Win2003下經過IP安全策略限制udp-flood發包的批處理代碼

在Windows 2003下經過IP安全策略限制udp-flood發包實現方法。

新建bat腳本，添加如下內容，而後點擊運行。

:edit by http://www.jbxue.com
:DROP UDP Flood
@echo off
cls
:獲取DNS地址
for /f "delims=: tokens=1,2" %%a in ('ipconfig /all ^|findstr /i "DNS Server"') do (
set DNSIP=%%b
)
:新建IP安裝策略禁止UDP
netsh ipsec static add policy name=禁止UDP description=容許DNS，拒絕其它UDP外出
:新建IP安全規則
netsh ipsec static add filterlist name=容許UDP
netsh ipsec static add filterlist name=拒絕UDP
:新建IP篩選器
netsh ipsec static add filter filterlist=容許UDP srcaddr=me dstaddr=%DNSIP% description=容許DNS查詢 protocol=udp mirrored=yes dstport=53
netsh ipsec static add filter filterlist=拒絕UDP srcaddr=me dstaddr=any description=禁止UDP外出 protocol=udp mirrored=yes
:新建IP篩選器操做
netsh ipsec static add filteraction name=容許DNS查詢 action=permit
netsh ipsec static add filteraction name=拒絕UDP外出 action=block
:封裝策略
netsh ipsec static add rule name=容許規則 policy=禁止UDP  filterlist=容許UDP filteraction=容許DNS查詢
netsh ipsec static add rule name=拒絕規則 policy=禁止UDP  filterlist=拒絕UDP filteraction=拒絕UDP外出
:應用IP安全策略
netsh ipsec static set policy name=禁止UDP assign=y