Question

I’m developing an ASP MVC3 application and I have some views that are related to the security of the webpage (mostly creating users and groups). This page is only used by people inside the local network and even though they need to access with their user and password I would like to prevent people that are using the application from outside the network to access them as an additional security measure.

Is this possible with IIS and ASP MVC3?

Answer 1

Yes, you can restrict access to a paths by IP address by using the web.config.

for example:

<location path="/localOnly/">
  <system.webServer>
    <security>
      <ipSecurity allowUnlisted="false">
        <clear/>
        <add ipAddress="127.*.*.*"/>
        <add ipAddress="1.*.*.*"/>
        <add ipAddress="192.*.*.*"/>
      </ipSecurity>
    </security>
  </system.webServer>
</location>

So just check on which local subnet your site is running, and add it.

Edit: I assume you already have the "even though they need to access with their user and password" part managed by just using the default mvc stuff right?