Use VBScript to add IP policy automatic seal ip_vbs

The program mainly reads the IIS log of this website, analyzes the IP address, and automatically closes with security policy. The VBS code is as follows:

Copy Code code as follows:

' Code starts

Set fileobj=createobject ("Scripting.FileSystemObject")
Logfilepath= "E:w3logw3svc237ex070512old.log" note specifies the log path for the attacked Web site.
' If it is a virtual host, to find out which site is under attack, you can view: C:windowssystem32logfileshttperr,

It is easy to analyze from the error log.
Writelog "netsh ipsec static add policy Name=xblue"
Writelog "netsh ipsec static add filterlist Name=denyip"

Overip= ""
F_name=logfilepath
' Specify log file

' Program function: Extract IP from logfiles into the filtering format required by IPSec, and import filtering into IPSec. Suitable for a site subject to a large number of CC attacks.

Set Fileobj88=createobject ("Scripting.FileSystemObject")
Set myfile=fileobj88. OpenTextFile (F_name,1,false)
Contentover=myfile. ReadAll ()
Contentip=lcase (Contentover)
Myfile.close
Set fileobj88=nothing
On Error Resume Next
Myline=split (CONTENTIP,CHR (13))
For i=0 to UBound (myline)-1

Myline2=split (Myline (i), "")
Newip=myline2 (6)
' Specifies the detached identity string!
If InStr (OVERIP,NEWIP) =0 Then ' removes duplicate IP.
Overip=overip&newip
Dsafasf=split (Newip, ".")
If UBound (dsafasf) =3 Then
Writelog "netsh ipsec static add filter Filterlist=denyip srcaddr=" &newip& "Dstaddr=me

Dstport=80 protocol=tcp "
End If
Else
WScript.Echo Newip & "is exits!"
End If
Next
Writelog "netsh ipsec static add filteraction name=denyact Action=block"
Writelog "netsh ipsec static add rule name=kill3389 Policy=xblue Filterlist=denyip

Filteraction=denyact "
Writelog "netsh ipsec static set policy Name=xblue assign=y"


Sub writelog (errmes) ' Export IPSec policy file is a bat file.
Ipfilename= "Denyerrorip.bat"
Set Logfile=fileobj.opentextfile (ipfilename,8,true)
Logfile.writeline Errmes
Logfile.close
Set logfile=nothing
End Sub

' End of code

Save the above code as a. vbs file and set the path of the log. Double-click to run, and then generate a Denyerrorip.bat file after running, this is the policy file that IPSec needs, directly double-click to run.