Internal Server Error with web.config ipSecurity - asp.net

Question

This is my web.config which has some tags for blocking Ipaddress
<configuration>
<connectionStrings>
...
</connectionStrings>
<appSettings>
....
</appSettings>
<runtime>
....
</runtime>
<system.webServer>
<security>
<ipSecurity allowUnlisted="false">
<clear/>
<add ipAddress="127.0.0.1" allowed="true"/>
<add ipAddress="83.116.19.53" allowed="true"/>
</ipSecurity>
</security>
</system.webServer>
</configuration>
My intention is to block any other IP except the above. The above is the only Ip address I want the website to be accessible from . But with "ipSecurity" tag I am always getting
500 - Internal server error and the site runs fine without it.
I have made sure that "IP and Domains Restrictions" are installed on the server.
Please let me know if I am missing anything.
Thank you.

Answer 1

For others that run into this issue. The cause of the issue is that Feature Delegation doesn't allow the feature to be managed by web.config.
To Fix:
Verify that the Feature is enabled for web.config management
In IIS 7, click on the root server
Double click Feature Delegation (under management)
Scroll down to IPv4 Address and Domain Restrictions
Change the delegation to Read/Write (in my case it was Read Only, which was the issue)
Hope this helps someone else.

Answer 2

For Windows 10 and Visual Studio 2015 note that the ApplicationHost.config file has been relocated to the .vs\config folder in your project's folder hierarchy. You will need to edit the project specific version of the ApplicationHost.config file found there with...
<section name="ipSecurity" overrideModeDefault="Allow" />
If you only edit the ApplicationHost.config located in your Documents\IISExpress folder this will not affect your existing application (MVC5 appl in my case).

Answer 3

Open the applicationHost.config file (located at %windir%\system32\inetsrv\config\applicationHost.config) and edit the ipSecurity section.
Change this line:
<section name="ipSecurity" overrideModeDefault="Deny" />
To:
<section name="ipSecurity" overrideModeDefault="Allow" />

Answer 4

Are you editing the config by hand or through IIS manager?
See this post about that error message as you may not have that feature delegation enabled
http://forums.asp.net/t/1220987.aspx

Answer 5

Try this outside System.Webserver tag
<location path="Default WebSite">
<system.webServer>
<security>
<ipSecurity allowUnlisted="false">
<clear/>
<add ipAddress="127.0.0.1" allowed="true"/>
<add ipAddress="83.116.19.53" allowed="true"/>
</ipSecurity>
</security>
</system.webServer>
</location>

Answer 6

Hopefully this will help someone...
I am running IIS express on Windows 7 locally and did the following - Control panel > Programs > Programs and features > Turn Windows features on or off
In the Windows Features dialog ensure the IP Security option is checked:
I also had to open up my applicationhost.config (under %userprofile%\Documents\IISExpress\config) file and change the following:
<section name="ipSecurity" overrideModeDefault="Deny" />
To
<section name="ipSecurity" overrideModeDefault="Allow" />

Answer 7

Don't forget custom site delegation. This allows you to only allow delegation to sites you intend.