This is my web.config which has some tags for blocking Ipaddress
...
Don't forget custom site delegation. This allows you to only allow delegation to sites you intend.