DEV Community

Arina Cholee
Arina Cholee

Posted on

How a Small IT Team Secured IIS on Windows Server with SafeLine WAF

#websecurity #cybersecurity #waf #safeline

For many traditional enterprises, especially those running Windows Server + IIS, web security is often an afterthought—until an audit, an incident, or a sudden spike in suspicious traffic forces action.

This is the story of how a small IT team, with limited Linux experience and a tight budget, successfully protected their internal OA system on Windows Server 2019 + IIS 10 using SafeLine WAF, without disrupting existing services.

Background: A Common Windows Server Security Dilemma

The company’s internal OA system had been running on IIS for years. It was stable, business-critical, and—like many internal systems—directly exposed without a Web Application Firewall (WAF).

The problem surfaced during an IT compliance review, where auditors flagged a clear risk:

  • No protection against SQL injection or XSS
  • No visibility into abnormal HTTP requests
  • No mitigation for brute-force login attempts

The IT team explored several options, but quickly ran into familiar roadblocks.

Why Existing Options Failed

  • Linux-based WAFs

    Most tutorials assumed strong Linux skills and heavy CLI usage. The team primarily worked in Windows environments and found this error-prone.

  • Commercial cloud WAFs

    Annual costs were high, and procurement cycles were slow. Overkill for an internal OA system.

  • Lightweight IIS plugins

    Easy to install, but lacked real protection against modern attack patterns.

What they needed was simple, local, and Windows-friendly.

Discovery: A WAF That Actually Fits Windows Environments

The team eventually came across SafeLine, a self-hosted WAF that supports Windows Server deployments via Docker and provides a fully graphical management console.

What stood out immediately:

  • Works natively on Windows Server
  • No need to touch IIS configuration
  • Visual dashboard instead of raw config files
  • Free Community Edition suitable for internal systems

This lowered the barrier enough for the team to proceed.

Deployment Overview: Securing IIS Without Breaking Anything

Environment

  • OS: Windows Server 2019
  • Web Server: IIS 10
  • Application: Internal OA system
  • Deployment Method: Docker on Windows

The entire deployment took under 30 minutes.

Step 1: Preparing the Windows Server Environment

SafeLine runs inside Docker, so the only prerequisite was installing Docker Desktop for Windows Server.

Key points from their experience:

  • Installation is fully graphical
  • Supports WSL 2 or Hyper-V
  • No manual environment variables required

Once Docker Desktop showed a healthy “Running” status, the system was ready.

Step 2: Launching SafeLine WAF

Using PowerShell (Administrator mode), the team ran two simple commands:

docker run -d --name safeline `
  -p 80:80 -p 443:443 `
  -v C:\safeline\rules:C:\safeline\rules `
  --restart=always `
  chaitin/safeline:latest
Enter fullscreen mode Exit fullscreen mode

Then retrieved the initial admin password from container logs.

Within minutes, SafeLine appeared in Docker Desktop as Running, with no impact on IIS yet.

Step 3: Protecting IIS via Reverse Proxy (No IIS Changes)

Instead of modifying IIS itself, SafeLine was configured as a reverse proxy in front of the OA system.

Through the web UI:

  • Added the OA system as a protected site
  • Set backend IP and IIS port
  • Enabled protection with one click

No IIS restart.
No configuration edits.
No downtime.

Immediate Results: Visibility and Protection

Within the first day, the SafeLine dashboard began showing:

  • Blocked SQL injection attempts
  • Suspicious scanner and bot traffic
  • Abnormal request patterns targeting login endpoints

For the first time, the team had clear visibility into what was actually hitting their IIS server.

Extra Hardening for Internal OA Systems

To further reduce risk, the team enabled two additional features:

1. Internal Network Access Control

  • Whitelisted internal IP ranges
  • Blocked all external access by default

This alone eliminated most automated attacks.

2. Login Protection Rules

  • Enabled rate limiting on /admin and /login
  • Locked IPs after multiple failed attempts

These settings required no scripting—just toggles in the UI.

Challenges Encountered (And How They Were Solved)

  • Port conflicts with IIS
    Temporarily stopped IIS during first launch, then restarted it after SafeLine took over port 80.

  • Form authentication issues
    Resolved by preserving original HTTP headers in SafeLine settings.

Each issue was solved through documented options in the UI—no deep debugging required.

Outcome After 3 Months

  • No reported security incidents
  • Passed internal IT audit successfully
  • Zero performance complaints from users
  • No added licensing cost

For a small Windows-focused IT team, this was a rare case of a security tool that did not increase operational complexity.

Why This Case Matters

This experience highlights a reality often overlooked in security discussions:

Not every organization runs Linux.
Not every IT team wants YAML files and CLI-only tools.

For Windows Server + IIS environments, especially internal systems like OA, ERP, or legacy portals, a WAF must be:

  • Easy to deploy
  • Non-intrusive
  • Affordable
  • Understandable by Windows administrators

SafeLine fit that gap.

Final Takeaway

This user case demonstrates that deploying a WAF on Windows Server does not have to be complex or expensive.

With SafeLine, even teams without Linux expertise can:

  • Protect IIS applications
  • Gain real attack visibility
  • Meet compliance requirements
  • Improve security posture quickly

For organizations still running IIS without a WAF, this case offers a practical and proven path forward.

Official Website: https://safepoint.cloud/landing/safeline

Top comments (0)