防火墙规则C＃的正确设置

Question

I got a new question, what firewall settings is needed for blocking an IP address ? I found the property "RemoteAddress", like firewallRule.RemoteAddress, but I dont know how to use it. This is what I found on stackoverflow ( following code blocks all access to internet ), Thanks.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using NETCONLib;
using NATUPNPLib;
using NetFwTypeLib;

namespace WindowsFormsApplication1
{

public class Form1 : Form
{

    public Form1()
    {
        InitializeComponent();
        INetFwRule firewallRule = (INetFwRule)Activator.CreateInstance(
        Type.GetTypeFromProgID("HNetCfg.FWRule"));
        firewallRule.Action = NET_FW_ACTION_.NET_FW_ACTION_BLOCK;
        firewallRule.Description = "Used to block all internet access.";
        firewallRule.Direction = NET_FW_RULE_DIRECTION_.NET_FW_RULE_DIR_OUT;
        firewallRule.Enabled = true;
        firewallRule.InterfaceTypes = "All";
        firewallRule.Name = "Block Internet";

        INetFwPolicy2 firewallPolicy = (INetFwPolicy2)Activator.CreateInstance(
        Type.GetTypeFromProgID("HNetCfg.FwPolicy2"));
        firewallPolicy.Rules.Add(firewallRule);
    }
}
}

Answer 1

As far as I can tell, you have to retrieve the RemoteAddresses list first before adding to it. Otherwise, it just overwrites each IP with the next one. The format needs to be as Jan described in his/her answer. However, the subnet " /255.255.255.255 " is not needed when adding a single IP address. My app only blocks a single ip at a time, but you can put ranges in there as Jan describes. Most the credit goes to others on SO with exception of the RemoteAddresses part. If there's a better/cleaner way, I would love to hear it. Here's how I ended up doing it:

        private void BlockIp(string ip, string ruleName)
        {
            INetFwPolicy2 firewallPolicy = (INetFwPolicy2)Activator.CreateInstance(Type.GetTypeFromProgID("HNetCfg.FwPolicy2"));
            INetFwRule firewallRule = firewallPolicy.Rules.OfType<INetFwRule>().Where(x => x.Name == ruleName).FirstOrDefault();

            if (firewallRule == null)
            {
                firewallRule = (INetFwRule)Activator.CreateInstance(Type.GetTypeFromProgID("HNetCfg.FWRule"));
                firewallRule.Name = ruleName;
                firewallPolicy.Rules.Add(firewallRule);
                firewallRule.Description = "Block inbound traffic";
                firewallRule.Profiles = (int)NET_FW_PROFILE_TYPE2_.NET_FW_PROFILE2_ALL;
                firewallRule.Protocol = (int)NET_FW_IP_PROTOCOL_.NET_FW_IP_PROTOCOL_TCP;
                firewallRule.Direction = NET_FW_RULE_DIRECTION_.NET_FW_RULE_DIR_IN;
                firewallRule.Action = NET_FW_ACTION_.NET_FW_ACTION_BLOCK;
                //firewallRule.LocalPorts = "8080";
                //firewallRule.Grouping = "@firewallapi.dll,-23255";
                firewallRule.Enabled = true;
                firewallRule.RemoteAddresses = ip;
                //firewallPolicy.Rules.Add(firewallRule); //throws error, not needed
            } else {
                var remoteAddresses = firewallRule.RemoteAddresses;
                firewallRule.RemoteAddresses = remoteAddresses + "," + ip;
            }
        }

Answer 2

您可以使用以逗号分隔的IP地址列表（子网，别名）

$Rule.RemoteAddresses = RemoteAddresses = 'LocalSubnet,10.1.1.1/255.255.255.255,12.5.0.0/255.255.0.0'