Windows 11 上封锁 Claude Code 出网：防火墙 + DNS + hosts 三层实战

1
# claude-guard setup for Windows 11 (run elevated) - ASCII only
2
$ErrorActionPreference = 'Continue'
3
$dir = 'C:\Users\<你>\AppData\Local\Temp\claude-guard'
4
$log = Join-Path $dir 'setup.log'
5
function Log([string]$m) {
6
    Add-Content -Path $log -Value ('[{0}] {1}' -f (Get-Date -Format s), $m) -Encoding utf8
7
}
8
Log '=== setup start ==='
9
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
10
Log ("IsAdmin=$isAdmin")
11
if (-not $isAdmin) { Log 'ABORT: not elevated'; exit 1 }
12

13
# --- A: firewall block rules (kernel-level, persistent) ---
14
foreach ($n in @('claude-guard-v4','claude-guard-v6','claude-guard-selftest-v4')) {
15
    Get-NetFirewallRule -DisplayName $n -ErrorAction SilentlyContinue | Remove-NetFirewallRule
16
}
17
New-NetFirewallRule -DisplayName 'claude-guard-v4' -Direction Outbound -Action Block -RemoteAddress '160.79.104.0/21' -Profile Any -Enabled True | Out-Null
18
New-NetFirewallRule -DisplayName 'claude-guard-v6' -Direction Outbound -Action Block -RemoteAddress '2607:6bc0::/32' -Profile Any -Enabled True | Out-Null
19
New-NetFirewallRule -DisplayName 'claude-guard-selftest-v4' -Direction Outbound -Action Block -RemoteAddress '223.5.5.5/32' -Profile Any -Enabled True | Out-Null
20
Log 'firewall: claude-guard-v4 / claude-guard-v6 / claude-guard-selftest-v4 created'
21

22
# --- E1: DNS on non-virtual adapters (anti-hijack) ---
23
$adapters = Get-NetAdapter | Where-Object { $_.InterfaceDescription -notmatch 'Hyper-V|Virtual|TAP-Windows|OpenVPN|WSL' }
24
foreach ($a in $adapters) {
25
    Set-DnsClientServerAddress -InterfaceAlias $a.Name -ServerAddresses @('223.5.5.5','119.29.29.29')
26
    $now = (Get-DnsClientServerAddress -InterfaceAlias $a.Name -AddressFamily 2).ServerAddresses -join ','
27
    Log ('DNS set on [' + $a.Name + '] desc=[' + $a.InterfaceDescription + '] now=' + $now)
28
}
29
ipconfig /flushdns | Out-Null
30
Log 'dns cache flushed'
31

32
# --- E2: hosts (aux name-layer, fail-closed) ---
33
$hostsPath = Join-Path $env:SystemRoot 'System32\drivers\etc\hosts'
34
Copy-Item $hostsPath ($hostsPath + '.bak-claude-guard') -Force
35
$domains = @('anthropic.com','www.anthropic.com','api.anthropic.com','console.anthropic.com','docs.anthropic.com','code.anthropic.com','statsig.anthropic.com','claude.ai','www.claude.ai','claude.com','www.claude.com','claudeusercontent.com')
36
$text = [System.IO.File]::ReadAllText($hostsPath)
37
$add = @()
38
foreach ($d in $domains) {
39
    if ($text -notmatch ('(?m)^\s*0\.0\.0\.0\s+' + [regex]::Escape($d) + '\s*$')) { $add += ('0.0.0.0 ' + $d) }
40
}
41
if ($add.Count -gt 0) {
42
    $block = "`r`n# claude-guard: aux name-layer block (fail-closed)`r`n" + ($add -join "`r`n") + "`r`n"
43
    [System.IO.File]::AppendAllText($hostsPath, $block, [System.Text.Encoding]::ASCII)
44
    Log ('hosts: ' + $add.Count + ' lines added')
45
} else {
46
    Log 'hosts: already up to date'
47
}
48

49
# --- summary ---
50
Get-NetFirewallRule -DisplayName 'claude-guard*' | ForEach-Object {
51
    Log ('rule: ' + $_.DisplayName + ' enabled=' + $_.Enabled + ' action=' + $_.Action + ' dir=' + $_.Direction)
52
}
53
Log '=== setup done ==='