Wondering how to Configure Windows Firewall Rules with PowerShell? We will help you it.

Here at Bobcares, we have seen several such Firewall related queries as part of our Server Management Services

Today, let’s see some of its benefits and how our Support Engineers configure it.

Configure Windows Firewall Rules with PowerShell

Usually, Windows Firewall settings are managed from the graphic console: Control Panel -> System and Security -> Windows Defender Firewall.

Previously, we could use the following command to manage Windows Firewall rules and settings:

netsh advfirewall firewall

There are 85 commands available in the NetSecurity module on Windows. We can display the whole list:

Get-Command -Module NetSecurity

How to Manage Windows Firewall Network Profiles from PowerShell

Usually, there are three types of network profiles in Windows Firewall:

• Domain – can apply to the computers in an Active Directory domain
• Private – home or corporate networks
• Public – public networks

Generally, network Location Awareness (NLA) keeps the information about network types in its database. We can change our network profile (location) if it has been detected incorrectly.

• Firstly, to enable all three network profiles: Domain, Public and Private, use this command:

Set-NetFirewallProfile -All -Enabled True

• Or, set the specific profile instead All:

Set-NetFirewallProfile -Profile Public -Enabled True

• In order to,  disable the firewall for all three network location, use the command:

Set-NetFirewallProfile -All -Enabled False

• Generally, using the Set-NetFirewallProfile cmdlet, we can change profile options (a default action, logging, a path to and a size of a log file, notification settings, etc.).
• Next, allow all outbound connections and block inbound ones (except allowed ones) in the profile settings.
• Let us change the default action for the Public profile to block all inbound connections.

Set-NetFirewallProfile –Name Public –DefaultInboundAction Block

• We can display the current profile settings as follows:

Get-NetFirewallProfile -Name Public

• If we manage Windows Firewall settings using GPO, we can display the current resulting profile settings as follows:

Get-NetFirewallProfile -policystore activestore

• Make sure to apply all firewall settings to all network interfaces of the computer.

Get-NetFirewallProfile -Name Public | fl DisabledInterfaceAliases

• If all interfaces are protected, the command will return the following:

DisabledInterfaceAliases : {NotConfigured}

• To disable the specific interface profile (to display the list of interface names, use the Get-NetIPInterface):

Set-NetFirewallProfile -Name Public -DisabledInterfaceAliases “Ethernet0”

• As we can see, Public profile is no longer applied to Ethernet0:

DisabledInterfaceAliases : {Ethernet0}

• Set network connection logging options at the profile level.

By default, Windows Firewall logs are stored in %systemroot%\system32\LogFiles\Firewall and the file size is 4MB.

• Enable all connection logging and change the maximum file size:

Set-NetFireWallProfile -Profile Domain -LogBlocked True -LogMaxSize 20000 -LogFileName ‘%systemroot%\system32\LogFiles\Firewall\pfirewall.log’

How to Create, Edit or Remove Windows Firewall Rules with PowerShell

There are 9 cmdlets to manage our firewall rules:

New-NetFirewallRule
Copy-NetFirewallRule
Disable-NetFirewallRule
Enable-NetFirewallRule
Get-NetFirewallRule
Remove-NetFirewallRule
Rename-NetFirewallRule
Set-NetFirewallRule
Show-NetFirewallRule

For example, if we want to allow inbound TCP connections to ports 80 and 443 for Domain and Private profiles, use this command:

New-NetFirewallRule -DisplayName ‘HTTP-Inbound’ -Profile @(‘Domain’, ‘Private’) -Direction Inbound -Action Allow -Protocol TCP -LocalPort @(’80’, ‘443’)

• Firstly, to allow or block network access for an app. For example, we want to block outbound connections for Firefox:

New-NetFirewallRule -Program “C:\Program Files (x86)\Mozilla Firefox\firefox.exe” -Action Block -Profile Domain, Private -DisplayName “Block Firefox browser” -Description “Block Firefox browser” -Direction Outbound

• Then, to allow inbound RDP connection on port 3389 from one IP address only:

New-NetFirewallRule -DisplayName “AllowRDP” –RemoteAddress 192.168.2.200 -Direction Inbound -Protocol TCP –LocalPort 3389 -Action Allow

• Next, to allow ping (ICMP) for addresses from the specified IP subnet or IP range, use these commands:

$ips = @(“192.168.2.15-192.168.2.40”, “192.168.100.15-192.168.100.200”, ”10.1.0.0/16”)
New-NetFirewallRule -DisplayName “Allow inbound ICMPv4” -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress $ips -Action Allow
New-NetFirewallRule -DisplayName “Allow inbound ICMPv6” -Direction Inbound -Protocol ICMPv6 -IcmpType 8 -RemoteAddress $ips -Action Allow

• In order to, edit an existing firewall rule, the Set-NetFirewallRule cmdlet is used. For example, to allow inbound connections from the specified IP address for the rule created earlier:

Get-NetFirewallrule -DisplayName ‘HTTP-Inbound’ | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress 192.168.1.10

• To add multiple IP addresses to a firewall rule, use this script:

$ips = @(“192.168.2.15”, “192.168.2.17”,”192.168.100.15”)
Get-NetFirewallrule -DisplayName ‘WEB-Inbound’|Set-NetFirewallRule -RemoteAddress $ips

• In order to, display all IP addresses in a firewall rule:

Get-NetFirewallrule -DisplayName ‘Allow inbound ICMPv4’|Get-NetFirewallAddressFilter

• Then, enable/disable firewall rules using Disable-NetFirewallRule and Enable-NetFirewallRule cmdlets.

Disable-NetFirewallRule –DisplayName ‘WEB-Inbound’

• Next, to allow ICMP (ping), run this command:

Enable-NetFirewallRule -Name FPS-ICMP4-ERQ-In

• In order to  remove a firewall rule, the Remove-NetFirewallRule cmdlet is used.

Listing Windows Firewall Rules with PowerShell

• Firstly, we can display the list of active firewall rules for our inbound traffic as follows:

Get-NetFirewallRule | where {($_.enabled -eq $True) -and ($_.Direction -eq “Inbound”)} |ft

• Next, to display the list of outbound blocking rules:

Get-NetFirewallRule -Action Block -Enabled True -Direction Outbound

• Then, to display an app name in a rule:

Get-NetFirewallRule -Action Block -Enabled True -Direction Outbound | %{$_.Name; $_ | Get-NetFirewallApplicationFilter

• As we can see, the Get-NetFirewallRule cmdlet does not show network ports and IP addresses for our firewall rules.

To display the detailed information about allowed inbound (outbound) connections in a more convenient way showing the port numbers, use the following PowerShell script:

Get-NetFirewallRule -Action Allow -Enabled True -Direction Inbound |
Format-Table -Property Name,
@{Name=’Protocol’;Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},
@{Name=’LocalPort’;Expression={($PSItem | Get-NetFirewallPortFilter).LocalPort}},
@{Name=’RemotePort’;Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}},
@{Name=’RemoteAddress’;Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}},
Enabled,Profile,Direction,Action.

Need any further assistance to configure filters in Nagios log server? – We’re available 24*7 

Conclusion

Today, we saw how our Support Techs configure Windows Firewall Rules with PowerShell