netsh ipsec

链接：

http://technet.microsoft.com/en-US/cc725926

http://msdn.microsoft.com/en-us/cc739550(zh-cn,WS.10).aspx

 

创建策略
netsh ipsec static add policy name="DIY Policy" description="Port accessed policy."
创建两个过滤器
netsh ipsec static add filterlist name="Trust" description="Permit accessed rules."

netsh ipsec static add filterlist name="Distrust" description="Block accessed rules."

分别为过滤器创建规则
netsh ipsec static add filter filterlist="Trust" srcaddr=any srcport=53 dstaddr=me dstport=0 protocol=udp mirrored=yes description="Permit Any UDP(53) accessed Me UDP(All) ports."

netsh ipsec static add filter filterlist="Trust" srcaddr=any srcport=53 dstaddr=me dstport=0 protocol=tcp mirrored=yes description="Permit Any TCP(53) accessed Me TCP(all) ports."

netsh ipsec static add filter filterlist="Trust" srcaddr=any srcport=80 dstaddr=me dstport=0 protocol=tcp mirrored=yes description="Permit Any TCP(80) accessed Me TCP(all) ports."

netsh ipsec static add filter filterlist="Trust" srcaddr=any srcport=0 dstaddr=me dstport=80 protocol=tcp mirrored=yes description="Permit Any TCP(all) accessed Me TCP(80) ports."

netsh ipsec static add filter filterlist="Trust" srcaddr=any srcport=0 dstaddr=me dstport=3389 protocol=tcp mirrored=yes description="Permit Any TCP(all) accessed Me TCP(3389) ports."

netsh ipsec static add filter filterlist="Distrust" srcaddr=any srcport=0 dstaddr=me dstport=0 protocol=tcp mirrored=no description="Block Any TCP(all) accessed Me TCP(all) ports."

netsh ipsec static add filter filterlist="Distrust" srcaddr=any srcport=0 dstaddr=me dstport=0 protocol=udp mirrored=no description="Block Any(all) accessed Me UDP(all) ports."

创建过滤动作
netsh ipsec static add filteraction name="Permit" action=permit

netsh ipsec static add filteraction name="Block" action=block

将过滤器与过滤动作关联
netsh ipsec static add rule name="Trusted rules" policy="DIY Policy" filterlist="Trust" filteraction="Permit"

netsh ipsec static add rule name="Distrust rules" policy="DIY Policy" filterlist="Distrust" filteraction="Block"

启用和停止策略
netsh ipsec static set policy name="DIY Policy" assign=y

netsh ipsec static set policy name="DIY Policy" assign=n

 

删除策略
netsh ipsec static add policy name="DIY Policy" description="Port accessed policy."

 

启动关闭服务

sc config "PolicyAgent" start= auto

sc start PolicyAgent

sc delete PolicyAgent

 

 

XP下IPSEC

工具：ipseccmd.exe，winipsec.dll

启动

ipseccmd -w REG -p "Block default ports" -y
ipseccmd -w REG -p "Block default ports" -o
ipseccmd -w REG -p "Block default ports" -r "Block TCP/135" -f *+0:135:TCP -n BLOCK -x
ipseccmd -w REG -p "Block default ports" -r "Block ping" -f *+0::ICMP -n BLOCK -x
ipseccmd -w REG -p "Block default ports" -x
Pause

删除

ipseccmd.exe -w REG -p "Block default ports" -y
ipseccmd.exe -w REG -p "Block default ports" -o
pause