IISFrontGuard is an IIS HTTP Module providing comprehensive web application security including WAF functionality, rate limiting, geographic IP filtering, security event logging, automatic security header management, and webhook notifications for ASP.NET applications running on .NET Framework 4.8. Automatically removes server identification headers (X-Powered-By, Server) and adds essential security headers (CSP, HSTS, X-Frame-Options, etc.).
Disclaimer: IISFrontGuard is a project name, not affiliated with Cloudflare or Microsoft Corp.
IISFrontGuard is a Web Application Firewall (WAF) module for Internet Information Services (IIS) built on .NET Framework 4.8. It provides advanced security features including request filtering, rate limiting, managed/interactive challenges, and comprehensive logging with webhook notifications.
Features
Web Application Firewall (WAF): Custom rule-based request filtering with pattern matching
Rate Limiting: Protect against DDoS and brute-force attacks with configurable rate limits
Geographic IP Filtering: Block or allow traffic based on country of origin using GeoIP2
Security Event Logging: Comprehensive logging to SQL database for audit and compliance
Webhook Notifications: Real-time security event notifications to external systems
Interactive Challenges: CAPTCHA-like challenges for suspicious requests
Request Encryption: Support for encrypted request validation
Installation
Via NuGet Package Manager
Install-Package IISFrontGuard.Module
Via .NET CLI
dotnet add package IISFrontGuard.Module
Via Package Manager Console
PM> Install-Package IISFrontGuard.Module
Note: The package will automatically update your Web.config with required settings and open a getting started guide.
Configuration
1. Database Setup
Execute the included SQL script to create the required database tables:
-- Located in: Content\Scripts\init.sql
2. Web.config Configuration
The package automatically configures your Web.config during installation with the following default settings. Please review and update as needed:
Run the included UpdateGeoDb.bat script with your license key
Usage
Interactive Challenges for localhost
Configure WAF rules for localhost:
-- Create an AppEntity for localhost testing
INSERT [dbo].[AppEntity] ([Id], [AppName], [AppDescription], [Host], [CreationDate], [TokenExpirationDurationHr]) VALUES (NEWID(), N'Localhost App', N'Test application for localhost', N'localhost', GETDATE(), 12)
GO
-- Retrieve the Id of the newly created AppEntity
DECLARE @LocalAppId UNIQUEIDENTIFIER
SELECT TOP 1 @LocalAppId = [Id] FROM [dbo].[AppEntity] WHERE [Host] = N'localhost'
-- Insert a rule for Interactive Challenge as an example on localhost using the newly created AppEntity
INSERT [dbo].[WafRuleEntity] ([Nombre], [ActionId], [AppId], [Prioridad], [Habilitado], [CreationDate])
VALUES (N'Interactive Challenge', 4, @LocalAppId, 0, 1, GETDATE())
