:Created by http://www.1sucai.cn :DROP UDP Flood @echo off cls :获取DNS地址 for /f "delims=: tokens=1,2" %%a in ('ipconfig /all ^|findstr /i "DNS Server"') do ( set DNSIP=%%b ) :新建IP安装策略禁止UDP netsh ipsec static add policy name=禁止UDP description=允许DNS，拒绝其它UDP外出 :新建IP安全规则 netsh ipsec static add filterlist name=允许UDP netsh ipsec static add filterlist name=拒绝UDP :新建IP筛选器 netsh ipsec static add filter filterlist=允许UDP srcaddr=me dstaddr=%DNSIP% description=允许DNS查询 protocol=udp mirrored=yes dstport=53 netsh ipsec static add filter filterlist=拒绝UDP srcaddr=me dstaddr=any description=禁止UDP外出 protocol=udp mirrored=yes :新建IP筛选器操作 netsh ipsec static add filteraction name=允许DNS查询 action=permit netsh ipsec static add filteraction name=拒绝UDP外出 action=block :封装策略 netsh ipsec static add rule name=允许规则 policy=禁止UDP  filterlist=允许UDP filteraction=允许DNS查询 netsh ipsec static add rule name=拒绝规则 policy=禁止UDP  filterlist=拒绝UDP filteraction=拒绝UDP外出 :应用IP安全策略 netsh ipsec static set policy name=禁止UDP assign=y