How to restrict access to section of website running on Azure - asp.net

Question

I have an Episerver website running on Azure and, for security reasons, i would like to block access to any requests to the cms admin section using a white list of ip addresses.
I have done this in the past with websites running on windows server but i have never done this on an Azure hosted site. I have tried the approach i took on previous sites, adding a security section to the web.config for the location i am trying to restrict eg:
<location path="cms/admin">
<system.webServer>
</ipSecurity>
<add allowed="true" ipAddress="{my ip address}" subnetMask="255.255.255.255" />
...
</security>
</system.webServer>
</location>
this works locally but it is not working when i deploy the web.config to Azure. it is preventing any users, including those in the whitelist from accessing the location.
I have also looked into making the changes in portal.azure using aplication->networking->Access-restrictions but this looks like it is intended to control access to the whole app, which is not what i want.
Does anybody know if i am doing this incorrectly, specifically for an Azure website? Is there a setting in access-restrictions that i have missed?
thanks
Sam

Answer 1

You can use iis url rewrite rule to block request to restrict ip for the specific path:
<rule name="RequestBlockingRule1" patternSyntax="Wildcard" stopProcessing="true">
<match url="cms/admin" />
<conditions>
<add input="{REMOTE_ADDR}" pattern="192.168.2.*" />
</conditions>
<action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
</rule>
If you want to allow some ip than you can add another condition with does not match the pattern.
For more detail you can refer below article:
Creating Rewrite Rules
Request Blocking - rule

Answer 2

This recently worked for me.
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Block unauthorized access to admin" stopProcessing="true">
<match url=".*" />
<conditions>
<!-- Enter your staging site host name here as the pattern-->
<add input="{REQUEST_URI}" pattern="^/admin" />
<!-- Enter your white listed IP addresses -->
<add input="{REMOTE_ADDR}" pattern="127\.0\.0\.1" negate="true" />
<add input="{REMOTE_ADDR}" pattern="127\.0\.0\.2" negate="true" />
<!-- <add input="{REMOTE_ADDR}" pattern="123\.123\.123\.2" negate="true"/> -->
</conditions>
<action type="CustomResponse" statusCode="404" statusReason="Not Found" statusDescription="Site is not accessible" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>

Answer 3

We solved this using url rewrite module, as others have suggested. We also realised that the ip address being passed in was not the true request origin IP address because of the cloudflare CDN. luckily the origin ip address is included in the rerouted request from Cloudflare so we were able to make this work using the url rewrite rule below. I have added this as the correct answer to the question because Jalpa's answer technically won't work in my specific context:
<rewrite>
<rules>
<rule name="restrict admin access by IP address" stopProcessing="true">
<match url="(.*)" />
<conditions logicalGrouping="MatchAll">
<add input="{REQUEST_URI}" pattern="^/admin/login(.*)" />
<!-- localhost -->
<add input="{HTTP_True_Client_IP}" pattern="^127\.0\.0\.1$" negate="true"/>
<!-- my office -->
<add input="{HTTP_True_Client_IP}" pattern="^{your ip address here}$" negate="true"/>
</conditions>
<action type="CustomResponse" statusCode="404" statusReason="Not Found" statusDescription="The resource you are looking for has been removed, had its name changed, or is temporarily unavailable." />
</rule>
</rules>
</rewrite>