Board logo

标题: 【66元】求助一个批量加IP安全策略的批处理程序 <脚本已分享>【已解决】 [打印本页]
作者: usebat    时间: 2019-7-12 14:45     标题: 【66元】求助一个批量加IP安全策略的批处理程序 <脚本已分享>【已解决】

本帖最后由 usebat 于 2019-7-17 12:22 编辑

具体报酬：66元RMB
支付方式：可支付宝，可银行转账
联系方式：2*9*8*4*9*3*1*6*2*3（去掉*号就是正确号码）
有效期限：2019年7月15日之前。
需求描述：
（1）系统环境：Windows Server 2012
（2）根据已知的IP，或者IP段来批量使用cmd命令来添加IP安全策略，最好可以自动从网上下载国内IP地址段来定期更新IP库
（3）测试数据及期待结果：希望做到国外IP地址无法访问服务器网站，只供国内访问（国内IP白名单，其余全封禁）
（4）这边可提供部分资源：IP地址获取地址，以及IP提取的部分批处理。

IP地址获取地址：http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest  （通过关键字：CN，HK，MO来筛选出中国大陆，香港，澳门的相关IP）

以下为部分代码，可根据下载下来的TXT IP库来筛选出我们需要的白名单IP，具体格式可自组。IP范围部分可能有些不准确，该程序处理出来的数据有重合或者误杀白名单IP。
  1. @echo off

  2. findstr /i "|CN|ipv4| |HK|ipv4| |MO|ipv4|" "C:\Users\Administrator\Desktop\cnip\delegated-apnic-latest.txt" > "C:\Users\Administrator\Desktop\cnip\rs\CNIP.txt"

  3. set "dataDir=C:\Users\Administrator\Desktop\cnip\rs\CNIP.txt"

  4. set "ip=C:\Users\Administrator\Desktop\cnip\rs\ip.txt"

  5. 

  6. ::for /f "delims=| tokens=4" %%i in (%dataDir%) do echo %%i >> "C:\Users\Administrator\Desktop\cnip\rs\ips.txt"

  7. 

  8. for /f "delims=| tokens=4" %%i in (%dataDir%) do (

  9. 	echo %%i > "C:\Users\Administrator\Desktop\cnip\rs\ip.txt"

  10. 	echo %%i

  11. 	set tmpip=%%i

  12. 	for  /f "delims=. tokens=1,2,3" %%s in (%ip%) do (

  13. 		echo %%s %%t %%u

  14. 		if NOT %%t == 0 (

  15. 			if %%u == 0 (

  16. 				echo IP Range is %%i -- %%s.%%t.255.255 >> "C:\Users\Administrator\Desktop\cnip\rs\logs.txt"

  17. 			)else (

  18. 				echo IP Range is %%i -- %%s.%%t.%%u.255 >> "C:\Users\Administrator\Desktop\cnip\rs\logs.txt"

  19. 			)

  20. 		)else (

  21. 			echo IP Range is %%i -- %%s.255.255.255 >> "C:\Users\Administrator\Desktop\cnip\rs\logs.txt"

  22. 		)

  23. 	)

  24. )

  25. 

  26. pause
复制代码
最后根据筛选出来的IP，我们可以通过cmd命令：netsh ipsec  来批量添加IP安全策略，由于搞不清楚如何加入IP段这块点，所以自己就放弃了，求教各位大佬。

至于netsh ipsec 命令相关详解，可参考：
https://www.cnblogs.com/cnxkey/articles/10374937.html
https://www.jb51.net/article/110692.htm

谢谢大家啦！！！


++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2019年7月17日 结贴

首先非常感谢：flashercs   非常的有耐心，并且中途也有给到我很多建议。尝试了无数次，他也耐心的改了无数次。

虽然最后测试出来的性能不佳，但是不关 flashercs  的问题。事实就是如此。最后本着共享精神，我把这次的代码

公布出来，分享给其他需要的人学习一下。flashercs  应该也会同意大家学习他的代码的。

这边直接公布脚本附件吧。代码比较长，占版面。 尝试上传附件，貌似有问题，只能直接发源代码了。
  1. 0<1/*,:

  2. @echo off

  3. REM 脚本用于创建IPSec安全策略，阻止国外IP访问本地机器,必须以管理员身份运行

  4. REM 设置本地IP

  5. set localip="121.201.74.164"

  6. REM 创建netsh Script

  7. echo 正在更新IP列表...

