IIS Dynamic IP Restrictions

IIS Dynamic IP Restrictions (DIPR) is a built-in IIS module that automatically blocks IP addresses based on request rate and concurrent connections. It operates at the IIS kernel level, blocking abusive traffic before any application code runs. This protects all resources including pages, APIs, static assets, images, CSS, and JavaScript files.

The Contensive upgrade script configures Dynamic IP Restrictions automatically for every IIS site during installation and upgrades.

Emergency Disable

If Dynamic IP Restrictions is causing problems after installation, run this PowerShell command on the server to immediately disable it for a site. Replace YourSiteName with the IIS site name (which is the Contensive app name).

Import-Module WebAdministration
$siteName = "YourSiteName"
Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" -filter "system.webServer/security/dynamicIpSecurity/denyByRequestRate" -name "enabled" -value "False"
Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" -filter "system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests" -name "enabled" -value "False"

This takes effect immediately with no IIS restart required. All traffic will be allowed through as it was before the upgrade. To disable it for every site on the server at once:

Import-Module WebAdministration
Get-Website | ForEach-Object {
    $s = $_.Name
    Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$s" -filter "system.webServer/security/dynamicIpSecurity/denyByRequestRate" -name "enabled" -value "False"
    Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$s" -filter "system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests" -name "enabled" -value "False"
    Write-Host "Disabled DIPR for $s"
}

Note that the next Contensive upgrade will re-enable Dynamic IP Restrictions with the default settings unless the upgrade script is also modified.

How It Works

Dynamic IP Restrictions monitors two metrics per IP address:

• Request rate — how many requests an IP sends within a time window
• Concurrent connections — how many simultaneous connections an IP holds open

When either threshold is exceeded, the IP is temporarily blocked. The block is released automatically when the request rate drops below the threshold. No manual intervention is required.

Blocked connections are silently dropped (the Abort deny action). The client receives no response at all, which is the preferred behavior for scanners and bots because it gives them no information about the server.

Default Configuration

The Contensive upgrade script applies these settings to each IIS site:

These defaults are designed to be permissive enough for legitimate users while blocking vulnerability scanners and rapid-fire bots. Legitimate users rarely exceed 5-10 requests per second sustained. Automated scanners like Nikto typically run at 50-200+ requests per second.

Adjusting Request Rate Limiting

To change the request rate threshold, open IIS Manager and navigate to your site. Double-click IP Address and Domain Restrictions, then click Edit Dynamic Restriction Settings in the Actions panel.

The two rate settings work together:

• Number of requests — the maximum number of requests allowed before blocking triggers
• Time period (milliseconds) — the time window for counting requests

For example, 200 requests with a 10000 millisecond (10 second) period means 200 requests per 10 seconds, or approximately 20 requests per second.

To make the limit stricter, reduce the number of requests or reduce the time period. To make it more permissive, increase either value.

Tuning guidance:

• Start permissive (500 requests per 10000ms) and tighten after watching logs
• If you have a search index crawler hitting the site, whitelist its IP addresses before tightening the rate limit
• Monitor IIS logs for false positives after changing thresholds

Via PowerShell

$siteName = "YourSiteName"

Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/dynamicIpSecurity/denyByRequestRate" `
    -name "maxRequests" -value 300

Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/dynamicIpSecurity/denyByRequestRate" `
    -name "requestIntervalInMilliseconds" -value 10000

Adjusting Concurrent Connection Limiting

Concurrent connection limiting catches slow-rate scanners that maintain many open connections simultaneously. The default limit is 25 concurrent connections per IP.

To adjust, use the same Edit Dynamic Restriction Settings dialog in IIS Manager and change the Maximum number of concurrent requests value.

Via PowerShell

$siteName = "YourSiteName"

Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests" `
    -name "maxConcurrentRequests" -value 50

Disabling Dynamic IP Restrictions

To disable rate limiting entirely for a site, set the enabled property to False for both restriction types.

Via IIS Manager

Open IP Address and Domain Restrictions for the site, click Edit Dynamic Restriction Settings, and uncheck both options.

