Using IPv6 with IIS7

Besides the US government and certain Asian countries, IPv6 has not really caught on yet, especially here in the US. So how does IIS7 stack up as far as IPv6 support is concerned? Let's walk through the IIS7 feature set to evaluate this. For comparison against IIS 6 you can check out the TechNet article here.

IPv6 Bindings in IIS7

The default binding is a '*' binding and does not have an IP address, so IPv6 does not come into the picture. However if you were to create a binding for your site from 'inetmgr' (IIS 7 configuration tool), the drop down list for IP Address would pre-populate with your server's IP addresses, including IPv6 address. Here's a screen shot of what this looks like.

Screen7

When you are selecting an IPv6 address from the list, make sure you don't accidentally bind to the 'Temporary IPv6 Address'. Temporary addresses are IPv6 interface identifiers that provide a level of anonymity for outbound traffic. If your machine is domain joined, it is possible for the DC to assign a temporary address (with the same global prefix) to your machine and this address may change frequently, say every day. In that case your binding will be broken every time such a change occurs.

Sounds good so far, but can I manually enter an IP address? And if I do, will it check the validity of the address? Yes and yes. Here's what I get when I enter an invalid IP address.

Screen8

Site Limits

Back in IIS 6 site/server limits like MaxBandwidth and MaxGlobalBandwidth metabase properties did not apply to responses sent over IPv6 addresses. IIS 7 has equivalents to these limits as well that reside under system.applicationHost/sites/Limits. These settings apply to responses sent over both IPv4 and IPv6 for IIS 7.

IP Address and Domain Restrictions

If you have brought up the configuration manager for IIS 7 (inetmgr) you probably noticed that the restriction list is preceded by "IPv4".

Screen9

And drilling down further to add a deny rule list shows IPv4 specific entries only.

Screen10

So does this mean that there is no support for IPv6 in the IP restrictions list? Well, note really. The way the restriction list currently works is that it applies a specified mask to an incoming requests address to figure out if an address is on the restriction list. In the case of IPv6 masks are specified as a bit offset like 2001:8989::/16. But there is no reason why you could not specify a subnet style mask for IPV6 like ffff::. The inetmgr UI has an artificial restriction for allowing only IPv4 addresses and this is mostly because of test constraints on our part. However, you can easily configure this in our configuration file (applicationHost.config), and here are what entries look like for both a specific address and an address range for both IPv4 and IPV6 .

<ipSecurity allowUnlisted="true">
    <add ipAddress="10.199.199.199" allowed="false" />
    <add ipAddress="12.14.0.0" subnetMask="255.255.0.0" allowed="false" />
    <add ipAddress="2001:4898:2a:5:c4ad:9291:22b1:c870" subnetMask="ffff:ffff::" allowed="false" />
</ipSecurity >

All we had to do to specify an IPV6 address is to use a subnet mask style filter for ranges and it should just work. The bonus here is that once you do this in the configuration file, you will see the entry appear accurately in the inetmgr UI as shown below.

ipv6restr

There are some additional details that are worth mentioning here.

  • Grant/Deny rules using 127.0.0.1 will automatically apply to both IPv4 and IPv6 address.
  • Also, 127.0.0.1 and ::1 can be used interchangeably and is protocol version agnostic.

Another important fact to remember here is that adding an IP restriction rule is evaluated against that specific IP address and not a client. So if a client has both an IPV4 address and an IPV6 address, and you add a deny rule for the IPV4 address, it can still connect via its IPV6 address.

FTP Publishing Service for IIS 7.0

The new version of FTP (7.0) fully supports IPv6 besides supporting other marked improvements like SSL. Both IPv4 and IPv6 clients can connect to a server that could have either an IPv4 or IPv6 address.

Note:

One major point of confusion that I should clarify here is that the version of FTP on the box with Windows Server 2008 is NOT FTP 7. It is in fact the older version. The new version of FTP shipped out of band and can be downloaded here for x86 version or here for x64 version.

FTP has its own IP restriction list and even its configuration UI (which is integrated with IIS configuration) does not let you specify IPv6 addresses. Here is what you will see when you enter an IPv6 address.

Screen12

In case you were wondering if IP restrictions is any different for FTP than for IIS, it's not. In fact, if you open up the same applicationHost.config file you will see a section like the one below.

<system.ftpServer>
    ...
    <security>
        ...
        <ipSecurity>
            <add ipAddress="5.4.3.2" allowed="false" />
            <add ipAddress="234.123.10.1" subnetMask="255.255.0.0" allowed="false" />
        </ipSecurity>
    </security>
</system.ftpServer>

And this is exactly the same schema as the one for IIS. So everything I mentioned above applies here as well.

Miscellaneous

IIS 7.0's tracing and logging mechanisms are fully IPv6 aware as well. So whether you are generating Failed Request Traces or looking at the HTTP error logs, you will see IPv6 addresses. Even at an OS and programmability level there is much greater support for IPv6, which makes it easier to work with even from a developer's perspective.

