Azure website IP restriction

Question

I have an Azure website which I only use for development and testing, therefore I want to restrict access to it for everyone but myself. According to this blog article this is now offically supported, so I tried adding this to my web.config file:

<system.webServer>
    <security>
        <ipSecurity allowUnlisted="false" denyAction="NotFound">
            <add allowed="true" ipAddress="1.2.3.4" />
        </ipSecurity>
    </security>
</system.webServer>

For the ipAddress attribute I have to use the IP address of my internet connection right? So I went to http://www.whatismyip.com/ and copied the address, but now my website is simply blocking all requests, the allow rule has no effect.

Did I miss something?

UPDATE: The log files revealed that the IPs seen by the web server are not those of the actual clients, but of a proxy in between (Cloudflare). So I tried to solve this by adding enableProxyMode="true", unfortunately this does not fix my issue. Any ideas of how to get IP restrictions to work with Cloudflare?

Answer 1

Just in case someone is trying to setup IP restrictions with Cloudflare: the solution is to not only add your IP to the whitelist, but also all the Cloudflare IPs (taken from here).

<system.webServer>
    <security>
        <ipSecurity enableProxyMode="true" allowUnlisted="false" denyAction="NotFound">
            <!-- YOUR IP -->
            <add allowed="true" ipAddress="1.2.3.4" />
            <!-- CLOUDFLARE -->
            <add allowed="true" ipAddress="199.27.128.0" subnetMask="255.255.248.0" />
            <add allowed="true" ipAddress="173.245.48.0" subnetMask="255.255.240.0" />
            <add allowed="true" ipAddress="103.21.244.0" subnetMask="255.255.252.0" />
            <add allowed="true" ipAddress="103.22.200.0" subnetMask="255.255.252.0" />
            <add allowed="true" ipAddress="103.31.4.0" subnetMask="255.255.252.0" />
            <add allowed="true" ipAddress="141.101.64.0" subnetMask="255.255.192.0" />
            <add allowed="true" ipAddress="108.162.192.0" subnetMask="255.255.192.0" />
            <add allowed="true" ipAddress="190.93.240.0" subnetMask="255.255.240.0" />
            <add allowed="true" ipAddress="188.114.96.0" subnetMask="255.255.240.0" />
            <add allowed="true" ipAddress="197.234.240.0" subnetMask="255.255.252.0" />
            <add allowed="true" ipAddress="198.41.128.0" subnetMask="255.255.128.0" />
            <add allowed="true" ipAddress="162.158.0.0" subnetMask="255.254.0.0" />
            <add allowed="true" ipAddress="104.16.0.0" subnetMask="255.240.0.0" />
        </ipSecurity>
    </security>
</system.webServer>