Windows IPsec IP安全策略
IPsec 是一个很有用的功能,以前在服务器端上用过,哪个时候常常都手动添加,量少还好,多了就会觉得繁琐。
下面就来了解下基于CMD版本的IPsec
# 批处理小知识
bat脚本获取管理员权限
@echo off %1 mshta vbscript:CreateObject("Shell.Application").ShellExecute("cmd.exe","/c %~s0 ::","","runas",1)(window.close)&&exit cd /d "%~dp0"
## CMD批处理添加IPsec
# 创建一个名字为“IPblock_list”的安全策略,并添加安全策略描述(policy )
netsh ipsec static add policy name=IPblock_list description="IP Block List"
# 创建筛选列表(filterlist)
example:
netsh ipsec static add filterlist name=denyAll
# 创建筛选器(filter)
筛选器的参数及含义如下:
标签 值
filterlist -筛选器要添加到的筛选器列表的名称。
srcaddr -源 ip 地址,dns 名称或 server 类型。
dstaddr -目标 ip 地址,dns 名称或 server 类型。
description -筛选器的简短信息。
protocol -可以是 ANY,ICMP,TCP,UDP,RAW,或者一个整数。
mirrored -值为 yes 将创建两个筛选器,每个方向一个。
srcmask -源地址掩码或一个 1 到 32 的前缀。
dstmask -目标地址掩码一个 1 到 32 的前缀。
srcport -数据包的源端口。值为 0 意味着任意端口。
dstport -数据包的目标端口。值为 0 意味着任意端口。
netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=21 description="TCP21ftp"
netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=23 description="TCP23telnet"
netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=135 description="TCP135RPC"
netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=139 description="TCP139NetworkShare"
netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=445 description="TCP445SMB"
netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=UDP dstport=69 description="UDP69Tftp"
netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=UDP dstport=137 description="UDP137NetBIOS"
netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=UDP dstport=138 description="UDP138NetBIOS"
## 创建筛选器动作(filteraction)
创建筛选器动作的相关参数:
标签 值
name -筛选器操作的名称。
description -筛选器操作类别的简短信息。
qmpfs -设置快速模式完全向前保密的选项。
inpass -接受不安全的通讯,但是总是用 IPSec响应。这接受 yes 或 no。
soft -允许与没有 IPSec 的计算机进行不安全的通讯。可以是 yes 或 no。
action -可以是 permit,block 或 negotiate。
netsh ipsec static add filteraction name=allow action=permit
netsh ipsec static add filteraction name=deny action=block
# 添加一个规则(rule)
netsh ipsec static add rule name=deny policy=IPblock_list filterlist=denyAll filteraction=deny
# 指派安全策略(policy)
netsh ipsec static set policy name=IPblock_list assign=y
# 导出安全策略(policy)
netsh ipsec static exportpolicy c:\Loki.ipsec
# 把安全策略导入(policy)
netsh ipsec static importpolicy c:\Loki.ipsec
# 删除所有IP安全策略(policy)
删除IP安全策略中的所有的内容,包括所有的策略、规则、筛选器列表、筛选器、筛选器动作等。
netsh ipsec static del all
# 自己制作的IPsec 批处理 for Win11
@ echo off %1 %2 ver|find "5.">nul&&goto :Admin mshta vbscript:createobject("shell.application").shellexecute("%~s0","goto :Admin","","runas",1)(window.close)&goto :eof :: Author: Loki 20211012 beta1 :Admin echo setp. 1/7 Clean up and Back up other old IPsec netsh ipsec static exportpolicy c:\old_ipsec.ipsec netsh ipsec static del all cls echo setp. 2/7 Create policy netsh ipsec static add policy name=IPblock_list description="IP Block List for Loki 20211012" cls echo setp. 3/7 Create filterlist netsh ipsec static add filterlist name=denyAll cls echo setp. 4/7 Create filter TCP 21 23 135 139 445 UDP 69 137 138 netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=21 description="TCP21ftp" netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=23 description="TCP23telnet" netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=135 description="TCP135RPC" netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=139 description="TCP139NetworkShare" netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=TCP dstport=445 description="TCP445SMB" netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=UDP dstport=69 description="UDP69Tftp" netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=UDP dstport=137 description="UDP137NetBIOS" netsh ipsec static add filter filterlist=denyAll srcaddr=0.0.0.0 srcmask=0.0.0.0 dstaddr=me protocol=UDP dstport=138 description="UDP138NetBIOS" cls echo setp. 5/7 Create filteraction = deny netsh ipsec static add filteraction name=deny action=block cls echo setp. 6/7 Create rule netsh ipsec static add rule name=deny policy=IPblock_list filterlist=denyAll filteraction=deny cls echo setp. 7/7 Assign security policy netsh ipsec static set policy name=IPblock_list assign=y cls echo Congratulations! It's done @pause