  8. netsh ipsec static set policy name="policy1" assign=no

  9. cscript -nologo -e:jscript %0 %localip%

  10. echo 更新IP列表完成

  11. REM 执行netsh Script

  12. echo 正在设置IPSec策略

  13. netsh -f "%~dp0netshScript.txt"

  14. echo 设置IPSec策略完成

  15. pause

  16. exit /b

  17. */

  18. ;

  19. var xhr = (function () {

  20.   var aXMLHttpVers = ['MSXML2.XMLHTTP.6.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP', 'Microsoft.XMLHTTP'];

  21.   for (var i = 0; i < aXMLHttpVers.length; i++) {

  22.     try {

  23.       return WScript.CreateObject(aXMLHttpVers[i]);

  24.     } catch (error) {}

  25.   }

  26.   return null;

  27. })();

  28. if (xhr === null) WScript.Quit(1);

  29. // var wshell = new ActiveXObject('WScript.Shell');

  30. var fso = new ActiveXObject('Scripting.FileSystemObject');

  31. var currDir = fso.GetParentFolderName(WScript.ScriptFullName);

  32. var ipfile = currDir + '\\ip.txt';

  33. var netshScript = currDir + '\\netshScript.txt'

  34. var re = /\|(?:CN|HK|MO)\|ipv4\|((?:\d+\.){3}\d+)\|(\d+)/g;

  35. // var tsWrite1 = fso.openTextFile(ipfile, 2, true, -2);

  36. var tsWrite2 = fso.openTextFile(netshScript, 2, true, -2);

  37. // initialize netshScript.txt

  38. tsWrite2.WriteLine('ipsec static');

  39. tsWrite2.WriteLine('set batch enable');

  40. // delete old policy policy1

  41. tsWrite2.WriteLine('delete rule name="_AllowRule" policy="policy1"');

  42. tsWrite2.WriteLine('delete rule name="_BlockRule" policy="policy1"');

  43. tsWrite2.WriteLine('delete filterlist name="WhiteList"');

  44. tsWrite2.WriteLine('delete filterlist name="OtherAddr"');

  45. tsWrite2.WriteLine('delete filteraction name="_Allow"');

  46. tsWrite2.WriteLine('delete filteraction name="_Disallow"');

  47. tsWrite2.WriteLine('delete policy name="policy1"');

  48. // add filterlist

  49. tsWrite2.WriteLine('add filterlist name="WhiteList" description="Allowed IP addresses"');

  50. tsWrite2.WriteLine('add filterlist name="OtherAddr" description="Other disallowed IP addresses"');

  51. // 更新IP列表, netsh脚本 netshScript.txt

  52. // add filters to filterlist WhiteList

  53. tsWrite2.WriteLine('add filter filterlist="WhiteList" description="User defined local IP address" srcaddr=' + WScript.Arguments(0) + ' dstaddr=me protocol=any mirrored=no');

  54. tsWrite2.WriteLine('add filter filterlist="WhiteList" description="Gateway" srcaddr=GATEWAY dstaddr=me protocol=any mirrored=no');

  55. tsWrite2.WriteLine('add filter filterlist="WhiteList" description="DNS" srcaddr=DNS dstaddr=me protocol=any mirrored=no');

  56. tsWrite2.WriteLine('add filter filterlist="WhiteList" description="DHCP" srcaddr=DHCP dstaddr=me protocol=any mirrored=no');

  57. tsWrite2.WriteLine('add filter filterlist="WhiteList" description="WINS" srcaddr=WINS dstaddr=me protocol=any mirrored=no');

  58. tsWrite2.WriteLine('add filter filterlist="WhiteList" description="LAN" srcaddr=10.0.0.0 srcmask=8 dstaddr=me protocol=any mirrored=no');

  59. tsWrite2.WriteLine('add filter filterlist="WhiteList" description="LAN" srcaddr=172.16.0.0 srcmask=12 dstaddr=me protocol=any mirrored=no');

