Windows 相当于 iptables？

Question

愚蠢的问题：

Windows 上是否有相当于 iptables 的工具？我可以通过 cygwin 安装一个吗？

真正的问题：我如何在 Windows 上完成我可以通过 iptables 完成的任务？只是寻找基本的防火墙功能（例如阻止某些 IP 地址）

Answer 1

一种方法是使用netsh命令：

• netsh firewall （在 XP 和 2003 之后弃用）
• netsh advfirewall （Vista，7 和 2008）

Answer 2

以下来自：https : //support.microsoft.com/en-us/kb/947709

示例 1：启用程序

旧命令 新命令

netsh firewall add allowedprogram C:\MyApp\MyApp.exe "My Application" ENABLE    
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes
netsh firewall add allowedprogram program=C:\MyApp\MyApp.exe name="My Application" mode=ENABLE scope=CUSTOM addresses=157.60.0.1,172.16.0.0/16,LocalSubnet profile=Domain   netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh firewall add allowedprogram program=C:\MyApp\MyApp.exe name="My Application" mode=ENABLE scope=CUSTOM addresses=157.60.0.1,172.16.0.0/16,LocalSubnet profile=ALL  

运行以下命令：

netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain

netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=private

有关如何添加防火墙规则的更多信息，请运行以下命令：

netsh advfirewall firewall add rule ?

示例 2：启用端口

旧命令 新命令

netsh firewall add portopening TCP 80 "Open Port 80"    
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

有关如何添加防火墙规则的更多信息，请运行以下命令：

netsh advfirewall firewall add rule ?

示例 3：删除启用的程序或端口

旧命令 新命令

netsh firewall delete allowedprogram C:\MyApp\MyApp.exe netsh advfirewall firewall delete rule name=rule name program="C:\MyApp\MyApp.exe"
delete portopening protocol=UDP port=500    netsh advfirewall firewall delete rule name=rule name protocol=udp localport=500

有关如何删除防火墙规则的更多信息，请运行以下命令：

netsh advfirewall firewall delete rule ?

示例 4：配置 ICMP 设置

旧命令 新命令

netsh firewall set icmpsetting 8    netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow
netsh firewall set icmpsetting type=ALL mode=enable netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow
netsh firewall set icmpsetting 13 disable all   netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block

有关如何配置 ICMP 设置的更多信息，请运行以下命令：

netsh advfirewall firewall add rule ?

示例 5：设置日志记录

旧命令 新命令 netsh firewall set logging %systemroot%\system32\LogFiles\Firewall\pfirewall.log 4096 ENABLE ENABLE 运行以下命令：

netsh advfirewall set currentprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log

netsh advfirewall set currentprofile logging maxfilesize 4096
netsh advfirewall set currentprofile logging droppedconnections enable

netsh advfirewall set currentprofile logging allowedconnections enable

有关更多信息，请运行以下命令：

netsh advfirewall set currentprofile ?

如果你想设置日志记录特定的个人资料，下列选项而不是“currentprofile”选项使用一个：
Domainprofile
Privateprofile
Publicprofile

示例 6：启用 Windows 防火墙

旧命令 新命令

netsh firewall set opmode ENABLE    netsh advfirewall set currentprofile state on
netsh firewall set opmode mode=ENABLE exceptions=enable 

运行以下命令：

Netsh advfirewall set currentprofile state on 

netsh advfirewall set currentprofile firewallpolicy blockinboundalways,allowoutbound
netsh firewall set opmode mode=enable exceptions=disable profile=domain 

运行以下命令：

Netsh advfirewall set domainprofile state on 

netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
netsh firewall set opmode mode=enable profile=ALL   Run the following commands:

netsh advfirewall set domainprofile state on 

netsh advfirewall set privateprofile state on

有关更多信息，请运行以下命令：

netsh advfirewall set currentprofile ?

如果要设置防火墙状态特定配置文件，下列选项而不是“currentprofile”选项使用一个：Domainprofile
Privateprofile
Publicprofile

示例 7：恢复策略默认值

旧命令 新命令

netsh firewall reset
netsh advfirewall reset

有关详细信息，请运行以下命令：netsh advfirewall reset ? 示例 8：启用特定服务

旧命令 新命令 netsh firewall set service FileAndPrint netsh advfirewall firewall set rule group="文件和打印机共享" new enable=Yes netsh firewall set service RemoteDesktop enable netsh advfirewall firewall set rule group="remote desktop" new enable=Yes netsh firewall set service RemoteDesktop enable profile=ALL 运行以下命令：

netsh advfirewall 防火墙设置规则组=“远程桌面”新启用=是配置文件=域

netsh advfirewall 防火墙设置规则组=“远程桌面”新启用=是配置文件=私有

Answer 3

WIPFW看起来非常有前途，特别是如果您遵循 iptables 规则创建风格的话。