<authentication mode="Forms">
  <forms name=".ASPXAUTH" loginUrl="login.aspx" protection="All" timeout="999999">
    <credentials passwordFormat="MD5">
      <user name="admin" password="passwordhashhere" />
    </credentials>
  </forms>
</authentication>
<authorization>
  <allow users="?" />
</authorization>

<location path="Admin">
  <system.web>
    <authorization>
      <allow users="admin" />
      <deny users="*" />
    </authorization>
  </system.web>
</location>

<div class="user">
    <p>Username:</p>
    <br />
    <asp:TextBox ID="TextBoxUser" runat="server"></asp:TextBox>
</div>

<div class="pass">
    <p>Password:</p>
    <br />
    <asp:TextBox ID="TextBoxPass" runat="server" TextMode="Password"></asp:TextBox>
</div>

<div class="login">
    <asp:Button ID="ButtonLogin" runat="server" Text="Log In" />
    <asp:Label ID="LabelError" runat="server" Text=""></asp:Label>
</div>

Protected Sub ButtonLogin_Click(sender As Object, e As System.EventArgs) Handles ButtonLogin.Click
    If Membership.ValidateUser(TextBoxUser.Text, TextBoxPass.Text) Then
        If Request.QueryString("ReturnUrl") IsNot Nothing Then
            FormsAuthentication.RedirectFromLoginPage(TextBoxUser.Text, False)
        Else
            FormsAuthentication.SetAuthCookie(TextBoxUser.Text, False)
        End If
    Else
        LabelError.Text = "Invalid UserID and Password"
    End If
End Sub

<deny users="?" />

<allow users="*" />