share|improve this answer
First, can you suggest a better alternative? Second, it does not work like this, the web server wont add this header at all!! this header is added by proxies.And it does not work like this, if the request passes through multiple proxies, each proxy wont add another "x-forwarded-for" header, it would append to the value of the first header. – Bahi Jul 12 '11 at 6:32
2  
on the proxy, strip any X-Forwarded-For prior to appending one with the clients IP. – 3molo Jul 12 '11 at 17:32
1  
If you manually add the x-forwarded header to your request when you send it, my proxy wont add another header, it will add its IP to the header value that you added, it will look like this (X-Forwarded-For: 192.168.0.1, 172.16.0.1, 10.0.0.1). In addition, some proxies can be configured to accept requests with x-forwarded-header from specific IPs as well. – Bahi Jul 13 '11 at 7:04
@Bahi, Then you need to know what IP address to look for in that chain. Because I spoof my X-Header-For, and you add my real one then your IIS need to know which one to use. Both in normal cases and in extreme cases (for example if I add another 2 X-Header-For). – Chris Andrè Dale Jul 13 '11 at 7:14
I hope my question gets answered first, if IIS can use XFF header to block IPs....Then I promise you I will pay attention to the other stuff :) – Bahi Jul 13 '11 at 9:12
show 1 more comment
up vote 0 down vote

Windows server 2012 can.

Source: http://spiffy.sg/general/why-i-love-windows-server-2012-part-1-iis-8-0/

share|improve this answer
1  
welcome to IT Security. Can you elaborate a bit more than just an anonymous link? Perhaps summarize a bit from that site (assuming it's not a problem of plagiarism...) E.g. please see the FAQ regarding posting links, and you can also read How to Answer. – AviD♦ Oct 15 '12 at 21:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.