最近做IPv6项目时遇到了ipv4地址的十进制数字转ipv6地址的十六进制，用计算器换算太麻烦，所以撸了一个批处理轮子。
可以参考我之前的《批处理脚本封装成exe可执行文件》，转成exe方便使用。

此脚本可以实现对输入的ipv4地址格式做判断，只把v4的a.b.c.d转成v6的ff:ff格式。
注意批处理脚本要保存成ansi格式。

#batch_ipv4_trans_hex.bat
chcp 936&cls
@echo off&PUSHD %~DP0 &TITLE IPv4地址转IPv6
mode con cols=90 lines=30&COLOR f0

:input_ipv4_address
cls
echo;请输入IPv4地址：
setlocal enabledelayedexpansion
set /p ipv4=
set "s=[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*"
echo %ipv4%|findstr /be "%s%" >nul||set flag=a
set n=%ipv4:.= %
for %%a in (%n%) do (
   set /a var=1%%a 2>nul
   if !var! gtr 1255 set flag=a
)
if defined flag echo;IPv4地址格式错误，按任意键重新输入&pause>nul&endlocal&goto :input_ipv4_address
for /f "tokens=1 delims=." %%a in ("%ipv4%")  do ( set ipv4_a=%%a)
if not defined ipv4_a echo;IPv4地址格式错误，按任意键重新输入&pause>nul&goto :input_ipv4_address
for /f "tokens=2 delims=." %%a in ("%ipv4%")  do ( set ipv4_b=%%a)
if not defined ipv4_b echo;IPv4地址格式错误，按任意键重新输入&pause>nul&goto :input_ipv4_address
for /f "tokens=3 delims=." %%a in ("%ipv4%")  do ( set ipv4_c=%%a)
if not defined ipv4_c echo;IPv4地址格式错误，按任意键重新输入&pause>nul&goto :input_ipv4_address
for /f "tokens=4 delims=." %%a in ("%ipv4%")  do ( set ipv4_d=%%a)
if not defined ipv4_d echo;IPv4地址格式错误，按任意键重新输入&pause>nul&goto :input_ipv4_address
call :dec2hex %ipv4_a% ipv4_a_hex
call :dec2hex %ipv4_b% ipv4_b_hex
call :dec2hex %ipv4_c% ipv4_c_hex
call :dec2hex %ipv4_d% ipv4_d_hex
cls
echo;IPv4地址：%ipv4%
echo;IPv6地址：%ipv4_a_hex%%ipv4_b_hex%:%ipv4_c_hex%%ipv4_d_hex%
echo;按任意键重新输入，或按右上角X退出
pause>nul
set ipv4=
set ipv4_a=
set ipv4_b=
set ipv4_c=
set ipv4_d=
cls
goto :input_ipv4_address

:dec2hex
setlocal EnableDelayedExpansion
set n=%1
for /l %%i in (1,1,2) do set/a"H%%i=n&15,n>>=4"&set o=!H%%i!:!o!
for %%e in ("10:=A" "11:=B" "12:=C" "13:=D" "14:=E" "15:=F" ":=") do set o=!o:%%~e!
endlocal & set %2=%o%

需求：vpn连接限制了可访问的ip和端口，想要使用windows的远程桌面

思路：
1，修改远程桌面默认3389端口为vpn可访问端口；
2，添加端口转发到远程桌面默认3389端口

实施：
1，使用rdpwrapper修改，或通过注册表修改，略。

2，添加新端口转发到3389端口，并设置防火墙放行新端口
命令如下：
端口转发：

netsh interface portproxy add v4tov4  listenaddress=0.0.0.0 listenport=%newport% connectaddress=127.0.0.1 connectport=3389

防火墙放行：

netsh advfirewall firewall add rule name="Allow VPN Remore Desktop" dir=in protocol=tcp localport=%newport% action=allow

