Network Management

Restrict access to the Orion Web Console through IP and domain restrictions in IIS

This article describes how you can limit access to the Orion Web Console by adding an extra layer of security to your deployment with built-in security features native to IIS.

First published date

12/24/2020 2:29 AM

Last published date

12/24/2020 6:29 PM

Overview

Restricting access to the Orion Web Console can add an extra layer of security to your Orion Platform deployment. One method to limit access is to leverage the built-in security features that are native to IIS.

The following instructions describe how to limit access to the Orion Web Console by: 

  • Installing the IP Address and Domain Restrictions Role Service as part of the Web Server (IIS) on the Orion server.
  • Enabling IP Address and Domain Restrictions Role Service on the Orion server.

Product section

Orion Platform

Resolution

To install the IP Address and Domain Restrictions Role Service

  1. Log in to the Orion server and start Server Manager.

  2. Click Add roles and features > Server Roles.

  3. Expand the Roles tree view by clicking Web Server (IIS) > Web Server > Security.

  4. Select the IP and Domain Restrictions option.

  5. Click Next > Next > Install.

  6. Confirm selections in the wizard, and then click Install.

  7. When installation is complete, close the wizard.

To enable the IP Address and Domain Restrictions Role Service for IIS

  1. On the Orion server, open the Internet Information Services (IIS) Manager:

    1. Click Start.

    2. Type inetmgr.

  2. Expand the SolarWinds NetPerfMon site and verify that the IP Address and Domain Restrictions feature appears for IIS.

    Note: If the IP Address and Domain Restrictions feature doesn't appear, restart IIS. See instructions at the bottom of this article.

  3. Double-click the IP Address and Domain Restrictions icon.

  4. On the IP Address and Domain Restrictions page, you can set specific Allow or Deny statements by using options in the Actions pane on the right side.

Examples

This section provides two examples of how you can configure IIS to restrict access to the Orion Web Console.

To lock down the Orion server to only admins who have direct access to RDP into the server

  1. Start by configuring feature settings.

    1. Click Edit Feature Settings.

    2. For the "Access for unspecified clients" option, select Deny.

    3. Set remaining options, as desired.

    4. Click OK but note that changes aren't applied until you finish the next set of steps.

      Note: Enabling domain name restrictions can affect server performance because each request requires a DNS lookup. See IP Address and Domain Restrictions (© 2020 Microsoft Corp., available at docs.microsoft.com, obtained on December 23, 2020).

  2. Next, specify which IP addresses are allowed.

    1. Click Add Allow Entry.

    2. To specify the local host, add 127.0.0.1 for Specific IP address.

    3. Click OK.

    The IP Address and Domain Restrictions page displays the Allow rule created for Localhost.

    If you test access, an "Access to xxxxxxx was denied" message appears unless you RDP into the server and use localhost in the web browser.

To lock down the Orion server by limiting access to specific IP addresses or an IP address range

  1. Start by configuring feature settings.

    1. Click Edit Feature Settings.

    2. For the "Access for unspecified clients" option, select Deny.

    3. Set remaining options, as desired.

    4. Click OK but note that changes aren't applied until you finish the next set of steps.

      Note: Enabling domain name restrictions can affect server performance because each request requires a DNS lookup. See IP Address and Domain Restrictions (© 2020 Microsoft Corp., available at docs.microsoft.com, obtained on December 23, 2020).

  2. Next, specify which IP addresses are allowed.

    1. Click Add Allow Entry.

    2. Enter a Specific IP address.

    3. Click OK.

    The IP Address and Domain Restrictions page displays the Allow rule that was created.

This article describes one way to restrict access to the Orion Web Console. Alternatives include, but are not limited to, utilizing access control lists from your router, firewall policies, Windows firewall restrictions, or load balancer policies.

Learn more

Restart IIS on the Orion server

To restart IIS, use one of the following methods:

  • Open the Command prompt and run it as an Administrator. Execute this command: iisreset /restart

  • Use the Run utility to execute iisreset /restart.