  60. tsWrite2.WriteLine('add filter filterlist="WhiteList" description="LAN" srcaddr=192.168.0.0 srcmask=16 dstaddr=me protocol=any mirrored=no');

  61. var arrURL = [

  62.   // 'http://ipblock.chacuo.net/down/t_txt=c_CN',

  63.   // 'http://ipblock.chacuo.net/down/t_txt=c_HK',

  64.   // 'http://ipblock.chacuo.net/down/t_txt=c_MO'

  65.   'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest'

  66. ];

  67. var arrReferer = [

  68.   'http://ipblock.chacuo.net/view/c_CN',

  69.   'http://ipblock.chacuo.net/view/c_HK',

  70.   'http://ipblock.chacuo.net/view/c_MO'

  71. ];

  72. var arrIP, str, exitCode = 0;

  73. for (var i = 0; i < arrURL.length; i++) {

  74.   xhr.open('GET', arrURL[i], false); //CN,HK,MO

  75.   // xhr.setRequestHeader('Referer', arrReferer[i]);

  76.   xhr.send();

  77.   if (xhr.status === 200) {

  78.     str = xhr.responseText;

  79.     // WScript.Echo(str);

  80.     while (arrIP = re.exec(str)) {

  81.       var ip = arrIP[1];

  82.       var prefix = 32 - Math.log(+arrIP[2]) / Math.log(2);

  83.       tsWrite2.WriteLine('add filter filterlist="WhiteList" description="CNIP" srcaddr=' + ip + ' srcmask=' + prefix + ' dstaddr=me protocol=any mirrored=no');

  84.     }

  85.   } else {

  86.     exitCode++;

  87.     WScript.Echo('Download "' + arrURL[i] + '" failed.Status:' + xhr.status);

  88.   }

  89. }

  90. // add filters to filterlist OtherAddr

  91. tsWrite2.WriteLine('add filter filterlist="OtherAddr" description="ALL" srcaddr=any dstaddr=me protocol=any mirrored=no');

  92. // add filteraction permit

  93. tsWrite2.WriteLine('add filteraction name="_Allow" description="Allow connect" action=permit');

  94. // add filteraction block

  95. tsWrite2.WriteLine('add filteraction name="_Disallow" description="Disallow connect" action=block');

  96. // add policy

  97. tsWrite2.WriteLine('add policy name="policy1" description="policy1"');

  98. // add rule

  99. tsWrite2.WriteLine('add rule name="_AllowRule" description="Allow WhiteList to connect to local machine" policy="policy1" filterlist="WhiteList" filteraction="_Allow" activate=yes');

  100. tsWrite2.WriteLine('add rule name="_BlockRule" description="Block others to connect to local machine" policy="policy1" filterlist="OtherAddr" filteraction="_Disallow" activate=yes');

  101. // tsWrite2.WriteLine('delete filterlist name="WhiteList"'); //先删除原来的IP列表; filterlist被占用时无法被删除的

  102. // tsWrite2.WriteLine('add filterlist name="WhiteList" description="允许访问本地服务器的IP列表"'); //再创建新的IP列表

  103. // activate policy1

  104. tsWrite2.WriteLine('set policy name="policy1" assign=yes');

  105. // tsWrite1.close();

  106. tsWrite2.close();

  107. WScript.Quit(exitCode);
复制代码
作者: flashercs    时间: 2019-7-12 22:52

  1. 0<1/*,:

  2. @echo off

  3. REM 脚本用于创建IPSec安全策略，阻止国外IP访问本地机器,必须以管理员身份运行

  4. REM 创建netsh Script

  5. cscript -nologo -e:jscript %0

  6. REM 执行netsh Script

  7. netsh -f "%~dp0netshScript.txt"

  8. pause

  9. exit /b

  10. */

  11. ;

  12. var xhr = (function () {

  13.   var aXMLHttpVers = ['MSXML2.XMLHTTP.6.0', 'MSXML2.XMLHTTP.3.0', 'MSXML2.XMLHTTP', 'Microsoft.XMLHTTP'];

  14.   for (var i = 0; i < aXMLHttpVers.length; i++) {

  15.     try {

  16.       return WScript.CreateObject(aXMLHttpVers[i]);

