无法将本地IP添加至ASP.NET MVC的web.config的ipSecurity节点

安全阿岳

2026-5-20

Hey there, let's troubleshoot this IP blocking issue with IIS Express and your web.config. I've run into similar headaches before, so here are the common fixes to try:

1. Double-check your real IP and subnet mask

First, get your accurate local IPv4 address: open Command Prompt (cmd) and run ipconfig, then find the IPv4 Address under your active network adapter (Wi-Fi or Ethernet). For example, it might be 192.168.1.100.

The subnet mask for local LANs is usually 255.255.255.0 (not 255.255.255.255, which targets a single IP). Update your web.config like this:

<security>
  <ipSecurity allowUnlisted="false" denyAction="NotFound">
    <!-- Local loopback address -->
    <add allowed="true" ipAddress="127.0.0.1" subnetMask="255.255.255.255" />
    <!-- Your actual local IP -->
    <add allowed="true" ipAddress="192.168.1.100" subnetMask="255.255.255.0" />
  </ipSecurity>
</security>

2. Bind IIS Express to your real IP

By default, IIS Express only binds to localhost (127.0.0.1). If you're accessing via your real IP, edit the applicationhost.config file:

It's usually located at %USERPROFILE%\Documents\IISExpress\config\applicationhost.config
Find your site's node (e.g., <site name="YourSiteName" id="1">), then add a binding for your real IP in the <bindings> section:

<bindings>
  <binding protocol="http" bindingInformation="*:5000:localhost" />
  <!-- Add this line, replace the port with your project's port -->
  <binding protocol="http" bindingInformation="*:5000:192.168.1.100" />
</bindings>

3. Ensure the IP Security module is enabled

IP Security needs to be turned on in IIS Express. In applicationhost.config, look for the <modules> section under <system.webServer> and confirm the IpSecurityModule is enabled:

<modules>
  <!-- Other modules... -->
  <add name="IpSecurityModule" lockItem="true" />
</modules>

4. Check rule priority

Rules in ipSecurity are matched top to bottom. If any deny rules come before your allow rules, they'll trigger first. Make sure your allowed IP entries are placed above any deny rules, and remember allowUnlisted="false" means only explicitly allowed IPs can access the site.

5. Restart IIS Express completely

After making these config changes, right-click the IIS Express tray icon and select "Exit", then restart your debugger. This ensures the new settings take effect.

内容的提问来源于stack exchange，提问作者chuckd