web.config

<configuration>
  <system.webServer>
	  <staticContent>
      <remove fileExtension=".woff" /> <!-- In case IIS already has this mime type -->
      <mimeMap fileExtension=".woff" mimeType="application/x-font-woff" />
	    <remove fileExtension=".woff2" /> <!-- In case IIS already has this mime type -->
      <mimeMap fileExtension=".woff2" mimeType="application/x-font-woff2" />
    </staticContent>
    <rewrite>
      <rules>
        <clear />
        <rule name="BlockAccessToPublic" patternSyntax="Wildcard" stopProcessing="true">
          <match url="*" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
            <add input="{URL}" pattern="/web/*" />
          </conditions>
          <action type="CustomResponse" statusCode="403" statusReason="Forbidden: Access is denied." statusDescription="You do not have permission to view this directory or page using the credentials that you supplied." />
        </rule>
        <rule name="RewriteAssetsToPublic" stopProcessing="true">
          <match url="^(.*)(\.css|\.js|\.jpg|\.png|\.gif|\.ttf|\.woff|\.woff2)$" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
          </conditions>
          <action type="Rewrite" url="web/{R:0}" />
        </rule>
        <rule name="RewriteRequestsToPublic" stopProcessing="true">
          <match url="^(.*)$" />
          <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
          </conditions>
          <action type="Rewrite" url="web/app.php/{R:0}" />
        </rule>
      </rules>
    </rewrite>
  </system.webServer>
</configuration>