IIS site blocks internet connection

asp.net-mvciisiis-7.5

I'm fighting this problem for some time.

When my ASP.NET MVC4 website starts to get served on my locally installed IIS (runs on port 8081, not 80!), internet connectivity gets blocked.
Just like that.

I'm confused because it is really strange.
It behaves like this:

  • when the website is first started, I can browse any site
  • only when the first page is served, connectivity fails
  • stopping the website afterwards doesn't help
  • stopping the IIS server afterwards doesn't help either (!)
  • the connectivity problem affects ping as well
  • when I perform logon/logoff or restart the computer, the connectivity is back
  • by looking at the trace, I can't see anything blocked by windows firewall
  • EDIT: everything behaves the same with windows firewall off

I tried to change binding from localhost:8081 to {my IP address}:8081, but it doesn't help.
Any clues?

EDIT

FYI, this is my web.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <configSections>
    <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net" />
    <section name="plisani.medo" type="System.Configuration.NameValueSectionHandler, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
  </configSections>
  <connectionStrings configSource="connectionStrings.config" />
  <location path="Account">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
  <location path="Content">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
  <location path="Images">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
  <appSettings>
    <add key="webpages:Version" value="2.0.0.0" />
    <add key="webpages:Enabled" value="false" />
    <add key="PreserveLoginUrl" value="true" />
    <add key="ClientValidationEnabled" value="true" />
    <add key="UnobtrusiveJavaScriptEnabled" value="true" />
    <add key="log4net.Internal.Debug" value="true" />
    <add key="MvcSiteMapProvider_UseExternalDIContainer" value="true" />
    <add key="MvcSiteMapProvider_SiteMapFileName" value="~/Mvc.sitemap" />
    <add key="MvcSiteMapProvider_IncludeAssembliesForScan" value="GeomarketingWeb" />
  </appSettings>
  <plisani.medo>
    <add key="zeko1" value="MYDOMAIN\xxxxxxxxxxxxxxxx" />
    <add key="zeko2" value="xxxxxxxxxxxxxxxx" />
  </plisani.medo>
  <system.diagnostics>
    <trace autoflush="true">
      <listeners>
        <add name="textWriterTraceListener" type="System.Diagnostics.TextWriterTraceListener" initializeData="Logs\log4netDebug.txt" />
      </listeners>
    </trace>
  </system.diagnostics>
  <system.web>
    <compilation debug="true" targetFramework="4.5" />
    <sessionState cookieName=".tempsession" 
                  cookieless="UseCookies" 
                  regenerateExpiredSessionId="true" 
                  mode="Custom" 
                  customProvider="SessionProvider">
      <providers>
        <add name="SessionProvider" 
             type="GeomarketingWeb.Providers.SessionProvider" 
             connectionStringName="GMDB" />
      </providers>
    </sessionState>
    <authentication mode="Forms">
      <forms loginUrl="~/Account/Logon" 
             name=".GMAUTH" 
             timeout="1440" 
             defaultUrl="~/Home/Index" 
             slidingExpiration="true" />
    </authentication>
    <authorization>
      <deny users="?" />
    </authorization>
    <membership defaultProvider="GeomarketingMembershipProvider">
      <providers>
        <clear />
        <add name="GeomarketingMembershipProvider" 
             type="System.Web.Security.ActiveDirectoryMembershipProvider" 
             connectionStringName="GMAD" 
             attributeMapUsername="sAMAccountName" 
             connectionUsername="" 
             connectionPassword="" 
             connectionProtection="Secure" 
             enablePasswordReset="false" 
             enableSearchMethods="true" 
             requiresQuestionAndAnswer="false" 
             requiresUniqueEmail="false" 
             maxInvalidPasswordAttempts="5" 
             minRequiredPasswordLength="6" 
             minRequiredNonalphanumericCharacters="0" 
             passwordAttemptWindow="10" 
             applicationName="Geomarketing" />
      </providers>
    </membership>
    <roleManager defaultProvider="GeomarketingRoleProvider" enabled="true" cacheRolesInCookie="true" cookieName=".GMROLES" cookieTimeout="5" cookiePath="/" cookieSlidingExpiration="true">
      <providers>
        <clear />
        <add name="GeomarketingRoleProvider" type="GeomarketingWeb.Providers.RoleProvider" connectionStringName="GMDB" applicationName="Geomarketing" />
      </providers>
    </roleManager>
    <profile defaultProvider="DefaultProfileProvider">
      <providers>
        <add name="DefaultProfileProvider" 
             type="System.Web.Providers.DefaultProfileProvider" 
             connectionStringName="DefaultConnection" 
             applicationname="Geomarketing" />
      </providers>
    </profile>
    <pages controlRenderingCompatibilityVersion="4.0">
      <namespaces>
        <add namespace="System.Web.Helpers" />
        <add namespace="System.Web.Mvc" />
        <add namespace="System.Web.Mvc.Ajax" />
        <add namespace="System.Web.Mvc.Html" />
        <add namespace="System.Web.Optimization" />
        <add namespace="System.Web.Routing" />
        <add namespace="System.Web.WebPages" />
        <add namespace="MvcSiteMapProvider.Web.Html" />
        <add namespace="MvcSiteMapProvider.Web.Html.Models" />
      </namespaces>
    </pages>
  </system.web>
  <system.webServer>
    <validation validateIntegratedModeConfiguration="true" />
    <modules runAllManagedModulesForAllRequests="true" />
    <handlers>
      <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
      <add name="ExtensionlessUrlHandler-Integrated-4.0" 
           path="*." 
           verb="*" 
           type="System.Web.Handlers.TransferRequestHandler" 
           resourceType="Unspecified"
           requireAccess="Script"
           preCondition="integratedMode,runtimeVersionv4.0" />
    </handlers>
  </system.webServer>
  <runtime>
    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-2.0.0.0" newVersion="2.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />
        <bindingRedirect oldVersion="1.0.0.0-2.0.0.0" newVersion="2.0.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Web.Http" publicKeyToken="31bf3856ad364e35" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-5.1.0.0" newVersion="5.1.0.0" />
      </dependentAssembly>
      <dependentAssembly>
        <assemblyIdentity name="System.Net.Http.Formatting" publicKeyToken="31bf3856ad364e35" culture="neutral" />
        <bindingRedirect oldVersion="0.0.0.0-5.0.0.0" newVersion="5.0.0.0" />
      </dependentAssembly>
    </assemblyBinding>
  </runtime>
</configuration>

Best Answer

Solved.

I can't believe it's working like this, and I don't know about the implementation and/or network details of this confusion but here's the solution:

  • I found that the internet on the workstation was accessible when application was run under Application Pool Identity credentials
  • it was working when application was run under my own credentials as well
  • connectivity failed only when application was run under a special service credentials that has internet access restriction

A system engineer found that in case application was run under such service credentials, Palo Alto firewall blocks all internet access from the PC where IIS (and the application) runs. Not that-application-access-to-internet, but all-of-the-internet-access from that PC.

It took us 2 days to solve it.

I hope this helps someone.