Win2003设置IP安全策略批处理脚本
2020-06-09 13:50:24
供稿：网友
代码如下:
REM =================开始================
netsh ipsec static ^
add policy name=bim
REM 添加2个动作，block和permit
netsh ipsec static ^
add filteraction name=Permit action=permit
netsh ipsec static ^
add filteraction name=Block action=block
REM 首先禁止所有访问
netsh ipsec static ^
add filterlist name=AllAccess
netsh ipsec static ^
add filter filterlist=AllAccess srcaddr=Me dstaddr=Any
netsh ipsec static ^
add rule name=BlockAllAccess policy=bim filterlist=AllAccess filteraction=Block
REM 开放某些IP无限制访问
netsh ipsec static ^
add filterlist name=UnLimitedIP
netsh ipsec static ^
add filter filterlist=UnLimitedIP srcaddr=61.128.128.67 dstaddr=Me
netsh ipsec static ^
add rule name=AllowUnLimitedIP policy=bim filterlist=UnLimitedIP filteraction=Permit
REM 开放某些端口
netsh ipsec static ^
add filterlist name=OpenSomePort
netsh ipsec static ^
add filter filterlist=OpenSomePort srcaddr=Any dstaddr=Me dstport=20 protocol=TCP
netsh ipsec static ^
add filter filterlist=OpenSomePort srcaddr=Any dstaddr=Me dstport=21 protocol=TCP
netsh ipsec static ^
add filter filterlist=OpenSomePort srcaddr=Any dstaddr=Me dstport=80 protocol=TCP
netsh ipsec static ^
add filter filterlist=OpenSomePort srcaddr=Any dstaddr=Me dstport=3389 protocol=TCP
netsh ipsec static ^
add rule name=AllowOpenSomePort policy=bim filterlist=OpenSomePort filteraction=Permit
REM 开放某些ip可以访问某些端口
netsh ipsec static ^
add filterlist name=SomeIPSomePort
netsh ipsec static ^
add filter filterlist=SomeIPSomePort srcaddr=Me dstaddr=Any dstport=80 protocol=TCP
netsh ipsec static ^
add filter filterlist=SomeIPSomePort srcaddr=61.128.128.68 dstaddr=Me dstport=1433 protocol=TCP
netsh ipsec static ^
add rule name=AllowSomeIPSomePort policy=bim filterlist=SomeIPSomePort filteraction=Permit
"netsh"是Windows 2000/XP/2003操作系统自身提供的命令行脚本实用工具，它允许用户在本地或远程显示或修改当前正在运行的计算机的网络配置。
netsh ipsec，听闻只有windows2003才能运行。在2003下测试的。
IP安全策略，我自身的理解就是：一个安全策略由一条条规则组成，而这些规则是由2部分组成的。首先要建立一个ip筛选器（用来指定那些地址）。然后呢是筛选器操作（用来指定对这些ip的操作，就是动作）一个安全策略编写完成了，首先要激活，才能使用，那就是指派。
下面用实例来说明，然后附带一些常用的。这个例子就是不允许ip为192.168.1.2的机器访问我的3389端口。'后面是注析
'建立一个名字叫XBLUE的安全策略先
netsh ipsec static add policy name=XBLUE
'建立一个ip筛选器，指定192.168.1.2
netsh ipsec static add filterlist name=denyip
netsh ipsec static add filter filterlist=denyip srcaddr=192.168.1.2 dstaddr=Me dstport=3389 protocol=TCP
