命令行IPSEC封锁端口

今天
天气还不错，赶快放心大胆的去网上冲浪去吧，海岸上有漂亮的贝壳，不要忘了
捡几颗送给我哦。

[代码清单]

@ echo off
rem
rem blockport.bat
rem Spirituel@SMTH
rem
rem This file use the IPsec filters to block default ports of Windows.
rem It can work on Windows 2003 and Windows XP system if there is ipseccmd command on it.
rem It can also work on Windows2000, if you chang "ipseccmd" to "ipsecpol" when ipsecpol command could work well.
rem You can customize your own policy easily.
rem please refer to README.txt for more details.
rem NOTICE: NO WARRANTY totally. Please use it carefully.
rem
rem
rem
echo [Usage] blockport [ -o or -y ]
echo set policy of filter rules and and enable them without parameter.
echo -y parameter to make the policy inactive.
echo -o parameter to disable and delete the policy.

if "%1"=="-y" goto :inactive
if "%1"=="-o" goto :delete

@ echo on
ipseccmd -w REG -p "Block default ports" -y
ipseccmd -w REG -p "Block default ports" -o
ipseccmd -w REG -p "Block default ports" -r "Block TCP/135" -f *+0:135:TCP -n BLOCK
ipseccmd -w REG -p "Block default ports" -r "Block TCP/139" -f *+0:139:TCP -n BLOCK
ipseccmd -w REG -p "Block default ports" -r "Block TCP/445" -f *+0:445:TCP -n BLOCK
ipseccmd -w REG -p "Block default ports" -r "Block UDP/123" -f *+0:123:UDP -n BLOCK
ipseccmd -w REG -p "Block default ports" -r "Block UDP/135" -f *+0:135:UDP -n BLOCK
ipseccmd -w REG -p "Block default ports" -r "Block UDP/137" -f *+0:137:UDP -n BLOCK
ipseccmd -w REG -p "Block default ports" -r "Block UDP/138" -f *+0:138:UDP -n BLOCK
ipseccmd -w REG -p "Block default ports" -r "Block UDP/139" -f *+0:139:UDP -n BLOCK
ipseccmd -w REG -p "Block default ports" -r "Block UDP/445" -f *+0:445:UDP -n BLOCK
@ rem ipseccmd -w REG -p "Block default ports" -r "Block ping" -f 0+*::ICMP -n BLOCK
ipseccmd -w REG -p "Block default ports" -x
@ goto :end

∶inactive
@ echo on
ipseccmd -w REG -p "Block default ports" -y
@ goto :end

∶delete
@ echo on
ipseccmd -w REG -p "Block default ports" -y
ipseccmd -w REG -p "Block default ports" -o

∶end
@ echo off
pause

IPSec可以通过组策略来控制，但我找遍MSDN，也没有找到相应的安全模板的语法。已经配置好的IPSec策略也不能被导出为模板。所以，组策略这条路走不通。IPSec的设置保存在注册表中(HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local)，理论上可以通过修改注册表来配置IPSec。但很多信息以二进制形式存放，读取和修改都很困难。相比之下，上传命令行工具更方便。

2000下 ipsecpol实例

关于ipsecpol和ipseccmd的资料，网上可以找到很多，因此本文就不细说了，只是列举一些实用的例子。
在设置IPSec策略方面，ipseccmd命令的语法和ipsecpol几乎完全一样，所以只以ipsecpol为例：

1，防御rpc-dcom攻击

ipsecpol -p myfirewall -r rpc-dcom -f *+0:135:tcp *+0:135:udp *+0:137:udp *+0:138:udp *+0:139:tcp *+0:445:tcp *+0:445:udp -n BLOCK -w reg -x

这条命令关闭了本地主机的TCP135,139,445和udp135,137,138,445端口。
具体含义如下：
-p myfirewall 指定策略名为myfirewall
-r rpc-dcom 指定规则名为rpc-dcom
-f …… 建立7个筛选器。*表示任何地址(源)；0表示本机地址(目标)；+表示镜像(双向)筛选。详细语法见ipsecpol -?
-n BLOCK 指定筛选x作是“阻塞”。注意，BLOCK必须是大写。
-w reg 将配置写入注册表，重启后仍有效。
-x 立刻激活该策略。

2，防止被ping

ipsecpol -p myfirewall -r antiping -f *+0::icmp -n BLOCK -w reg -x

如果名为myfirewall的策略已存在，则antiping规则将添加至其中。
注意，该规则同时也阻止了该主机ping别人。

上一页  [1] [2] [3] 下一页