大家都知道windows2003下的基本防火牆雖然健壯，但功能單一，徵對主動外發的包更無能爲力，ipsec是一個非常好的補充，但ipsec圖形下操作是非常笨拙的，而網上流傳的ipsec安全配置腳本大多隻能運行一次，修改後第二次運行可能造成不需要的策略或規則殘留。
因此本次改進，添加了刪除策略或規則的命令，不過會把系統自帶的也刪掉，那沒有關係，系統自帶的本來就沒有用，並簡化了腳本，在每次修改後可再次運行，便於批量修改。
腳本中每條規則末尾的說明會出現在ipsec的描述中，不用擔心影響腳本的運行。
配置方略： 禁止所有，允許部分
@echo off rem ================================================== rem author 趙亞南 rem date 2013/03/27 rem apply to win2k3 rem ================================================== sc config "PolicyAgent" start= auto sc start PolicyAgent Netsh ipsec static del rule all ipsec_base_config Netsh ipsec static del policy all Netsh ipsec static del filteraction all Netsh ipsec static del filterlist all Netsh ipsec static add policy name=ipsec_base_config activatedefaultrule = no Netsh ipsec static add filteraction name=block action=block Netsh ipsec static add filteraction name=permit action=permit Netsh ipsec static add filterlist name=permitlist Netsh ipsec static add filterlist name=alllist Netsh ipsec static add filter filterlist=permitlist srcaddr=any dstaddr=me protocol=tcp mirrored=yes dstport=80 對外服務端口 Netsh ipsec static add filter filterlist=permitlist srcaddr=1.2.3.4 dstaddr=me protocol=tcp mirrored=yes dstport=3306 數據庫 Netsh ipsec static add filter filterlist=permitlist srcaddr=2.3.4.5 srcmask=32 dstaddr=me dstmask=32 protocol=any mirrored=yes dstport=0 ***-IP Netsh ipsec static add filter filterlist=permitlist srcaddr=2.3.4.6 dstaddr=me protocol=any mirrored=yes dstport=0 ***-IP rem Netsh ipsec static add filter filterlist=permitlist srcaddr=192.168.1.0 srcmask=255.255.255.0 dstaddr=me protocol=any mirrored=yes dstport=0 內網信任網絡 Netsh ipsec static add filter filterlist=permitlist srcaddr=210.72.145.44 srcmask=255.255.255.255 srcport=123 dstaddr=me dstport=123 protocol=UDP mirrored=yes 復旦大學NTP時間同步服務器 Netsh ipsec static add filter filterlist=permitlist srcaddr=any dstaddr=me protocol=ICMP mirrored=yes PING響應，註釋這條可以禁ping，連本機也ping不出去 Netsh ipsec static add filter filterlist=permitlist srcaddr=60.195.252.107 dstaddr=me protocol=udp mirrored=yes dstport=161 監控寶snmp Netsh ipsec static add filter filterlist=permitlist srcaddr=60.195.252.110 dstaddr=me protocol=udp mirrored=yes dstport=161 監控寶snmp Netsh ipsec static add filter filterlist=permitlist srcaddr=60.195.252.106 dstaddr=me protocol=tcp mirrored=yes dstport=3306 監控寶mysql Netsh ipsec static add filter filterlist=permitlist srcaddr=me dstaddr=202.96.128.86 protocol=udp mirrored=yes dstport=53 訪問外網DNS，要換成你當地的DNS Netsh ipsec static add filter filterlist=permitlist srcaddr=me dstaddr=any protocol=tcp mirrored=yes dstport=80 訪問外網WEB Netsh ipsec static add filter filterlist=permitlist srcaddr=me dstaddr=any protocol=tcp mirrored=yes dstport=8080 訪問外網WEB Netsh ipsec static add filter filterlist=permitlist srcaddr=me dstaddr=any protocol=tcp mirrored=yes dstport=443 訪問外網WEB Netsh ipsec static add filter filterlist=permitlist srcaddr=me dstaddr=any protocol=tcp mirrored=yes dstport=21 訪問外網FTP Netsh ipsec static add filter filterlist=alllist srcaddr=any dstaddr=me protocol=any mirrored=yes dstport=0 最後默認阻止其它所有 Netsh ipsec static add rule name=1 policy=ipsec_base_config filterlist=permitlist filteraction=permit Netsh ipsec static add rule name=2 policy=ipsec_base_config filterlist=alllist filteraction=block netsh ipsec static set policy name=ipsec_base_config assign=y
實測通過，注意，運行之後，就只有***才能遠程連上了喲。
原文：http://www.zhaoyanan.cn/win2k3-ipsec.html