All the traffic gets to my IIS server through a proxy. I can't block or white list IP addresses because all the traffic comes from the proxy's IP address.

Can I use the X-Forwarded-For header with IIS?

  • You should be blocking people at the proxy instead. – vcsjones Jul 12 '11 at 14:07

I would proceed with caution using a HTTP header for IP filtering considering they can be controlled by the client unless your webserver takes this in account when it forwards your request.

What happens if I as not authorized send X-Forwarded-For in my headers? Will your webserver add an extra X-Forwarded-For? Will it add it below or above mine? Which one will the IIS use to validate on?

These are questions you need to be able to answer before implementing any trust in the header value.

Edit: I dont know of a better alternative, but if you are going for the one you're question you should be able to answer the questions first. I am not talking about passing through multiple proxies, but instead what happens if I put my own X-Forwarder-For header on the bottom of my request? Will your proxy add another one further up? Will there be two X-Forwarder-For? Which one will the webserver look at?

  • First, can you suggest a better alternative? Second, it does not work like this, the web server wont add this header at all!! this header is added by proxies.And it does not work like this, if the request passes through multiple proxies, each proxy wont add another "x-forwarded-for" header, it would append to the value of the first header. – Bahi Jul 12 '11 at 6:32
  • 2
    on the proxy, strip any X-Forwarded-For prior to appending one with the clients IP. – 3molo Jul 12 '11 at 17:32
  • 1
    If you manually add the x-forwarded header to your request when you send it, my proxy wont add another header, it will add its IP to the header value that you added, it will look like this (X-Forwarded-For:,, In addition, some proxies can be configured to accept requests with x-forwarded-header from specific IPs as well. – Bahi Jul 13 '11 at 7:04
  • @Bahi, Then you need to know what IP address to look for in that chain. Because I spoof my X-Header-For, and you add my real one then your IIS need to know which one to use. Both in normal cases and in extreme cases (for example if I add another 2 X-Header-For). – Chris Dale Jul 13 '11 at 7:14
  • I hope my question gets answered first, if IIS can use XFF header to block IPs....Then I promise you I will pay attention to the other stuff :) – Bahi Jul 13 '11 at 9:12

ModSecurity has this capability since it has full visibility of the transaction. Meaning it can inspect headers and payload in both the request and response. Just need to create a rule for this condition. There's one caveat, although ModSecurity was written by Microsoft and Trustwave it is considered community support. If this is a production application, you won't be able to call Microsoft Support for assistance. With that, the mailing lists for ModSecurity are great and the Trustwave engineers are very helpful. If you need paid support for rules, Trustwave has a service offering this as well as a commercial ruleset (similar to the snort model).

Other Web Application Firewalls (WAF) would work but ModSecurity is free.


This question at Stack Overflow is nominally asking the same thing.

You can use the URL Rewrite module to do your filtering by adding a condition around the {HTTP_X_FORWARDED_FOR} variable as described in this answer.

Alternatively, the other answer describes a method by which you can set the IP address back to its pre-proxy value with a global rewrite rule. (I personally think that if you do that, you might want to add an X-Forwarded-By header as well.) Then you can write normal rules of whatever sort you like to do the filtering.

In general, however, I agree with the comment by vcsjones on your question wherein s/he suggests that you do this filtering at the proxy, if that's an available option.


IIS 7 and beyond include the Dynamic IP Restrictions module, which supports filtering client requests by their X-Forwarded-For header, which is added to a request when using an AWS load balancer:

Support for web servers behind a proxy - If your web server is behind a proxy, you can configure the module to use the client IP address from an X-Forwarded-For header.

You can enable Proxy Mode support by checking the "Proxy" checkbox in the module's configuration page, then write rules to allow/deny IPs/CIDR ranges via the module.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.