How to remove my server IP showing in remote address?

Question

I have already referred to this post. But my query is a little different since I want to know if I can achieve this from IIS?

Here is how the Remote Address looks like when I inspect element.

Now, the problem is the IP that is seen is of the server where all my files for the website are deployed and there are concerns from the security team as follows

The application discloses internal IP addresses which can aid attackers in mapping out the internal infrastructure of the network. This information can be used to craft other types of attacks.

Here is what I have tried so far..

So in the web.config I was able to remove some other details that were showing in the Response Headers like the asp.net version etc.

<httpProtocol>
  <customHeaders>
    <add name="X-UA-Compatible" value="IE=edge" />
    <add name="X-Frame-Options" value="ALLOW-FROM https://dev.org.com"/>
    <add name="Content-Security-Policy" value="frame-ancestors 'self' https://dev.org.com"/>
    <add name="Strict-Transport-Security" value="max-age=31536000"/>
    <remove name="ETag"/>
    <remove name="X-AspNet-Version" />
    <remove name="X-Powered-By" />
  </customHeaders>
</httpProtocol>

My question..

I understand one solution here is to mask a Proxy IP, but if there is some sort of setting that I can apply from IIS or web.config to achieve this, then I'd prefer that.

Answer 1

I'm afraid IIS can't help in this case.

Because there is no server variable indicate the IP address of remote server. IIS can only help you rewrite server variable and it is obviously that Server's IP is not included in either request or response context.

I think chrome might get the value from either TCP connction or DNS response.

If you want to hide it, you may have to create a reverse proxy.

https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/reverse-proxy-with-url-rewrite-v2-and-application-request-routing