Windows 屏蔽高危端口脚本bat

Posted 2020-10-11

  本文主要阐述如何在Windows系统下简单快速对高危端口进行屏蔽。

  以下为windows几个常用高危端口屏蔽bat脚本参考：

REM 添加策略

netsh ipsec static add policy name=secport

netsh ipsec static add filterlist name=drop-port

REM 添加筛选器到IP筛选器列表

netsh ipsec static add filter filterlist=drop-port srcaddr=any dstaddr=me description=任何到我的访问 protocol=tcp mirrored=yes dstport=135

netsh ipsec static add filter filterlist=drop-port srcaddr=any dstaddr=me description=任何到我的访问 protocol=tcp mirrored=yes dstport=137

netsh ipsec static add filter filterlist=drop-port srcaddr=any dstaddr=me description=任何到我的访问 protocol=udp mirrored=yes dstport=137

netsh ipsec static add filter filterlist=drop-port srcaddr=any dstaddr=me description=任何到我的访问 protocol=tcp mirrored=yes dstport=139

netsh ipsec static add filter filterlist=drop-port srcaddr=any dstaddr=me description=任何到我的访问 protocol=tcp mirrored=yes dstport=445

REM 添加筛选器操作

netsh ipsec static add filteraction name=drop-data action=block

REM 创建一个链接指定 IPSec 策略、筛选器列表和筛选器操作的规则

netsh ipsec static add rule name=拒绝规则 policy=secport filterlist=drop-port filteraction=drop-data

REM 激活安全策略

netsh ipsec static set policy name=secport assign=y

本文出自 “DDos886” 博客，请务必保留此出处http://ddos886.blog.51cto.com/13388172/1972793