::開啟防火牆服務
net start mpssvc
::配置遠程桌面僅允許管理機遠程
netsh advfirewall firewall add rule name=allow_rdp dir=in action=allow description="允許遠程桌面策略" enable=yes profile=public,private,domain remoteip=192.168.11.42,192.168.11.44,192.168.10.250,192.168.168.249,192.168.168.252 localport=3389 protocol=tcp
netsh advfirewall firewall set rule name="遠程桌面(TCP-In)" new enable=no
netsh advfirewall firewall set rule name="遠程桌面 - 用戶模式(TCP-In)" new enable=no
netsh advfirewall firewall set rule name="遠程桌面 - 用戶模式(UDP-In)" new enable=no
netsh advfirewall firewall set rule name="遠程桌面 - RemoteFX (TCP-In)" new enable=no
::關閉135-139端口
netsh advfirewall firewall add rule name=deny_tcp_port dir=in action=block description="關閉風險端口" enable=yes profile=public,private,domain localport=135-139 protocol=tcp
netsh advfirewall firewall add rule name=deny_udp_port dir=in action=block description="關閉風險端口" enable=yes profile=public,private,domain localport=135-139 protocol=udp
::開放應用端口
netsh advfirewall firewall add rule name=allow_app_port dir=in action=allow description="開放應用端口" enable=yes profile=public,private,domain localport=1433,4899,8080-8088 protocol=tcp
::開放snmp端口
netsh advfirewall firewall add rule name=allow_snmp_port dir=in action=allow description="開放snmp端口" enable=yes profile=public,private,domain localport=161 protocol=udp
::關閉默認開啟445的策略
netsh advfirewall firewall set rule name="Netlogon 服務(NP-In)" new enable=no
netsh advfirewall firewall set rule name="Telnet 遠程管理(NP-In)" new enable=no
netsh advfirewall firewall set rule name="文件和打印機共享(SMB-In)" new enable=no
netsh advfirewall firewall set rule name="遠程服務管理(NP-In)" new enable=no
netsh advfirewall firewall set rule name="遠程事件日志管理(NP-In)" new enable=no
netsh advfirewall firewall set rule name="DFS 管理(SMB-In)" new enable=no
::對堡壘機開啟445端口
netsh advfirewall firewall add rule name=allow_445_port dir=in action=allow description="對堡壘機開放445端口" enable=yes profile=public,private,domain remoteip=192.168.11.42 localport=445 protocol=tcp
::開啟ping
netsh advfirewall firewall set rule name="文件和打印機共享(回顯請求 - ICMPv4-In)" new enable=yes
::開放愛數備份櫃程序
netsh advfirewall firewall add rule name=allow_EBackup_program dir=in action=allow description="開放愛數備份櫃程序" enable=yes service=EBackupClient profile=public,private,domain remoteip=192.168.11.32 protocol=tcp
::啟用防火牆
netsh advfirewall set allprofile state on