批处理脚本：

@echo off&PUSHD %~DP0 &TITLE VPN可访问远程桌面端口设置
mode con cols=90 lines=30&COLOR f0
fltmc>nul&&(goto :message)||(echo;请以管理员身份运行，按任意键退出 &&goto :end)

:message
cls
echo;本程序需在终端计算机上运行
echo;本程序会将VPN可访问端口映射到远程桌面的3389端口，并添加相应防火墙规则
echo;
echo;按任意键继续，或点击右上角X退出
pause>nul
goto :port3389check


:port3389check
set portnum=3389
for /f "tokens=3 delims=: " %%a in ('netstat -an') do (
if "%%a"=="%portnum%" (goto :input))
echo;&echo 未检测到3389端口，请检查远程桌面服务&echo 按任意键退出&goto :end


:input
cls
echo;请输入您的VPN可访问端口并按回车
set/p userinput=端口：
echo %userinput%|findstr /r /c:"^[0-9][0-9]*$">nul
if errorlevel 1 (echo 请检查您输入的端口，按任意键开始重新输入&pause>nul&goto :input) else (
if %userinput% leq 65535 (if %userinput% geq 10000 (goto :vpnportcheck) else (echo 请检查您输入的端口，按任意键开始重新输入&pause>nul&goto :input) ) else (echo 请检查您输入的端口，按任意键开始重新输入&pause>nul&goto :input))
goto :end

:vpnportcheck
set vpnportnum=%userinput%
for /f "tokens=3 delims=: " %%a in ('netstat -an') do (
if "%%a"=="%vpnportnum%" (echo 检测到您输入的端口已被占用，按任意键退出&goto :end))
goto :portproxy

:portproxy
cls
echo;***步骤1：添加端口映射***
echo;如果360拦截，请选择“允许操作”
netsh interface portproxy add v4tov4  listenaddress=0.0.0.0 listenport=%userinput% connectaddress=127.0.0.1 connectport=3389
echo;
echo;***步骤2：添加防火墙规则***
echo;如果360拦截，请选择“允许操作”
netsh advfirewall firewall add rule name="Allow VPN Remore Desktop" dir=in protocol=tcp localport=%userinput% action=allow >nul
echo;
echo;成功,按任意键退出...
goto :end

:end
pause>nul

脚本说明：
0，github地址：https://github.com/trepwq/proxy-remote-desktop-port-batch
1，使用fltmc检查是否以管理员方式运行
2，检查3389端口是否在监听状态，使用了for循环匹配netstat -an命令结果中3389端口
3，检查输入的新端口是否合规，不能是非整数，不能是数字和其他字符组合，端口有范围，使用了findstr的正则匹配和if大小判断
4，检查新端口是否被占用，原理同2

2020.7.6更新：添加坑0，mtu问题

给公司测试ikev2 vpn，mac和ios一切正常，但是发现windows手动添加vpn有不少坑，总结一下，并附上批处理脚本（实际调用powershell）
以下在windows10下测试，ikev2服务器使用ubuntu下strongswan，代理所有路由，ikev2服务器安装脚本见之前文章https://www.willnet.net/index.php/archives/100/

坑0，windows的vpn虚拟网卡默认mtu是1400，
现象：如果服务端的mtu小于1400的话，会出现能ping通地址，但是网页不能打开的问题
解决办法：修改vpn虚拟网卡mtu值
连接vpn后，以管理员身份执行以下命令

netsh interface ipv4 set subinterface "vpn名称" mtu=1350  store=persistent

具体详见ikev2 客户端mtu引起的网络故障

坑1：
windows默认不支持DH2048_AES256协商协议
现象：提示策略匹配错误
解决办法：添加注册表项，不需要重启生效

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters里新建类型为DWORD的NegotiateDH2048_AES256 键，值设置为1

0 禁用AES-256-CBC和MODP-2048
1 启用AES-256-CBC和MODP-2048
2 强制使用AES-256-CBC和MODP-2048

坑2：
windows默认不支持Symmetric NAT类型路由器后的ikev2服务器
现象：提示809错误，或者提示路由器不支持nat
解决办法：添加注册表项，并需要重启生效

