Force authentication for specific IP range on IIS
Use the Rules module to determine if the user is from a specific IP range, or is authenticated.  If they are not from that IP range or not logged in, redirect to Login page.


Install and enable Rules module.
Create a new Rule that is triggered when Drupal is initializing.
Add a Condition of Data, Text Comparison
Add a Data field of site:current-page:path that matches user, and negate the condition so this Rule requires this Condition to be False.
Add a Condition Or group, set it to Negate, so that if neither condition are positive it will execute an action
Within the Or group, add a condition that executes PHP Code. Enter PHP code that returns True if the IP is in range (learn how to get the visitors IP).
Within the Or group, add another condition of User's role. Configure the condition to return true if the User has the Authenticated User role.
Add an Action of Page redirect, and redirect the user to user, or some other page where they can login.
Save and enable the Rule.