{"id":12724,"date":"2020-06-22T08:36:26","date_gmt":"2020-06-22T08:36:26","guid":{"rendered":"https:\/\/www.gmass.co\/blog\/?p=12724"},"modified":"2020-07-09T16:22:19","modified_gmt":"2020-07-09T16:22:19","slug":"block-ip-addresses-aws-windows-iis","status":"publish","type":"post","link":"https:\/\/www.gmass.co\/blog\/block-ip-addresses-aws-windows-iis\/","title":{"rendered":"How to block IP Addresses in an AWS\/Windows\/IIS environment"},"content":{"rendered":"

Here’s the problem \u2014 you’re hosting a Windows server running IIS<\/strong> on AWS<\/strong>, and your web app is getting hammered with requests that look like this:<\/p>\n

 https:\/\/www.mywebsite.com\/?q=%23Hcker%3Cbody%20oninput%3Djavascript%3Aalert(1)%3EHcker<\/span><\/pre>\n
These are clearly malicious<\/strong>. You want to block the IP easily<\/strong> and programatically<\/strong>. My website fields thousands<\/em> of requests just like this daily<\/em>, ever since we made it onto HackerOne’s list of apps using Google APIs that have more than 50,000 active users<\/a>.<\/p>\n
You have a few options, but I argue you only have one<\/em> good option.<\/p>\n
Various options to block an IP in AWS<\/h2>\n
    \n
  1. You might think to use AWS Security Groups<\/strong>, but you’ll quickly realize that Inbound Rules<\/strong> in AWS Security Groups can only be used to whitelist<\/em> traffic, not block<\/em> traffic.<\/li>\n
  2. When you dig further into what AWS offers, you’ll come across the ability to block individual IPs<\/a>, and even ranges of IPs, using a Network ACL (Network Access Control List). Specifically, you can set ALLOW and DENY rules. That’s actually a decent solution, but there are two issues: 1) If you want to do this programmatically, you’ll need to learn the AWS Network ACL API<\/a>; and 2) You are limited to 20 total rules<\/strong>, including Inbound<\/strong> and Outbound<\/strong>. So if you have 1 Outbound rule, which is normal, and 1 default Inbound rule, you’re left with only 18 IPs or ranges that can be blocked<\/strong>.\"block<\/a><\/li>\n
  3. If you dig even further into what AWS offers, you’ll find that you can integrate your own third-party firewall<\/a> into your EC2 environment, but this solution will be complex and expensive.<\/li>\n
  4. If you’re using Windows Firewall<\/strong>, then you can block an IP address using Windows Firewall, and you can even programmatically block IPs using the Windows Firewall API<\/a>. This is like a decent option, but one I’ve never tried before. The AWS documentation encourages users to use Security Groups<\/strong> instead<\/em> of Windows Firewall, so ever since I set up Security Groups, I have disabled Windows Firewall on my production servers.<\/li>\n
  5. After exhausting your native AWS options, you’ll start to look at what kind of blocking IIS can do natively. You’ll come across Dynamic IP restrictions<\/a>, but if your web app is even close to as complex as mine, you’ll note a few things lacking.<\/li>\n<\/ol>\n
    Why IIS’s Dynamic IP Restrictions Kind of Sucks<\/h2>\n