Generates the RemoteRestrictions registry value to for setting HKLM\SOFTWARE\Microsoft\WebManagement\Server\RemoteRestrictions

GenerateRemoteRestrictions.ps1

#generates the RemoteRestrictions registry value to for setting HKLM\SOFTWARE\Microsoft\WebManagement\Server\RemoteRestrictions
#to a set of allowed/dneied ip addresses. THe address specified with allow/deny based on the opposite of the globalDeny setting
#
#Examples:
#-Globally deny access and allow a specific ip through
#   Generate-RemoteRestrictions -globalDeny $True -addresses "1.1.1.1/255.255.255.255"
#
#-Globally deny access and allow 2 ip and subnets
#   Generate-RemoteRestrictions -globalDeny $True -addresses "1.1.1.0/255.255.255.0", "2.2.2.0/255.255.255.0"
#
#-Globally allow access and deny 2 ips and subnets
#   Generate-RemoteRestrictions -globalDeny $False -addresses "1.1.1.0/255.255.255.0", "2.2.2.0/255.255.255.0"

function Generate-IpOrSubnetString {
    Param ([string]$ip, [string]$ipTemplateString, [int] $ipOffset)
    $ipTemplate = [System.Convert]::FromBase64String($ipTemplateString);
    $ipParts = $ip.Split('.');
    $ipTemplate[$ipOffset] = [System.Convert]::ToByte($ipParts[0]);
    $ipTemplate[$ipOffset + 2] = [System.Convert]::ToByte($ipParts[1]);
    $ipTemplate[$ipOffset + 4] = [System.Convert]::ToByte($ipParts[2]);
    $ipTemplate[$ipOffset + 6] = [System.Convert]::ToByte($ipParts[3]);
    return [System.Convert]::ToBase64String($ipTemplate);
}

function Generate-AddressConfig {
    Param ([int]$index, [string]$ip, [string]$subnet, [bool]$allow)

    $ipTemplate = "AwEDAQMBAwEC";
    $ipConfig = Generate-IpOrSubnetString -ip $ip -ipTemplateString $ipTemplate -ipOffset 1;

    $subnetTemplate = "LgQD/wP/A/8D/wMA";
    $subnetConfig = Generate-IpOrSubnetString -ip $subnet -ipTemplateString $subnetTemplate -ipOffset 3;
    $addressConfig = [System.Convert]::FromBase64String("AQAAABkDAAAAAQAAAC4EAwEDAQMBAwECAAAALgQD/wP/A/8D/wMAAABn".Replace($ipTemplate, $ipConfig).Replace($subnetTemplate, $subnetConfig));
    [System.Buffer]::BlockCopy([System.BitConverter]::GetBytes($index), 0, $addressConfig, 0, 4);
    $addressConfig[$addressConfig.Count - 1] = If($allow) { 104 } else { 103 };
    return [System.Convert]::ToBase64String($addressConfig);
}

function Generate-RemoteRestrictions {
    Param ([bool]$globalDeny, [string[]] $addresses)

    $header = [System.Convert]::FromBase64String("/wEZAgAAAAEAAABnAgAAABkAAAAA");
    $addressCountBytes = [System.BitConverter]::GetBytes($addresses.Count);
    [System.Buffer]::BlockCopy($addressCountBytes, 0, $header, 17, 4);
    $header[11] = If($globalDeny) { 104 } else { 103 };
    $remoteRestrictions = [System.Convert]::ToBase64String($header);
    $index = 0;
    foreach ($address in $addresses) {
        $ip = $address.Split('/')[0];
        $subnet = $address.Split('/')[1];
        $remoteRestrictions += (Generate-AddressConfig -index $index -ip $ip -subnet $subnet -allow (-Not $globalDeny));
        $index++;
    }
    return $remoteRestrictions;
}