rem 开放某些机器的无限制访问，比如你的工作用机
ipsecpol -w REG -p "Haishion" -r "Allow IP" -f ^
210.34.0.1+0 ^
210.34.0.2+0 ^
-n PASS
rem 开放服务器端口，比如http 80，ftp 20，21
ipsecpol -w REG -p "Haishion" -r "Open Port" -f ^
*+0:20:TCP ^
*+0:21:TCP ^
*+0:80:TCP ^
-n PASS
rem 开放某些特定的ip可以访问特定的端口
ipsecpol -w REG -p "Haishion" -r "Allow IP Port" -f ^
0+*:53:UDP ^
0+*:80:TCP ^
210.34.0.3+0:8080:TCP ^
-n PASS
rem 指派
ipsecpol -w REG -p "Haishion" -x
REM =================开始================
netsh ipsec static ^
add policy name=bim
REM 添加2个动作，block和permit
netsh ipsec static ^
add filteraction name=Permit action=permit
netsh ipsec static ^
add filteraction name=Block action=block
REM 首先禁止所有访问
netsh ipsec static ^
add filterlist name=AllAccess
netsh ipsec static ^
add filter filterlist=AllAccess srcaddr=Me dstaddr=Any
netsh ipsec static ^
add rule name=BlockAllAccess policy=bim filterlist=AllAccess filteraction=Block
REM 开放某些IP无限制访问
netsh ipsec static ^
add filterlist name=UnLimitedIP
netsh ipsec static ^
add filter filterlist=UnLimitedIP srcaddr=61.128.128.67 dstaddr=Me
netsh ipsec static ^
add rule name=AllowUnLimitedIP policy=bim filterlist=UnLimitedIP filteraction=Permit
REM 开放某些端口
netsh ipsec static ^
add filterlist name=OpenSomePort
netsh ipsec static ^
add filter filterlist=OpenSomePort srcaddr=Any dstaddr=Me dstport=20 protocol=TCP
netsh ipsec static ^
add filter filterlist=OpenSomePort srcaddr=Any dstaddr=Me dstport=21 protocol=TCP
netsh ipsec static ^
add filter filterlist=OpenSomePort srcaddr=Any dstaddr=Me dstport=80 protocol=TCP
netsh ipsec static ^
add filter filterlist=OpenSomePort srcaddr=Any dstaddr=Me dstport=3389 protocol=TCP
netsh ipsec static ^
add rule name=AllowOpenSomePort policy=bim filterlist=OpenSomePort filteraction=Permit
REM 开放某些ip可以访问某些端口
netsh ipsec static ^
add filterlist name=SomeIPSomePort
netsh ipsec static ^
add filter filterlist=SomeIPSomePort srcaddr=Me dstaddr=Any dstport=80 protocol=TCP
netsh ipsec static ^
add filter filterlist=SomeIPSomePort srcaddr=61.128.128.68 dstaddr=Me dstport=1433 protocol=TCP
netsh ipsec static ^
add rule name=AllowSomeIPSomePort policy=bim filterlist=SomeIPSomePort filteraction=Permit
