title: IIS ipSecurity not blocking outside IPs
body: <p>We are running a web site on IIS with Windows Server 2016. We want the web site to be public, but one folder we want accessible to only internal IP addresses. applicationHost.config contains these lines:</p>
  <pre><code>    &lt;location path=&quot;mywebsite/private&quot;&gt;
          &lt;system.webServer&gt;
              &lt;security&gt;
                  &lt;ipSecurity allowUnlisted=&quot;false&quot;&gt;
                      &lt;add ipAddress=&quot;192.168.1.0&quot; subnetMask=&quot;255.255.255.0&quot; allowed=&quot;true&quot; /&gt;
                  &lt;/ipSecurity&gt;
              &lt;/security&gt;
          &lt;/system.webServer&gt;
      &lt;/location&gt;
  </code></pre>
  <p>When accessing a page within this folder from an IP address that is outside of 192.168.1.x, I expect to be blocked, but the page loads successfully.</p>
  <p>Also, I get an error in IIS Manager. I'm not sure if it is related. When I navigate to mywebsite &gt; private and open the <strong>IP Address and Domain Restrictions</strong> feature, I see the same settings as in applicationHost.config. Under <strong>Edit Feature Settings</strong>, it is set to Access=Deny, domain name restrictions=disabled, Proxy mode=disabled, Deny action type=Forbidden. When I change Access to Allow, I get this error message:</p>
  <pre><code>Filename: \\?\D:\mywebsite\private\web.config
  Error: The configuration section 'system.webServer/security/dynamicIpSecurity' 
  cannot be read because it is missing a section declaration
  </code></pre>
  <p>We do not have anything about <strong>dynamicIpSecurity</strong> in applicationHost.config or in any web.config file. <strong>ipSecurity</strong> is not in web.config.</p>
  <p>Any suggestions about why outside IP addresses are not being blocked?</p>
  <p>UPDATE:
  Still not totally fixed but I figured out what is happening and have used this information to implement a workaround. In our network, we have 3 zones: web servers, workstations, and the internet. It turns out that if a web request comes from a workstation, the IP Address and Domain Restrictions feature sees the actual client IP address and allows or denies as expected. But if the request comes from the internet, this IIS feature sees the interface IP address of our firewall appliance. It's strange because web applications see the client IP and the log file logs the client IP. It seems to be only the IP Address and Domain Restrictions feature. Is there something that can be done to IIS to make it more likely to look at the actual client IP?</p>