Can I ban an IP address (or a range of addresses) in the ASP.NET applicaton?

Question

What would be the easiest way to ban a specific IP (or a range of addresses) from being able to access my publicly available web site?

Is it possible to do so using the ASP.NET only, without resorting to modifying any IIS settings?

Answer 1

You can check the Request.ServerVariables["REMOTE_ADDR"] value and if they're banned redirect them to yahoo or something.

Answer 2

Indeed, Spencer Ruport's suggestion is the right way to go about it. (Not sure I would redirect to Yahoo however - an page informing the user they have been banned would be better, with some option for contacting the web admin if the client feels they were inadvertently banned).

I would add that it would be wise to check the *HTTP_X_FORWARDED_FOR* server variable (representing the IP forwarded by a proxy, or null if none) firstly in order to avoid the issue of the IP address for the proxy (and thus potentially many other users) also being banned.

Answer 3

It is easy and fast in asp.net using httpmodule, just take a look at Hanselman's post: http://www.hanselman.com/blog/AnIPAddressBlockingHttpModuleForASPNETIn9Minutes.aspx