  17.     } catch (error) {}

  18.   }

  19.   return null;

  20. })();

  21. if (xhr === null) WScript.Quit(1);

  22. var wshell = new ActiveXObject('WScript.Shell');

  23. var fso = new ActiveXObject('Scripting.FileSystemObject');

  24. var currDir = fso.GetParentFolderName(WScript.ScriptFullName);

  25. var ipfile = currDir + '\\ip.txt';

  26. var netshScript = currDir + '\\netshScript.txt'

  27. xhr.onReadystateChange = function () {

  28.   if (xhr.readyState == 4) {

  29.     var re = /\|(?:CN|HK|MO)\|ipv4\|((?:\d+\.){3}\d+)\|(\d+)/g;

  30.     var str = xhr.responseText;

  31.     var arrIP;

  32.     var tsWrite1 = fso.openTextFile(ipfile, 2, true, -2);

  33.     var tsWrite2 = fso.openTextFile(netshScript, 2, true, -2);

  34.     // initialize netshScript.txt

  35.     tsWrite2.WriteLine('ipsec static');

  36.     tsWrite2.WriteLine('set batch enable');

  37.     // delete old policy policy1

  38.     tsWrite2.WriteLine('delete policy name="policy1"');

  39.     // add filterlist

  40.     tsWrite2.WriteLine('add filterlist name="白名单" description="允许访问本地服务器的IP列表"');

  41.     tsWrite2.WriteLine('add filterlist name="所有地址" description="所有IP列表"');

  42.     // 更新IP列表, netsh脚本 netshScript.txt

  43.     // add filters to filterlist 白名单

  44.     while (arrIP = re.exec(str)) {

  45.       var ip = arrIP[1];

  46.       var prefix = 32 - Math.log(+arrIP[2]) / Math.log(2);

  47.       tsWrite1.WriteLine(ip + '/' + prefix);

  48.       tsWrite2.WriteLine('add filter filterlist="白名单" description="CNIP" srcaddr=' + ip + ' srcmask=' + prefix + ' dstaddr=me protocol=any mirrored=yes');

  49.     }

  50.     // add filters to filterlist 所有地址

  51.     tsWrite2.WriteLine('add filter filterlist="所有地址" description="ALL" srcaddr=any dstaddr=me protocol=any mirrored=yes');

  52.     // add filteraction permit

  53.     tsWrite2.WriteLine('add filteraction name="允许" description="允许访问" action=permit');

  54.     // add filteraction block

  55.     tsWrite2.WriteLine('add filteraction name="阻止" description="禁止访问" action=block');

  56.     // add policy

  57.     tsWrite2.WriteLine('add policy name="policy1" description="policy1"');

  58.     // add rule

  59.     tsWrite2.WriteLine('add rule name="允许规则" description="允许白名单访问规则" policy="policy1" filterlist="白名单" filteraction="允许" activate=yes');

  60.     tsWrite2.WriteLine('add rule name="阻止规则" description="禁止所有IP访问规则" policy="policy1" filterlist="所有地址" filteraction="阻止" activate=yes');

  61.     // tsWrite2.WriteLine('delete filterlist name="白名单"'); //先删除原来的IP列表; filterlist被占用时无法被删除的

  62.     // tsWrite2.WriteLine('add filterlist name="白名单" description="允许访问本地服务器的IP列表"'); //再创建新的IP列表

  63.     // activate policy1

  64.     tsWrite2.WriteLine('set policy name="policy1" assign=yes');

  65.     tsWrite1.close();

  66.     tsWrite2.close();

  67.     WScript.Quit();

  68.   }

  69. };

  70. 

  71. var url = 'http://ftp.apnic.net/apnic/stats/apnic/delegated-apnic-latest'; //更新IP地址库的来源网址

  72. xhr.open('GET', url, true);

  73. xhr.send();

  74. 

  75. while (true) {

  76.   WScript.Sleep(100);

  77. }
复制代码
作者: usebat    时间: 2019-7-13 11:01

回复 2# flashercs

好的，非常感谢您的支持，我这边测试一下，没问题的话，马上联系您转账。



欢迎光临 批处理之家 (http://bathome.net./) Powered by Discuz! 7.2