Get-NetTCPConnectionIPアドレス監視

# JSON を読み込み
$json = ConvertFrom-Json -InputObject (Get-Content .\allowList.json -Raw)

# 許可リストの作成
$allowList = @()
foreach($item in $json)
{
    $allowItem = New-Object allowItem
    $allowItem.LocalAddress = New-Object Ip4Address($item.LocalAddress)
    $allowItem.LocalPorts = $item.LocalPorts
    $allowItem.RemoteAddress = New-Object Ip4Address($item.RemoteAddress)
    $allowItem.RemotePorts = $item.RemotePorts
    $allowList += $allowItem
}

Function IsAllowed([CimInstance] $connection)
{
    if ($connection.LocalAddress.Contains(":"))
    {
        # IPv6 は不許可扱い
        return $FLASE
    }
    foreach($allowItem in $allowList)
    {
        $local = New-Object Ip4Address($connection.LocalAddress)
        $remote = New-Object Ip4Address($connection.RemoteAddress)

        if ($allowItem.LocalAddress.Contains($local) -and
            # ポート番号が１つもない時にはどれでもOK
            ( $allowItem.LocalPorts.Contains([int]$connection.LocalPort) -or $allowItem.LocalPorts.Length -eq 0 ) -and
            $allowItem.RemoteAddress.Contains($remote) -and
            # ポート番号が１つもない時にはどれでもOK
            ( $allowItem.RemotePorts.Contains([int]$connection.RemotePort) -or $allowItem.RemotePorts.Length -eq 0 ) )
        {
            return $TRUE
        }
    }
    return $FALSE
}

# フィルターの定義
filter SelectAllowConnection()
{
    if (IsAllowed($_))
    {
        return $_
    }
}

filter SelectDenyConnection()
{
    if (!(IsAllowed($_)))
    {
        return $_
    }
}

# 実行：許可リストにあるものを画面表示
Get-NetTCPConnection -State Established,Listen |
  SelectAllowConnection

# 実行：許可リストにないものをCSV出力
Get-NetTCPConnection -State Established,Listen |
  SelectDenyConnection |
  Select-Object -Property LocalAddress,LocalPort,RemoteAddress,RemotePort |
  Export-Csv -path xxxx.log

# IPv4のアドレスクラスの定義
class Ip4Address
{
    [int64] $Address
    [int64] $Mask
    [int] $Width

    # 渡せるアドレスは "192.168.140.0/24"、あるいは "192.168.140.10" など
    Ip4Address([String] $addressCidr){
        if($addressCidr -eq "")
        {
            $this.Address = 0
            $this.Mask = 0
            $this.Width = 0
            return
        }

        $temp = $addressCidr -split "/"
        $ip = $temp[0] -split "\."
        $this.Width = 32
        if(2 -eq $temp.Length)
        {
            $this.Width = [int]$temp[1]
        }
        $this.Mask = 0
        if($this.Width -ne 0)
        {
            $this.Mask = 0xffffffffL -bxor ( [Math]::Pow(2,32 - $this.Width) - 1 )
        }
        $this.Address = 0
        foreach($octet in $ip)
        {
            $this.Address = $this.Address * 256 + [int]$octet
        }
        $this.Address = $this.Address -band $this.Mask
    }

    [bool]Contains([Ip4Address] $other){
        return $this.Width -le $other.Width -and ( $other.Address -band $this.Mask ) -eq $this.Address
    }
}

# 許可リスト用の項目クラス
class allowItem
{
    [Ip4Address] $LocalAddress
    [int[]] $LocalPorts
    [Ip4Address] $RemoteAddress
    [int[]] $RemotePorts
}

[
  {
    "LocalAddress": "192.168.140.0/24",
    "LocalPorts": [80,443,445],
    "RemoteAddress": "",
    "RemotePorts": [80,443,24,587]
  },
  {
    "LocalAddress": "172.16.0.0/16",
    "LocalPorts": [80,443,445],
    "RemoteAddress": "",
    "RemotePorts": [80,443,24,588]
  },
  {
    "LocalAddress": "172.17.0.0/16",
    "LocalPorts": [80,443,445],
    "RemoteAddress": "",
    "RemotePorts": [80,443,24,589]
  },
  {
    "LocalAddress": "172.18.0.0/16",
    "LocalPorts": [80,443,445],
    "RemoteAddress": "",
    "RemotePorts": [80,443,24,590]
  }
]

         if ($allowItem.LocalAddress.Contains($local) -and
             # ポート番号が１つもない時にはどれでもOK
-            $allowItem.LocalPorts.Contains([int]$connection.LocalPort) -or $allowItem.LocalPorts.Length -eq 0 -and
+            ( $allowItem.LocalPorts.Contains([int]$connection.LocalPort) -or $allowItem.LocalPorts.Length -eq 0 ) -and
             $allowItem.RemoteAddress.Contains($remote) -and
             # ポート番号が１つもない時にはどれでもOK
-            $allowItem.RemotePorts.Contains([int]$connection.RemotePort) -or $allowItem.RemotePorts.Length -eq 0 )
+            ( $allowItem.RemotePorts.Contains([int]$connection.RemotePort) -or $allowItem.RemotePorts.Length -eq 0 ) )

         if($addressCidr -eq "")
         {
             $this.Address = 0
             $this.Mask = 0
-            $this.Width = 32
+            $this.Width = 0
             return
         }

{
  "LocalAddress": "",
  "LocalPorts": [20,21,80,443,445],
  "RemoteAddress": "172.18.0.0/16",
  "RemotePorts": [24,80,443,445,587]
}

{
  "LocalAddress": "",
  "LocalPorts": [],
  "RemoteAddress": "172.18.0.0/16",
  "RemotePorts": [24,80,443,445,587]
}