Using Windows IP Security policy skillfully

The security of Windows Server can be protected by setting IP Security Policy, which is one of the necessary skills for every Windows system OPS person.

IP Security Policy, in short, can be done by the corresponding strategy to achieve release, block the relevant ports, release, block the associated IP, to achieve a certain degree of system security.

Requirements: The hardware firewall in the room is not yet in place, the business department wants to limit the limited IP access to port 3389 through the system security policy.

Implementation steps:

1. Open the Local Security policy:

Start-run-enter secpol.msc or start-programs-Administrative tools-Local Security policy

In the pop-up window, right-click IP Security Policy to create IP Security policy on the local computer:

650) this.width=650; "Src=" Https://s5.51cto.com/wyfs02/M01/08/24/wKiom1nc3JuBCat2AAFWcmK3ndA761.png-wh_ 500x0-wm_3-wmp_4-s_3625177004.png "title=" 11.png "alt=" wkiom1nc3jubcat2aafwcmk3nda761.png-wh_50 "/>

2. Create a new IP Security policy, do not tick "Activate default response rule" and "edit Attribute"

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M01/08/24/wKiom1nc3pexA-1qAAGaY4lsxvk373.png-wh_500x0-wm_ 3-wmp_4-s_4069612373.png "title=" 22.png "alt=" Wkiom1nc3pexa-1qaagay4lsxvk373.png-wh_50 "/>

650) this.width=650; "Src=" https://s4.51cto.com/wyfs02/M00/A6/D6/wKioL1ncb7Ozh_EwAAKKbL922U4526.png-wh_500x0-wm_ 3-wmp_4-s_3324612261.png "title=" 33.png "alt=" Wkiol1ncb7ozh_ewaakkbl922u4526.png-wh_50 "/>

4, first build a block all rules, block all that is to block all ports and IP address access

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M01/A6/D6/wKioL1nccJbygQqbAAH8Csonk9c813.png-wh_500x0-wm_ 3-wmp_4-s_1207089150.png "title=" 44.png "alt=" Wkiol1nccjbygqqbaah8csonk9c813.png-wh_50 "/>

Block any IP address

650) this.width=650; "Src=" https://s5.51cto.com/wyfs02/M02/08/24/wKiom1nc37aT_t-CAAFh1dwSn6I092.png-wh_500x0-wm_ 3-wmp_4-s_3812092547.png "title=" 55.png "alt=" Wkiom1nc37at_t-caafh1dwsn6i092.png-wh_50 "/>

Block any protocol type

650) this.width=650; "Src=" https://s3.51cto.com/wyfs02/M02/08/24/wKiom1nc3-zgC11SAAFWHe2Bu_U947.png-wh_500x0-wm_ 3-wmp_4-s_963692621.png "title=" 66.png "alt=" Wkiom1nc3-zgc11saafwhe2bu_u947.png-wh_50 "/>

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/A6/D6/wKioL1nccMfz1_2-AAHOTAuzeYc320.png-wh_500x0-wm_ 3-wmp_4-s_1987204289.png "title=" 77.png "alt=" Wkiol1nccmfz1_2-aahotauzeyc320.png-wh_50 "/>

3, the following we want to release each, in fact, the process and the above is the same; setting the IP filter list can be changed to allow related ports and protocols, the default remote port is 3389

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/A6/D7/wKioL1ncc07hNmJxAAUoP0Fa2Gw809.png-wh_500x0-wm_ 3-wmp_4-s_3546312607.png "title=" 00.png "alt=" Wkiol1ncc07hnmjxaauop0fa2gw809.png-wh_50 "/>

4, finally let the policy to take effect: Right-click IP Security Policy, allocation can be

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M02/08/25/wKiom1nc4rOAt4QlAAGXhNShxQc034.png-wh_500x0-wm_ 3-wmp_4-s_1044983600.png "title=" 222.png "alt=" Wkiom1nc4roat4qlaagxhnshxqc034.png-wh_50 "/>

5, if you want to allow more IP and port, one input is more tired, you can directly export the policy backup, and then the other machine directly imported.

How to import IP Security policy:

Start > Run > Gpedit.msc

Computer Configuration > Windows Settings > Security Settings > IP Security Policy > right-click > All Tasks > Import Policy

650) this.width=650; "Src=" https://s2.51cto.com/wyfs02/M01/A6/D7/wKioL1ncdB6D-KBtAAI57uARJ5Y387.png-wh_500x0-wm_ 3-wmp_4-s_4282112278.png "title=" 221.png "alt=" Wkiol1ncdb6d-kbtaai57uarj5y387.png-wh_50 "/>

The import also requires an assignment to be enabled.

Well, basically it's OK.

Add:

In addition to the above 3389 port release, the actual production environment to release 80, 443 and other ports, otherwise people can not access your site, If your site is called to visit someone else's website, then you have to release the server's external 80 port number (because all the ports inside and outside are blocked).

The port of the database is generally recommended do not release, you can operate directly in the server, if you want to connect the database locally, you can and remote connection settings, the release of the relevant IP on the line. There are other ports that can be released according to their needs.

Additionally, there may be an error opening security policy that says "the following errors occurred while saving IP security data: The specified service does not exist with the installed service." (80070424) "This is because the service" IPSEC services "is not turned on.

This article is from the "Hollows Jie Sun" blog, be sure to keep this source http://xjsunjie.blog.51cto.com/999372/1971186

Using Windows IP Security policy skillfully