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent里新建类型为DWORD的AssumeUDPEncapsulationContextOnSendRule 键，值设置为2

0
A value of 0 (zero) configures Windows so that it cannot establish security associations with servers that are located behind NAT devices. This is the default value.
1
A value of 1 configures Windows so that it can establish security associations with servers that are located behind NAT devices.
2
A value of 2 configures Windows so that it can establish security associations when both the server and the Windows Vista-based or Windows Server 2008-based VPN client computer are behind NAT devices.

坑3：
windows手动添加的vpn默认没有开启默认路由
现象：连接成功，但是对外ip没有改变
解决办法：手动添加修改或者使用powershell新建vpn连接，手动路径：控制面板\网络和 Internet\网络连接，vpn网卡，属性，网络，ipv4，属性，高级，勾选在远程网络上使用默认网关

坑4:
windows10默认开启了smart multi-homed name resolution功能
现象：有线网络下连接vpn后不使用vpn的dns
解决办法：修改vpn网卡的跃点数，小于有线网卡即可。脚本自动解决待更新

批处理脚本如下，实际是使用批处理调用powershell命令，由于需要修改注册表，需要管理员权限运行

install.cmd

@echo off&PUSHD %~DP0 &TITLE ikev2 VPN安装/卸载程序
mode con cols=160 lines=50
set TempFile_Name=%SystemRoot%\System32\BatTestUACin_SysRt%Random%.batemp
( echo "BAT Test UAC in Temp" >%TempFile_Name% ) 1>nul 2>nul
if exist %TempFile_Name% (
del %TempFile_Name% 1>nul 2>nul&&goto :address
) else (
echo;请以管理员身份运行，按任意键退出 &&goto :end
)

:address
cls
echo;请输入办公地点：
echo;1：北京
echo;2：成都
echo;3：重庆
set/p choose1=请输入选项并按回车：
echo %choose1%|findstr /i "[123]">nul&&goto :install
goto :address

:install
cls
echo;请选择安装或者卸载VPN（ikev2）：
echo;i：安装
echo;u：卸载
echo;q：退出
set/p choose2=请输入选项并按回车：
echo %choose2%|findstr /i "[iuq]">nul&&goto :%choose1%%choose2%
goto :install

:1i
cls
echo;安装北京VPN
echo;===========================
echo;***步骤1：删除同名VPN***
(powershell -Command "& {Remove-VpnConnection -Name "北京办公室" -Force -PassThru;}") 1>nul 2>nul
echo;成功
echo;
echo;***步骤2：安装新的VPN***
powershell -Command "& {Add-VpnConnection -Name "北京办公室" -ServerAddress "beijing.example.com" -AuthenticationMethod "Eap" -EncryptionLevel "Maximum" -RememberCredential -TunnelType "Ikev2" -PassThru;}"
echo;成功
echo;
echo;***步骤3：清理注册表***
(powershell -Command "& {Remove-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256"; Remove-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule ";}") 1>nul 2>nul
echo;成功
echo;
echo;***步骤4：添加注册表***
(powershell -Command "& {New-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256" -value 1 -propertyType dword; New-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule " -value 2 -propertyType dword;}") 1>nul 2>nul
echo;成功
echo;
echo;***步骤5：设置注册表***
powershell -Command "& {Set-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256" -value 1; Set-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule " -value 2;}"
echo;成功
echo;
echo;***步骤6：重启电脑***
echo;按任意键重启电脑，或按右上角 X 退出后手动重启电脑
pause>nul
shutdown -r -t 0
goto :end

:1u
cls
echo;卸载北京VPN
echo;===========================
(powershell -Command "& {Remove-VpnConnection -Name "北京办公室" -Force -PassThru;}") 1>nul 2>nul
echo;成功,按任意键退出...
goto :end

