Win2003下通过IP安全策略限制udp-flood发包的批处理代码

之前有介绍linux下通过iptables限制udp发包，这次记录下windows 2003的实现方法。

新建bat脚本，添加以下内容，然后点击运行。

:created by //www.jb51.net
:drop udp flood
@echo off
cls
:获取dns地址
for /f "delims=: tokens=1,2" %%a in ('ipconfig /all ^|findstr /i "dns server"') do (
set dnsip=%%b
)
:新建ip安装策略禁止udp
netsh ipsec static add policy name=禁止udp description=允许dns，拒绝其它udp外出
:新建ip安全规则
netsh ipsec static add filterlist name=允许udp
netsh ipsec static add filterlist name=拒绝udp
:新建ip筛选器
netsh ipsec static add filter filterlist=允许udp srcaddr=me dstaddr=%dnsip% description=允许dns查询 protocol=udp mirrored=yes dstport=53
netsh ipsec static add filter filterlist=拒绝udp srcaddr=me dstaddr=any description=禁止udp外出 protocol=udp mirrored=yes
:新建ip筛选器操作
netsh ipsec static add filteraction name=允许dns查询 action=permit
netsh ipsec static add filteraction name=拒绝udp外出 action=block
:封装策略
netsh ipsec static add rule name=允许规则 policy=禁止udp  filterlist=允许udp filteraction=允许dns查询
netsh ipsec static add rule name=拒绝规则 policy=禁止udp  filterlist=拒绝udp filteraction=拒绝udp外出
:应用ip安全策略
netsh ipsec static set policy name=禁止udp assign=y