All the traffic gets to my IIS server through a proxy. I can't block or white list IP addresses because all the traffic comes from the proxy's IP address.
Can I use the X-Forwarded-For header with IIS?
I would proceed with caution using a HTTP header for IP filtering considering they can be controlled by the client unless your webserver takes this in account when it forwards your request.
What happens if I as not authorized send X-Forwarded-For in my headers? Will your webserver add an extra X-Forwarded-For? Will it add it below or above mine? Which one will the IIS use to validate on?
These are questions you need to be able to answer before implementing any trust in the header value.
Edit: I dont know of a better alternative, but if you are going for the one you're question you should be able to answer the questions first. I am not talking about passing through multiple proxies, but instead what happens if I put my own X-Forwarder-For header on the bottom of my request? Will your proxy add another one further up? Will there be two X-Forwarder-For? Which one will the webserver look at?
ModSecurity has this capability since it has full visibility of the transaction. Meaning it can inspect headers and payload in both the request and response. Just need to create a rule for this condition. There's one caveat, although ModSecurity was written by Microsoft and Trustwave it is considered community support. If this is a production application, you won't be able to call Microsoft Support for assistance. With that, the mailing lists for ModSecurity are great and the Trustwave engineers are very helpful. If you need paid support for rules, Trustwave has a service offering this as well as a commercial ruleset (similar to the snort model).
Other Web Application Firewalls (WAF) would work but ModSecurity is free.
This question at Stack Overflow is nominally asking the same thing.
Alternatively, the other answer describes a method by which you can set the IP address back to its pre-proxy value with a global rewrite rule. (I personally think that if you do that, you might want to add an
X-Forwarded-By header as well.) Then you can write normal rules of whatever sort you like to do the filtering.
In general, however, I agree with the comment by vcsjones on your question wherein s/he suggests that you do this filtering at the proxy, if that's an available option.
Support for web servers behind a proxy - If your web server is behind a proxy, you can configure the module to use the client IP address from an X-Forwarded-For header.
You can enable Proxy Mode support by checking the "Proxy" checkbox in the module's configuration page, then write rules to allow/deny IPs/CIDR ranges via the module.