# Download en installeer URL Rewrite
$url = "https://download.microsoft.com/download/1/2/8/128E2E22-C1B9-44A4-BE2A-5859ED1D4592/rewrite_amd64_en-US.msi"
Invoke-WebRequest -Uri $url -OutFile "rewrite.msi"
Start-Process msiexec.exe -ArgumentList '/i rewrite.msi /quiet' -Wait

<rewrite>
  <rules>
    <!-- Regel 1: API paden toestaan (geen actie) -->
    <rule name="Allow API paths" stopProcessing="false">
      <match url="^(api/|api-login|api-docs|swagger)" />
      <action type="None" />
    </rule>
    
    <!-- Regel 2: Blokkeer niet-API paden voor externe IP's -->
    <rule name="Block external non-API" stopProcessing="true">
      <match url=".*" />
      <conditions logicalGrouping="MatchAll">
        <!-- Niet van intern netwerk -->
        <add input="{REMOTE_ADDR}" 
             pattern="^(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.0\.0\.1)" 
             negate="true" />
        <!-- En niet een toegestaan API pad -->
        <add input="{REQUEST_URI}" 
             pattern="^/(api/|api-login|api-docs|swagger)" 
             negate="true" />
      </conditions>
      <action type="CustomResponse" 
              statusCode="403" 
              statusReason="Forbidden" 
              statusDescription="Access denied from external network" />
    </rule>
  </rules>
</rewrite>

<!-- Optionele IP whitelist voor API toegang -->
<rule name="IP Whitelist for API" stopProcessing="true">
  <match url="^api/" />
  <conditions logicalGrouping="MatchAll">
    <!-- Niet van intern netwerk -->
    <add input="{REMOTE_ADDR}" 
         pattern="^(192\.168\.|10\.|127\.0\.0\.1)" 
         negate="true" />
    <!-- Niet op de whitelist -->
    <add input="{REMOTE_ADDR}" 
         pattern="^(203\.0\.113\.50|198\.51\.100\.25|85\.12\.34\.56)$" 
         negate="true" />
  </conditions>
  <action type="CustomResponse" 
          statusCode="403" 
          statusReason="Forbidden" 
          statusDescription="IP address not allowed" />
</rule>

pattern="^(203\.0\.113\.50|198\.51\.100\.25|nieuw\.ip\.adres)$"

# Installeer IIS IP Security feature
Install-WindowsFeature Web-IP-Security

<security>
  <dynamicIpSecurity enableLoggingOnlyMode="false" enableProxyMode="false">
    <!-- Blokkeer bij te veel gelijktijdige requests -->
    <denyByConcurrentRequests enabled="true" maxConcurrentRequests="20" />
    
    <!-- Blokkeer bij te veel requests per tijdseenheid -->
    <denyByRequestRate enabled="true" 
                       maxRequests="50" 
                       requestIntervalInMilliseconds="10000" />
  </dynamicIpSecurity>
</security>

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <system.webServer>
    
    <!-- Rate Limiting -->
    <security>
      <dynamicIpSecurity enableLoggingOnlyMode="false">
        <denyByConcurrentRequests enabled="true" 
                                  maxConcurrentRequests="20" />
        <denyByRequestRate enabled="true" 
                           maxRequests="50" 
                           requestIntervalInMilliseconds="10000" />
      </dynamicIpSecurity>
    </security>
    
    <!-- URL Rewrite: alleen API paden extern -->
    <rewrite>
      <rules>
        <!-- Stap 1: API paden toestaan -->
        <rule name="Allow API" stopProcessing="false">
          <match url="^(api/|api-login|api-docs|swagger)" />
          <action type="None" />
        </rule>
        
        <!-- Stap 2: Optionele IP whitelist voor API -->
        <!--
        <rule name="IP Whitelist" stopProcessing="true">
          <match url="^api/" />
          <conditions logicalGrouping="MatchAll">
            <add input="{REMOTE_ADDR}" 
                 pattern="^(192\.168\.|10\.)" negate="true" />
            <add input="{REMOTE_ADDR}" 
                 pattern="^(203\.0\.113\.50)$" negate="true" />
          </conditions>
          <action type="CustomResponse" statusCode="403" />
        </rule>
        -->
        
        <!-- Stap 3: Blokkeer rest voor externe IP's -->
        <rule name="Block non-API external" stopProcessing="true">
          <match url=".*" />
          <conditions logicalGrouping="MatchAll">
            <add input="{REMOTE_ADDR}" 
                 pattern="^(192\.168\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|127\.0\.0\.1)" 
                 negate="true" />
            <add input="{REQUEST_URI}" 
                 pattern="^/(api/|api-login|api-docs|swagger)" 
                 negate="true" />
          </conditions>
          <action type="CustomResponse" 
                  statusCode="403" 
                  statusReason="Forbidden" 
                  statusDescription="Access denied" />
        </rule>
      </rules>
    </rewrite>
    
  </system.webServer>
</configuration>

# PowerShell: stuur 100 requests snel achter elkaar
1..100 | ForEach-Object { 
    try {
        Invoke-WebRequest -Uri "https://api.bedrijf.nl/api/test" -Method GET -TimeoutSec 5
    } catch {
        Write-Host "Request $_`: $($_.Exception.Response.StatusCode)"
    }
}

# Na ~50 requests zou u 403 moeten krijgen

# In IIS Manager:
# 1. Selecteer de SQLio site
# 2. Klik op "Failed Request Tracing Rules"
# 3. Klik "Add..." en voeg regel toe voor status code 403
# 4. Schakel Failed Request Tracing in (rechterkolom: "Edit Site Tracing")
# 5. Logs staan in: %SystemDrive%\inetpub\logs\FailedReqLogFiles

<!-- Voeg toe aan rewrite sectie voor debugging -->
<rewrite>
  <rules>
    <!-- Voeg logCondition toe aan uw regels -->
    <rule name="Debug logging" stopProcessing="false">
      <match url=".*" />
      <serverVariables>
        <set name="HTTP_X_DEBUG_IP" value="{REMOTE_ADDR}" />
        <set name="HTTP_X_DEBUG_URI" value="{REQUEST_URI}" />
      </serverVariables>
      <action type="None" />
    </rule>
    <!-- ... rest van uw regels ... -->
  </rules>
</rewrite>