Published Saturday, May 3, 2008 12:11 AM by naziml

Comments

# re: Using IPv6 with IIS7

Saturday, May 3, 2008 2:07 AM by bills

great topic to blog about, I don't know of any other IPv6 documentation!

# re: Using IPv6 with IIS7

Sunday, July 27, 2008 7:16 PM by Anonymous

This helped, thanks

# re: Using IPv6 with IIS7

Wednesday, September 10, 2008 12:49 AM by Anonymous

is it a must to set up manually??

our site http://www.ohr.cn applied with ipv6

# re: Using IPv6 with IIS7

Saturday, September 20, 2008 11:24 PM by Sohbet

<a href="http://www.gencsohbetci.net" title="Sohbet" target="_blank">Sohbet</a>

# re: Using IPv6 with IIS7

Saturday, September 20, 2008 11:24 PM by kasiraga346345

thanks your admin

# re: Using IPv6 with IIS7

Tuesday, October 7, 2008 10:44 PM by laptop battery

thank you

# re: Using IPv6 with IIS7

Sunday, October 12, 2008 6:24 AM by sohbet

thanks a lot

# re: Using IPv6 with IIS7

Sunday, October 12, 2008 6:25 AM by sohbet

its good i will use it thanks a lot.

<a href="http://www.uzmantasarim.net" title="web tasarım">web tasarım</a>

# re: Using IPv6 with IIS7

Monday, October 13, 2008 1:37 PM by islami sohbet

That is wonderful;

Temporary addresses are IPv6 interface identifiers that provide a level of anonymity for outbound traffic. If your machine is domain joined, it is possible for the DC to assign a temporary address (with the same global prefix) to your machine and this address may change frequently, say every day. In that case your binding will be broken every time such a change occurs.

# re: Using IPv6 with IIS7

Monday, October 20, 2008 7:28 PM by evden eve nakliyat

Thank you very much for this information. I like this site.

# re: Using IPv6 with IIS7

Thursday, October 23, 2008 10:34 AM by lida

thanks a lot

# re: Using IPv6 with IIS7

Thursday, October 23, 2008 7:33 PM by chat

thanks

# re: Using IPv6 with IIS7

Thursday, October 23, 2008 7:33 PM by chat

thanks

# re: Using IPv6 with IIS7

Friday, October 31, 2008 5:44 PM by film izle

thanks for toy.

# re: Using IPv6 with IIS7

Sunday, November 9, 2008 1:04 PM by sohbet

Thank you very much

# re: Using IPv6 with IIS7

Sunday, November 9, 2008 1:04 PM by sohbet

Thank you very much

# re: Using IPv6 with IIS7

Sunday, November 9, 2008 1:05 PM by kameralı sohbet

Thank you very much

# re: Using IPv6 with IIS7

Monday, November 17, 2008 4:43 AM by söve

thanks.

# re: Using IPv6 with IIS7

Saturday, December 13, 2008 1:41 PM by kelebek

thanks you.

# re: Using IPv6 with IIS7

Saturday, December 13, 2008 1:41 PM by kelebek

thanks you.

# re: Using IPv6 with IIS7

Monday, December 22, 2008 7:08 AM by mırc,mirc

thanks.

# re: Using IPv6 with IIS7

Sunday, January 18, 2009 12:24 PM by Netlog

???????? whahhtt

# re: Using IPv6 with IIS7

Wednesday, January 21, 2009 1:45 AM by almanya chat

?????whtt hcm ??

# re: Using IPv6 with IIS7

Wednesday, January 21, 2009 8:07 AM by web hosting

thank youu

# re: Using IPv6 with IIS7

Sunday, January 25, 2009 4:43 PM by Oyun

thanks from <a href="http://www.oyuncambazi.com">Oyun</a>

# re: Using IPv6 with IIS7

Tuesday, February 10, 2009 3:46 PM by güzel sözler

Thank you very much

# re: Using IPv6 with IIS7

Friday, February 13, 2009 6:02 AM by şiir

This seems like a major step forward and I don’t see any downside to it.

# re: Using IPv6 with IIS7

Friday, February 13, 2009 11:00 AM by sohbet odaları

thanks..

# re: Using IPv6 with IIS7

Sunday, February 15, 2009 4:09 AM by Arkadaş

Sevgiler

# re: Using IPv6 with IIS7

Saturday, October 17, 2009 5:40 PM by Ad3m34

Wednesday, September 10, 2008 5:49 AM by Anonymous

is it a must to set up manually??

<a href="http://www.sohbet32.net" title="sohbet">sohbet</a> | <a href="http://www.muhabbetim.in" title="muhabbet">muhabbet</a>

Leave a Comment

(required) 
(required) 
(optional)
(required) 
Powered by Community Server (Commercial Edition), by Telligent Systems