Via PowerShell

$siteName = "YourSiteName"

# Disable request rate limiting
Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/dynamicIpSecurity/denyByRequestRate" `
    -name "enabled" -value "False"

# Disable concurrent connection limiting
Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests" `
    -name "enabled" -value "False"

Note that the next Contensive upgrade will re-enable Dynamic IP Restrictions with the default settings. To permanently disable it, the upgrade script must also be modified.

Whitelisting IP Addresses

Add static Allow rules for IP addresses that should never be blocked. This is important for office networks, VPN endpoints, monitoring services, Googlebot, and the server's own IP if it makes internal requests.

Via IIS Manager

In IP Address and Domain Restrictions, click Add Allow Entry in the Actions panel. Enter the IP address or range to allow.

Via PowerShell

$siteName = "YourSiteName"

# Allow a single IP
Add-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/ipSecurity" `
    -name "." `
    -value @{ipAddress="203.0.113.10"; allowed="True"}

# Allow an IP range using subnet mask
Add-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/ipSecurity" `
    -name "." `
    -value @{ipAddress="10.0.0.0"; subnetMask="255.0.0.0"; allowed="True"}

Blacklisting IP Addresses

Add static Deny rules to permanently block specific IP addresses regardless of their request behavior.

Via IIS Manager

In IP Address and Domain Restrictions, click Add Deny Entry in the Actions panel.

Via PowerShell

$siteName = "YourSiteName"

Add-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/ipSecurity" `
    -name "." `
    -value @{ipAddress="198.51.100.50"; allowed="False"}

To remove a block:

Remove-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/ipSecurity" `
    -name "." `
    -AtElement @{ipAddress="198.51.100.50"}

Configuring Proxy Mode

If your server is behind a load balancer, reverse proxy, or CDN, the IP address seen by IIS is the proxy IP, not the real client. This causes Dynamic IP Restrictions to block the proxy instead of the actual abusive client.

Enable Proxy Mode so IIS reads the real client IP from the X-Forwarded-For header.

Via IIS Manager

In IP Address and Domain Restrictions, click Edit Feature Settings, then check Enable Proxy Mode.

Via PowerShell

$siteName = "YourSiteName"

Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/dynamicIpSecurity" `
    -name "enableProxyMode" -value "True"

Warning: Only enable Proxy Mode if you have a trusted proxy in front of your server. Without a proxy, a malicious client can spoof any IP address by forging the X-Forwarded-For header, effectively bypassing all IP-based restrictions.

Changing the Deny Action

The deny action controls what happens when an IP is blocked. The default is Abort (silent connection drop).

Via PowerShell

$siteName = "YourSiteName"

# Options: AbortRequest, Forbidden, Unauthorized, NotFound
Set-WebConfigurationProperty -pspath "MACHINE/WEBROOT/APPHOST/$siteName" `
    -filter "system.webServer/security/dynamicIpSecurity" `
    -name "denyAction" -value "Forbidden"

Monitoring Blocked Requests

When using Abort mode, blocked connections are not logged in IIS access logs because the connection is dropped before a response is written.

To see what is being blocked:

• Switch temporarily to Forbidden deny mode so 403 responses appear in IIS access logs
• Enable Failed Request Tracing for status code 403
• Check Event Viewer under Windows Logs and Application, filter for source IIS-W3SVC-WP

Prerequisites

Dynamic IP Restrictions requires the IIS IP and Domain Restrictions feature to be installed. The Contensive install script checks for this automatically and installs it if missing.

To verify or install manually:

Via PowerShell (Windows Server)

# Check if installed
Get-WindowsFeature Web-IP-Security

# Install if needed
Install-WindowsFeature -Name Web-IP-Security

Via Server Manager

Open Server Manager, navigate to Add Roles and Features, then Web Server (IIS), Web Server, Security, and check IP and Domain Restrictions.

Relationship to Contensive Abuse Detection

Dynamic IP Restrictions handles blunt-force rate blocking at the IIS kernel level with no application code involved. The Contensive Abuse Detection addon (when implemented) adds a complementary layer of protection:

Both systems work together. Dynamic IP Restrictions provides immediate, zero-overhead blocking for high-volume attacks. The Abuse Detection addon provides intelligent pattern-based detection that catches low-volume attacks like a single XSS probe in a query string.