Windows Server 2003 IPsec 安全性原則腳本：開放常用服務埠、限制特定 IP 存取、預設拒絕全自動化部署

腳本用途

在 Windows Server 2003 上透過 netsh ipsec static 命令批次建立 IP 安全性原則，實現：

• 允許 ICMP (Ping) 雙向通訊。
• 開放常用服務埠 (FTP 20/21、HTTP 80、SQL 1433/3306、RDP 3389、DNS 53) 供任意 IP 存取。
• 允許特定管理 IP (如 125.76.233.185) 無限制存取所有埠。
• 允許本機主動連向外部 HTTP 80、DNS 53 (TCP/UDP)。
• 預設拒絕 所有其他輸入/輸出連線 (白名單模式)。

常用埠對照表

完整部署腳本 (儲存為 ipsec_policy.cmd 以管理員執行)

@echo off
rem ===================== 建立原則 =====================
netsh ipsec static add policy name="10互聯預設IP策略" description="本機可上網，開放常用埠，特定 IP 全通，預設拒絕"

rem ===================== 允許 ICMP (Ping) =====================
netsh ipsec static add filter filterlist="所有ICMP通訊" srcaddr=me srcmask=255.255.255.255 dstaddr=any protocol=ICMP
netsh ipsec static add rule name="允許ICMP" policy="10互聯預設IP策略" filterlist="所有ICMP通訊" filteraction="許可"

rem ===================== 定義動作：許可/拒絕 =====================
netsh ipsec static add filteraction name=許可 action=permit
netsh ipsec static add filteraction name=拒絕 action=block

rem ===================== 特定管理 IP 全通 (UnLimitedIP) =====================
netsh ipsec static add filterlist name=UnLimitedIP description="特定管理IP無限制存取"
netsh ipsec static add filter filterlist=UnLimitedIP srcaddr=125.76.233.185 dstaddr=me
netsh ipsec static add rule name=允許管理IP全通 policy="10互聯預設IP策略" filterlist=UnLimitedIP filteraction=許可

rem ===================== 本機主動連出 HTTP/DNS (SomeIPSomePort) =====================
netsh ipsec static add filterlist name=SomeIPSomePort description="本機主動連出HTTP/DNS"
netsh ipsec static add filter filterlist=SomeIPSomePort srcaddr=me dstaddr=any dstport=80 protocol=TCP
netsh ipsec static add filter filterlist=SomeIPSomePort srcaddr=me dstaddr=any dstport=53 protocol=UDP
netsh ipsec static add filter filterlist=SomeIPSomePort srcaddr=me dstaddr=any dstport=53 protocol=TCP
netsh ipsec static add filter filterlist=SomeIPSomePort srcaddr=125.76.233.185 dstaddr=me dstport=3389 protocol=TCP
netsh ipsec static add rule name=允許主動連出 policy="10互聯預設IP策略" filterlist=SomeIPSomePort filteraction=許可

rem ===================== 開放常用服務輸入埠 (OpenSomePort) =====================
netsh ipsec static add filterlist name=OpenSomePort description="開放常用服務輸入埠"
netsh ipsec static add filter filterlist=OpenSomePort srcaddr=any dstaddr=me dstport=20 protocol=TCP
netsh ipsec static add filter filterlist=OpenSomePort srcaddr=any dstaddr=me dstport=21 protocol=TCP
netsh ipsec static add filter filterlist=OpenSomePort srcaddr=any dstaddr=me dstport=80 protocol=TCP
netsh ipsec static add filter filterlist=OpenSomePort srcaddr=any dstaddr=me dstport=1433 protocol=TCP
netsh ipsec static add filter filterlist=OpenSomePort srcaddr=any dstaddr=me dstport=3306 protocol=TCP
netsh ipsec static add filter filterlist=OpenSomePort srcaddr=any dstaddr=me dstport=3389 protocol=TCP
netsh ipsec static add rule name=允許常用服務輸入 policy="10互聯預設IP策略" filterlist=OpenSomePort filteraction=許可

rem ===================== 預設拒絕所有其他存取 (AllAccess) =====================
netsh ipsec static add filterlist name=AllAccess
netsh ipsec static add filter filterlist=AllAccess srcaddr=me dstaddr=any
netsh ipsec static add rule name=拒絕所有其他 policy="10互聯預設IP策略" filterlist=AllAccess filteraction=拒絕

rem ===================== 指派並啟用原則 =====================
netsh ipsec static set policy name="10互聯預設IP策略" assign=y

echo IPsec 原則已建立並啟用。請執行 "netsh ipsec static show policy" 驗證。
pause

驗證與管理指令

• 顯示所有原則：netsh ipsec static show policy
• 顯示指定原則規則：netsh ipsec static show rule name=all policy="10互聯預設IP策略"
• 停用原則：netsh ipsec static set policy name="10互聯預設IP策略" assign=n
• 刪除原則：netsh ipsec static delete policy name="10互聯預設IP策略"

注意事項

• 管理 IP 請替換為實際固定公網/內網 IP (腳本中 125.76.233.185 僅為範例)。
• 啟用原則後立即測試遠端桌面 (3389) 是否仍可連線，避免把自己鎖在外面。
• Windows Server 2003 IPsec 為無狀態過濾，FTP 主動模式 (20) 需額外允許輸出連線；建議改用被動模式並開放被動埠範圍。
• 生產環境建議先在測試機驗證腳本邏輯，再部署上線。