ASP.NET MVC - Allow internal anonymous users, require windows authentication on external

It would be easier to handle this rule directly at your firewall.

As an alternative you could configure IP Security at your IIS level and filter by client IP.

But if you have no control over the firewall you could write a custom Authorize attribute that will check the incoming IP address and allow/deny the request:

public class IpBasedAuthorizeAttribute: AuthorizeAttribute
{
    protected override bool AuthorizeCore(HttpContextBase httpContext)
    {
        var ip = httpContext.Request.UserHostAddress;
        return IsAllowed(ip);
    }

    private bool IsAllowed(string ip)
    {
        // TODO: do your checks here and return true or false
        // depending on whether the IP address is allowed to 
        // access the application or not
        throw new NotImplementedException();
    }
}

and then you could either decorate individual controllers/actions with this attribute or register it as a global authorization attribute if you want it to apply to all requests:

public static void RegisterGlobalFilters(GlobalFilterCollection filters)
{
    filters.Add(new HandleErrorAttribute());
    filters.Add(new IpBasedAuthorizeAttribute());
}