title: IIS legacy Web app through firewall only visible in Salesforce
body: <p>We have a legacy app that is hosted on an IIS7 web server on our LAN. I'd like to embed it in our Salesforce org so that remote employees can access it without using VPN as some of the customer sites they work at do not allow the ports the VPN requires. If I use an iframe is there a way in IIS to limit the requesting "source" to a specific URL? I don't want the app accessible anywhere but, from within Salesforce.</p>
  
  <p>I mistakenly tried limiting the firewall pass through/NAT rule to only allow SF IP addresses but, in that case the requesting source is actually the IP of the client not SF so that doesn't work.  </p>