More cool stuff from IIS team - The Dynamic IP Restrictions module (beta)

Hot off the presses!

The Dynamic IP Restrictions includes these key features:
  • Blocking of IP addresses based on number of concurrent requests - If HTTP client makes many concurrent requests then that client's IP address gets temporarily blocked.
  • Blocking of IP address based on number of requests over a period of time - If HTTP client makes many requests over short period of time then that client's IP address gets temporarily blocked.
  • Various deny actions - it is possible to specify what response to return to an HTTP client whose IP address is blocked. The module can return status codes 403 and 404 or just drop the HTTP connection and do not return any response.
  • Logging of denied requests – all dynamically denied requests can be logged into a W3C formatted log file.
  • Displaying currently blocked IP addresses - a list of currently blocked IP addresses can be obtained by using IIS Manager or by using IIS RSCA API's.
  • IPv6 - the module fully supports IPv6 addresses.
In additions to these features, the Dynamic IP Restrictions for IIS 7.0 provides the same functionality that exists in IIS 7.0 built-in IPv4 and Domain Restrictions. Because of that the Dynamic IP Restrictions is provided as a replacement for IPv4 and Domain Restrictions.More informationModule walkthrough: http://learn.iis.net/page.aspx/548/using-dynamic-ip-restrictions/Support forum: http://forums.iis.net/1043.aspx
Published Monday, February 16, 2009 10:03 PM by steve schofield
Filed under:

Comments

# re: More cool stuff from IIS team - The Dynamic IP Restrictions module

Tuesday, February 17, 2009 2:09 AM by ianniv

Urm, apache has had these features for about a decade..but I'm happy that IIS are there now.

# re: More cool stuff from IIS team - The Dynamic IP Restrictions module

Tuesday, February 17, 2009 10:48 AM by dbarker

Finally! Dynamic blocking rules have been sorely missing for some time, and firewall based solutions are expensive on a number of levels. This is a welcome extension.  Now if they can get it out of beta.

# re: More cool stuff from IIS team - The Dynamic IP Restrictions module

Tuesday, February 17, 2009 11:51 AM by steve schofield

Hope they come out with something for FTP also. I'm not familiar enough with Apache beyond the basics.  

# re: More cool stuff from IIS team - The Dynamic IP Restrictions module (beta)

Tuesday, February 17, 2009 12:29 PM by Downer Dave

Yawn.  Wake me when IIS runs in true 64-bit mode, doesn't have to recycle the app pool every 2 hours on a busy web site, and is as reliable as Apache.

---Downer Dave

P.S. This from a dude that doesn't like Apache.

# re: More cool stuff from IIS team - The Dynamic IP Restrictions module (beta)

Tuesday, February 17, 2009 5:59 PM by mike

Great - id like to see this functionality implemented in every server process on the internet. It really makes architectural sense to me to embed this functionality in every server. As a lucky side effect data centres would use more energy with that extra processing requirement. Power companies could then drag us out of the financial crisis.

# re: More cool stuff from IIS team - The Dynamic IP Restrictions module (beta)

Tuesday, February 17, 2009 7:44 PM by steve schofield

Maybe the extra bandwidth saved could be allocated to home users. :)  

# re: More cool stuff from IIS team - The Dynamic IP Restrictions module (beta)

Thursday, February 19, 2009 2:08 AM by Jason P Sage

Well, I like many Web Server software - and of course I'm biased for my own - Jegas Application Server, but I am pleased to hear my friendly Microsoft Shop Clients will have this ability, though Downer Dave's comment made me grin at the same time.

Personally I think techniques like these and others like "Knock Knock - Who's There" for secure systems, and variaties of the said blocking IP techniques that allow - "forgiveness"... (Time elapsed release of ban) ... 2nd Offense... (Longer Time Elapsed Forgiveness) - 3rd Time - permanent/Admin discretion ban implemented - or some user configurable variation/version of this as some IP's are genuinely used by nuisance user one day, and the next the same pc is used by someone's Grand Mother... But obviously repeated attempts from the same IP warrant the Server protecting its computing horse power and data via whatever means available - BAN BAN BAN :)

--Jason P Sage

# re: More cool stuff from IIS team - The Dynamic IP Restrictions module (beta)

Thursday, February 26, 2009 5:59 AM by waleefi

Nice stuff, if I just could add IPs to block from my ASP.NET app, this would be perfect!