防火墙操作

比眉伴天荒 2021-12-10 01:45 348阅读 0赞

转：[https://blog.51cto.com/xiaoli110/1080426][https_blog.51cto.com_xiaoli110_1080426]

1.  rem windows 防火墙匹配原则
2.  rem 1 优先匹配安全连接规则
3.  rem 2 匹配阻止的规则
4.  rem 3 匹配允许的规则
5.  rem 4 按照默认策略匹配，一般是阻止，除非做了修改
6.  rem 所有如果有端口有些ip允许，有些不允许，应该写一个允许规则，然后将允许的ip加入到规则中，不需要再添加一个阻止规则！
7.  rem 负责会造成对这个端口的访问全部被阻止！
8.  
9.  rem 恢复防火墙到默认值
10. netsh advfirewall reset
11. rem 防火墙日志位置 %systemroot%\\system32\\LogFiles
12. 
13. rem 如何避免很长的一行，使用变量！
14. set innet\_ip=10.0.0.0/255.0.0.0,172.16.0.0/255.255.0.0,192.168.0.0/255.255.0.0
15. set in\_common\_tcp\_port=135,139,445,23,80,21
16. set in\_common\_udp\_port=137,138
17. 
18. rem 用法: add rule name=<string>
19. rem dir=in|out
20. rem action=allow|block|bypass
21. rem \[program=<program path>\]
22. rem \[service=<service short name>|any\]
23. rem \[description=<string>\]
24. rem \[enable=yes|no (default=yes)\]
25. rem \[profile=public|private|domain|any\[,...\]\]
26. rem \[localip=any|<IPv4 address>|<IPv6 address>|<subnet>|<range>|<list>\]
27. rem \[remoteip=any|localsubnet|dns|dhcp|wins|defaultgateway|
28. rem <IPv4 address>|<IPv6 address>|<subnet>|<range>|<list>\]
29. rem \[localport=0-65535|<port range>\[,...\]|RPC|RPC-EPMap|IPHTTPS|any (default=any)\]
30. rem \[remoteport=0-65535|<port range>\[,...\]|any (default=any)\]
31. rem \[protocol=0-255|icmpv4|icmpv6|icmpv4:type,code|icmpv6:type,code|
32. rem tcp|udp|any (default=any)\]
33. rem \[interfacetype=wireless|lan|ras|any\]
34. rem \[rmtcomputergrp=<SDDL string>\]
35. rem \[rmtusrgrp=<SDDL string>\]
36. rem \[edge=yes|deferapp|deferuser|no (default=no)\]
37. rem \[security=authenticate|authenc|authdynenc|authnoencap|notrequired
38. rem (default=notrequired)\]
39. rem 例子
40. rem 为不具有封装的 messenger.exe 添加入站规则:
41. rem netsh advfirewall firewall add rule name="allow messenger"
42. rem dir=in program="c:\\programfiles\\messenger\\msmsgs.exe"
43. rem security=authnoencap action=allow
44. 
45. rem 为端口 80 添加出站规则:
46. rem netsh advfirewall firewall add rule name="allow80"
47. rem protocol=TCP dir=out localport=80 action=block
48. 
49. rem 为 TCP 端口 80 通信添加需要安全和加密的入站规则:
50. rem netsh advfirewall firewall add rule
51. rem name="Require Encryption for Inbound TCP/80"
52. rem protocol=TCP dir=in localport=80 security=authdynenc
53. rem action=allow
54. rem 修改规则set rule name=<string> 规则属性
55. 
56. rem 关闭网络共享和常用端口,但是允许内网访问
57. netsh advfirewall firewall add rule name="deny smb common tcp" description="deny smb common and tcp port" protocol=TCP dir=in remoteip=%innet\_ip% localport=%in\_common\_tcp\_port% action=allow enable=yes
58. netsh advfirewall firewall add rule name="deny smb common udp" description="deny smb common and udp port" protocol=UDP dir=in remoteip=%innet\_ip% localport=%in\_common\_udp\_port% action=allow enable=yes
59. 
60. rem 允许内网访问
61. netsh advfirewall firewall add rule name="allow in net" description="permit in net" protocol=any dir=in remoteip=%innet\_ip% action=allow
62. 
63. rem 允许远程桌面
64. netsh advfirewall firewall add rule name="permitT3389 (RDP Access)" protocol=TCP dir=in remoteip=%snda\_ip% localport=3389 action=allow
65. 
66. 
67. rem 允许icmp
68. netsh advfirewall firewall add rule name="permit\_icmp" protocol=ICMPv4 dir=in remoteip=any action=allow
69. 
70. 
71. rem 多个ip段
72. netsh advfirewall firewall add rule name="nets" description="innet B class" dir=in action=allow
73. 
74. rem Ip段1 128.1.0.0/16
75. set net\_ip=128.1.0.0/255.255.0.0
76. rem Ip段2 128.2.0.0/16
77. set net\_ip=%net\_ip%,128.2.0.0/255.255.0.0
78. netsh advfirewall firewall set rule name="nets" new remoteip=%net\_ip%

[https_blog.51cto.com_xiaoli110_1080426]: https://blog.51cto.com/xiaoli110/1080426