IP安全策略列表：由多个IP安全策略组成
IP安全策略：由一个或多个规则的组成
规则：由一个IP筛选器列表和一个相应的筛选器操作的组成
IP筛选器列表：由一个或多个IP筛选器组成
筛选器操作：permit或block
操作流程：创建IP安全策略-->创建筛选器操作-->创建IP筛选器列表-->创建策略规则-->激活IP安全策略
2、完整实例
REM 清空策略
netsh ipsec static del all
REM 创建IP安全策略
netsh ipsec static add policy name=MyIPSec
REM 创建筛选器操作（block和permit）
netsh ipsec static add filteraction name=Permit action=permit
netsh ipsec static add filteraction name=Block action=block
REM 首先禁止所有访问（创建IP筛选器列表、创建策略规则）
netsh ipsec static add filterlist name=AllAccess
netsh ipsec static add filter filterlist=AllAccess srcaddr=Me dstaddr=Any mirrored=yes
netsh ipsec static add rule name=BlockAllAccess policy=MyIPSec filterlist=AllAccess filteraction=Block
REM 开放某些IP无限制访问（创建IP筛选器列表、创建策略规则）
netsh ipsec static add filterlist name=UnLimitedIP
netsh ipsec static add filter filterlist=UnLimitedIP srcaddr=192.168.120.83 dstaddr=Me mirrored=yes
netsh ipsec static add rule name=AllowUnLimitedIP policy=MyIPSec filterlist=UnLimitedIP filteraction=Permit
REM 开放某些端口（创建IP筛选器列表、创建策略规则）
netsh ipsec static add filterlist name=OpenSomePort
netsh ipsec static add filter filterlist=OpenSomePort srcaddr=Any dstaddr=Me dstport=3389 protocol=TCP mirrored=yes
netsh ipsec static add rule name=AllowOpenSomePort policy=MyIPSec filterlist=OpenSomePort filteraction=Permit
REM 开放某些ip可以访问某些端口（创建IP筛选器列表、创建策略规则）
netsh ipsec static add filterlist name=SomeIPSomePort
netsh ipsec static add filter filterlist=SomeIPSomePort srcaddr=Me dstaddr=Any protocol=ICMP mirrored=yes
netsh ipsec static add filter filterlist=SomeIPSomePort srcaddr=Me dstaddr=Any dstport=80 protocol=TCP mirrored=yes
netsh ipsec static add filter filterlist=SomeIPSomePort srcaddr=Me dstaddr=Any dstport=443 protocol=TCP mirrored=yes
netsh ipsec static add filter filterlist=SomeIPSomePort srcaddr=Me dstaddr=Any dstport=53 protocol=TCP mirrored=yes
netsh ipsec static add filter filterlist=SomeIPSomePort srcaddr=Me dstaddr=Any dstport=53 protocol=UDP mirrored=yes
netsh ipsec static add rule name=AllowSomeIPSomePort policy=MyIPSec filterlist=SomeIPSomePort filteraction=Permit
REM 激活IP安全策略
netsh ipsec static set policy name=MyIPSec assign=y
REM =================结束================
3、操作补充
删除规则
netsh ipsec static del rule name=BlockAllAccess policy=MyIPSec
删除筛选器列表
netsh ipsec static add filterlist name=AllAccess
导出策略
netsh ipsec static exportpolicy file=d:\MyIPSec.ipsec
导入策略
netsh ipsec static importpolicy file=d:\MyIPSec.ipsc
1、网络安全工具 Netsh IPsec
原文地址：http://blog.51cto.com/kaiyuandiantang/2089549