:2i
cls
echo;安装成都VPN
echo;===========================
echo;***步骤1：删除同名VPN***
(powershell -Command "& {Remove-VpnConnection -Name "成都办公室" -Force -PassThru;}") 1>nul 2>nul
echo;成功
echo;
echo;***步骤2：安装新的VPN***
powershell -Command "& {Add-VpnConnection -Name "成都办公室" -ServerAddress "chengdu.example.com" -AuthenticationMethod "Eap" -EncryptionLevel "Maximum" -RememberCredential -TunnelType "Ikev2" -PassThru;}"
echo;成功
echo;
echo;***步骤3：清理注册表***
(powershell -Command "& {Remove-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256"; Remove-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule ";}") 1>nul 2>nul
echo;成功
echo;
echo;***步骤4：添加注册表***
(powershell -Command "& {New-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256" -value 1 -propertyType dword; New-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule " -value 2 -propertyType dword;}") 1>nul 2>nul
echo;成功
echo;
echo;***步骤5：设置注册表***
powershell -Command "& {Set-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256" -value 1; Set-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule " -value 2;}"
echo;成功
echo;
echo;***步骤6：重启电脑***
echo;按任意键重启电脑，或按右上角 X 退出后手动重启电脑
pause>nul
shutdown -r -t 0
goto :end

:2u
cls
echo;卸载成都VPN
echo;===========================
(powershell -Command "& {Remove-VpnConnection -Name "成都办公室" -Force -PassThru;}") 1>nul 2>nul
echo;成功,按任意键退出...
goto :end

:3i
cls
echo;安装重庆VPN
echo;===========================
echo;***步骤1：删除同名VPN***
(powershell -Command "& {Remove-VpnConnection -Name "重庆办公室" -Force -PassThru;}") 1>nul 2>nul
echo;成功
echo;
echo;***步骤2：安装新的VPN***
powershell -Command "& {Add-VpnConnection -Name "重庆办公室" -ServerAddress "chongqing.example.com" -AuthenticationMethod "Eap" -EncryptionLevel "Maximum" -RememberCredential -TunnelType "Ikev2" -PassThru;}"
echo;成功
echo;
echo;***步骤3：清理注册表***
(powershell -Command "& {Remove-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256"; Remove-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule ";}") 1>nul 2>nul
echo;成功
echo;
echo;***步骤4：添加注册表***
(powershell -Command "& {New-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256" -value 1 -propertyType dword; New-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule " -value 2 -propertyType dword;}") 1>nul 2>nul
echo;成功
echo;
echo;***步骤5：设置注册表***
powershell -Command "& {Set-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256" -value 1; Set-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule " -value 2;}"
echo;成功
echo;
echo;***步骤6：重启电脑***
echo;按任意键重启电脑，或按右上角 X 退出后手动重启电脑
pause>nul
shutdown -r -t 0
goto :end

:3u
cls
echo;卸载重庆VPN
echo;===========================
(powershell -Command "& {Remove-VpnConnection -Name "重庆办公室" -Force -PassThru;}") 1>nul 2>nul
echo;成功,按任意键退出...
goto :end

:end
pause>nul

powershell脚本,需要以管理员身份运行powershell然后执行install.ps1
install.ps1

Remove-VpnConnection -Name "成都办公室" -Force

Add-VpnConnection -Name "成都办公室" -ServerAddress "chengdu.example.com" -AuthenticationMethod "Eap" -EncryptionLevel "Maximum" -RememberCredential -TunnelType "Ikev2"

Remove-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256"

Remove-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule"

New-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256" -value 1 -propertyType dword

New-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule" -value 2 -propertyType dword

Set-ItemProperty HKLM:\System\CurrentControlSet\Services\Rasman\Parameters -name "NegotiateDH2048_AES256" -value 1

Set-ItemProperty HKLM:\System\CurrentControlSet\Services\PolicyAgent -name "AssumeUDPEncapsulationContextOnSendRule " -value 2