Quay

Iis Security Allow Listed Ip Address For Server

--- sidebarposition: 7 title: \"IIS security: allow‑list the server IP address\" description: \"Add the server’s own IP to IIS IP Address and Domain Restrictio...

This is a configuration requirement you must complete before Quay can be used from machines other than localhost.

Summary

  • Secure by default: the QGIS Server endpoint in IIS denies all clients unless explicitly allowed.
  • On the server itself (for example via Remote Desktop), the URL works because the request originates from the local machine, which is allow‑listed.
  • From other machines, the same URL returns HTTP Error 403.503 – Forbidden until you allow‑list the server’s IP address.

Example symptom

Why this happens

  • Quay is designed to be secure by default. The IIS site/app that hosts the QGIS Server endpoint is configured to deny unspecified IP addresses.
  • When you’re on the server, your request comes from the server itself (localhost or its own network IP), which is allow‑listed. That’s why it works locally.
  • When you try from another machine, your IP isn’t on the allow list, so IIS blocks it with 403.503. Users are expected to access services through Quay, which will make the local call from the server on their behalf after they authenticate.

What to configure (choose one)

Option A: IIS Manager (recommended)

  1. Open IIS Manager.
  2. Select the site or application that hosts the QGIS Server endpoint (e.g., the QgisServer app under your Quay site).
  3. Open “IP Address and Domain Restrictions”.
  4. In the Actions pane, click “Edit Feature Settings…”.
    • Set “Access for unspecified clients” to Deny.
  5. Click “Add Allow Entry…”.
    • IP address: enter the server’s own IP (for example: 192.168.2.9).
    • Click OK, then Apply.

Option B: web.config (advanced) Add or confirm the following under your site/app’s web.config. Replace the example IP with your server’s address and include localhost entries.

<system.webServer>
  <security>
    <ipSecurity allowUnlisted="false">
      <add ipAddress="127.0.0.1" allowed="true" />
      <add ipAddress="::1" allowed="true" />
      <add ipAddress="192.168.2.9" allowed="true" /> <!-- Your server IP -->
    </ipSecurity>
  </security>
</system.webServer>

If you get a “locked configuration section” error using web.config, unlock the section at the server level (an admin action). See IIS features, or run:

cd C:\Windows\System32\inetsrv
./appcmd.exe unlock config -section:system.webServer/security/ipSecurity

Tips and gotchas

  • Find the server IP: run ipconfig and use the IPv4 address for the NIC your site binds to. If the server has multiple NICs or IPv6, allow‑list each address it may use.
  • Static vs DHCP: if the server IP is assigned by DHCP, it can change. Reserve a static IP or update the allow list when it changes.
  • Keep it secure: don’t add user/client IPs here. Deny unspecified clients and only allow the server’s own IP (plus 127.0.0.1/::1).
  • Scope matters: apply IP restrictions at the app level that hosts the QGIS Server endpoint, or at the site level if appropriate. Inherited settings can override your intent.

Validate your setup

  1. From another machine, request the QGIS Server URL directly — expect HTTP Error 403.503 (blocked by design).
  2. From the server itself (e.g., via Remote Desktop), request the same URL — expect it to load successfully.
  3. From Quay, use the application normally — Quay will make the local call from the server and the map/services will function.

Related

  • IIS feature enablement and IP security unlocking: see IIS Features in this section.