<system.webServer>
  <security>
    <ipSecurity allowUnlisted="false" denyAction="NotFound">
      <add allowed="true" ipAddress="123.456.0.0" subnetMask="255.255.0.0"/>
    </ipSecurity>
  </security>
</system.webServer>