如何通过编程向Web.Config添加system.webServer.rewrite.rules的IP拦截规则

你之前尝试的ConfigurationManager无法直接访问system.webServer节点，是因为这个节点属于IIS专属配置节，不在.NET默认的配置处理范围内。下面提供两种可靠的实现方案：

方法1：直接操作XML文档（轻量无依赖） #

这种方式无需额外库，直接通过XML API修改Web.config，适合快速实现：

using System.Xml;

// 替换为你的Web.config实际路径
var webConfigPath = @"C:\inetpub\wwwroot\YourWebsite\Web.config";
var xmlDoc = new XmlDocument();
// 保留原有格式，避免保存后XML结构混乱
xmlDoc.PreserveWhitespace = true;
xmlDoc.Load(webConfigPath);

// 定位到"IP Blocking"规则的conditions节点
var conditionsNode = xmlDoc.SelectSingleNode("//rewrite/rules/rule[@name='IP Blocking']/conditions");
if (conditionsNode != null)
{
    string maliciousIp = "192.168.1.100"; // 替换为监测到的异常IP

    // 检查IP是否已存在，避免重复添加
    bool isRemoteAddrExist = xmlDoc.SelectSingleNode($"//rewrite/rules/rule[@name='IP Blocking']/conditions/add[@input='{{REMOTE_ADDR}}' and @pattern='{maliciousIp}']") != null;
    bool isXForwardedForExist = xmlDoc.SelectSingleNode($"//rewrite/rules/rule[@name='IP Blocking']/conditions/add[@input='{{HTTP_X_Forwarded_For}}' and @pattern='{maliciousIp}']") != null;

    if (!isRemoteAddrExist)
    {
        // 添加REMOTE_ADDR拦截条件
        var remoteAddrAdd = xmlDoc.CreateElement("add");
        remoteAddrAdd.SetAttribute("input", "{REMOTE_ADDR}");
        remoteAddrAdd.SetAttribute("pattern", maliciousIp);
        conditionsNode.AppendChild(remoteAddrAdd);
    }

    if (!isXForwardedForExist)
    {
        // 添加X-Forwarded-For拦截条件
        var xForwardedForAdd = xmlDoc.CreateElement("add");
        xForwardedForAdd.SetAttribute("input", "{HTTP_X_Forwarded_For}");
        xForwardedForAdd.SetAttribute("pattern", maliciousIp);
        conditionsNode.AppendChild(xForwardedForAdd);
    }

    try
    {
        xmlDoc.Save(webConfigPath);
    }
    catch (UnauthorizedAccessException)
    {
        // 处理权限问题：确保程序以管理员身份运行，或给Web.config所在目录添加写入权限
    }
}

注意事项 #

• 必须开启PreserveWhitespace，否则保存后XML格式会被打乱
• 需确保WinForms程序拥有Web.config文件的写入权限，建议以管理员身份运行

方法2：使用Microsoft.Web.Administration库（官方推荐） #

这是微软官方提供的IIS管理API，专门用于处理IIS相关配置，比XML操作更安全可靠：

1. 首先安装NuGet包：Microsoft.Web.Administration
2. 编写代码：

using Microsoft.Web.Administration;

// 替换为你的IIS站点名称，或直接指定Web.config路径
var siteName = "YourIISSiteName";
using (var serverManager = new ServerManager())
{
    // 加载站点配置，也可以用serverManager.OpenWebConfiguration(null, webConfigPath)直接指定文件路径
    var config = serverManager.GetWebConfiguration(siteName);
    var rewriteRules = config.GetSection("system.webServer/rewrite/rules").GetCollection();

    // 查找"IP Blocking"规则
    ConfigurationElement ipBlockingRule = null;
    foreach (var rule in rewriteRules)
    {
        if (rule.Attributes["name"].Value == "IP Blocking")
        {
            ipBlockingRule = rule;
            break;
        }
    }

    if (ipBlockingRule != null)
    {
        string maliciousIp = "192.168.1.100";
        var conditions = ipBlockingRule.GetCollection("conditions");

        // 检查条件是否已存在
        bool remoteAddrExists = conditions.Any(c => 
            c.Attributes["input"].Value == "{REMOTE_ADDR}" && 
            c.Attributes["pattern"].Value == maliciousIp);
        bool xForwardedForExists = conditions.Any(c => 
            c.Attributes["input"].Value == "{HTTP_X_Forwarded_For}" && 
            c.Attributes["pattern"].Value == maliciousIp);

        if (!remoteAddrExists)
        {
            var newRemoteAddrCondition = conditions.CreateElement("add");
            newRemoteAddrCondition.Attributes["input"].Value = "{REMOTE_ADDR}";
            newRemoteAddrCondition.Attributes["pattern"].Value = maliciousIp;
            conditions.Add(newRemoteAddrCondition);
        }

        if (!xForwardedForExists)
        {
            var newXForwardedForCondition = conditions.CreateElement("add");
            newXForwardedForCondition.Attributes["input"].Value = "{HTTP_X_Forwarded_For}";
            newXForwardedForCondition.Attributes["pattern"].Value = maliciousIp;
            conditions.Add(newXForwardedForCondition);
        }

        // 提交配置更改
        serverManager.CommitChanges();
    }
}

注意事项 #

• 程序必须以管理员身份运行，否则无法访问IIS配置
• 该方法会自动验证配置合法性，避免手动修改XML可能出现的格式错误

内容的提问来源于stack exchange，提问作者Rusty Nail