ISAPI filter in .NET

[leejo123]

Is it possible to create a ISAPI filter in .NET. I had gone through a couple of articles that did not seem to help me. My purpose for this filter is I want to block access to a site if the Request comes from certain IP address. How do I go about creating one. Can some one please help me with it. :confused::confused: Leejo

[Dave Kreskowiak]

Is it possible? Yes. Practical? No. There is a bunch of Interop code that has to sit between your Managed C# code and the Unmanaged code world of IIS. This just adds a bunch of overhead to each and every request going to the web server. That means you're sacrificing your web servers performance to use a managed language. If this is really how you want to go about it, write it in C++. I don't think you'll find any examples of doing this in C#. Oh! You'll also probably have to write a management utility to go along with this filter. How else are you going to tell the filter what addresses to block? But, if all you want to do is block requests from certain IP's, then that what the firewall is for. Put the block where it belongs and leave the web server running as little code as possible to do its job. This will only result in better stability and easier management of the server. RageInTheMachine9532 "...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome

[leejo123]

Thank you for the reply. Actually we have a Filter running on the server. It was developed in c++ couple of yrs back. I was wondering whether I could port that code to .NET. The actual functionality that this filter is supposed to do is block Web Page requests that come from certain Countries and allow page requests from certain countries. Can I get this logic working using Will ISAPI extensions and ISAPI filters:confused::confused: Leejo

[Dave Kreskowiak]

Sure, you could move the logic to a newer .DLL. .NET won't have anything to do with this though, since ISAPI filters have no support in the .NET Base Class Library. If you want to get this to work in Managed Code (C#, VB.NET, Managed C++), you could. But like I mentioned before, there is a performance penalty for going between managed and unmanaged code. There is a reason why you don't see examples of ISAPI implementations in C#. If all your doing is blocking requests from certain IP's, nets, or entire countries, your best tool is still the firewall sitting in front of your web server. That's it's entire mission in life! To stop "this and that" traffic from reaching a network its protecting. If the firewall is blocking traffic from IP's, and more importantly, traffic trying to reach certain ports on machines inside the wall, your web server has less work to do that has nothing to do with serving web pages. Why have the web server run more code than it needs to? By putting up the firewall and blocking everything that isn't going to port 80, or whatever port your using for HTTP, you reduce the attackable surface of your web server, thereby increasing its security and reliability. Now, as I get off the Soapbox, there are HttpHandler and HttpModule interfaces that can provide similar functionality to ISAPI, though not a complete replacemnet for ISAPI. Look here[^] for some introduction and docs. RageInTheMachine9532 "...a pungent, ghastly, stinky piece of cheese!" -- The Roaming Gnome