Win2003 Server configuration method of firewall via IPSec _win server

The windows2003 system has a weak firewall capability, and the key is that it cannot be configured with commands, which can cause a lot of work on a bulk deployment, so access control using IPSec
Under Windows2003, you can operate with the command netsh ipsec
Syntax for commands: http://technet.microsoft.com/zh-cn/library/cc739550 (v=ws.10). aspx

1. Delete all security policies
netsh ipsec static del all

2. Establish strategy test
netsh ipsec static add policy name=test

3, the establishment of a filter operation, can be understood as action, matching rules after the operation, similar to the Linux iptables in the Accept and drop
Establish a reject action
netsh ipsec static add filteraction name=block Action=block
Establish accept Action
netsh ipsec static add filteraction name=permit Action=permit

4. Add filter list for reject action, similar to iptables default rule
netsh ipsec static add filterlist Name=deny_all
Add a filter to deny all connections
netsh ipsec static add filter Filterlist=deny_all Srcaddr=any dstaddr=me

5. Add filter and filter actions created to deny all requests to policy test
netsh ipsec static add rule name=deny_all policy=test filterlist=deny_all Filteraction=block

6, establish the server itself external access strategy

Set up a filter list server_access
netsh ipsec static add filterlist name=server_access

Add a filter to the filter list server_access that allows any port on the local to any address, and the protocol port is added as needed
netsh ipsec static add filter filterlist=server_access srcaddr=me dstaddr=any protocol=tcp dstport=80

Apply filter server_access in policy test and perform allowed actions on packets that match the filter
netsh ipsec static add rule name=server_access policy=test filterlist=server_access Filteraction=permit

7. Establish Web server access policy

Set up filter List Web
netsh ipsec static add filterlist Name=web

Add a filter on the filter list Web to allow access to local port 80 for any external address
netsh ipsec static add filter filterlist=web Srcaddr=any dstaddr=me dstport=80

Apply filter list Web in policy test
netsh ipsec static add rule name=web policy=test filterlist=web Filteraction=permit

8. Establish FTP server access policy

netsh ipsec static add filterlist name=ftp
netsh ipsec static add filter filterlist=ftp Srcaddr=any dstaddr=me dstport=21

Add a passive port to the FTP server, where three are added as tests
netsh ipsec static add filter filterlist=ftp Srcaddr=any dstaddr=me dstport=65530
netsh ipsec static add filter filterlist=ftp Srcaddr=any dstaddr=me dstport=65531
netsh ipsec static add filter filterlist=ftp Srcaddr=any dstaddr=me dstport=65532
netsh ipsec static add rule name=ftp policy=test filterlist=ftp Fileraction=permit