Wondering how to Configure Windows Firewall Rules with PowerShell? We will help you it.

Here at Bobcares, we have seen several such Firewall related queries as part of our Server Management Services

Today, let’s see some of its benefits and how our Support Engineers configure it.

Configure Windows Firewall Rules with PowerShell

Usually, Windows Firewall settings are managed from the graphic console: Control Panel -> System and Security -> Windows Defender Firewall.

Previously, we could use the following command to manage Windows Firewall rules and settings:

netsh advfirewall firewallCopy Code

There are 85 commands available in the NetSecurity module on Windows. We can display the whole list:

Get-Command -Module NetSecurityCopy Code

How to Manage Windows Firewall Network Profiles from PowerShell

Usually, there are three types of network profiles in Windows Firewall:

• Domain – can apply to the computers in an Active Directory domain
• Private – home or corporate networks
• Public – public networks

Generally, network Location Awareness (NLA) keeps the information about network types in its database. We can change our network profile (location) if it has been detected incorrectly.

• Firstly, to enable all three network profiles: Domain, Public and Private, use this command:

Set-NetFirewallProfile -All -Enabled TrueCopy Code

• Or, set the specific profile instead All:

Set-NetFirewallProfile -Profile Public -Enabled TrueCopy Code

• In order to,  disable the firewall for all three network location, use the command:

Set-NetFirewallProfile -All -Enabled FalseCopy Code

• Generally, using the Set-NetFirewallProfile cmdlet, we can change profile options (a default action, logging, a path to and a size of a log file, notification settings, etc.).
• Next, allow all outbound connections and block inbound ones (except allowed ones) in the profile settings.
• Let us change the default action for the Public profile to block all inbound connections.

Set-NetFirewallProfile –Name Public –DefaultInboundAction BlockCopy Code

• We can display the current profile settings as follows:

Get-NetFirewallProfile -Name PublicCopy Code

• If we manage Windows Firewall settings using GPO, we can display the current resulting profile settings as follows:

Get-NetFirewallProfile -policystore activestoreCopy Code

• Make sure to apply all firewall settings to all network interfaces of the computer.

Get-NetFirewallProfile -Name Public | fl DisabledInterfaceAliasesCopy Code

• If all interfaces are protected, the command will return the following:

DisabledInterfaceAliases : {NotConfigured}Copy Code

• To disable the specific interface profile (to display the list of interface names, use the Get-NetIPInterface):

Set-NetFirewallProfile -Name Public -DisabledInterfaceAliases “Ethernet0”Copy Code

• As we can see, Public profile is no longer applied to Ethernet0:

DisabledInterfaceAliases : {Ethernet0}Copy Code

• Set network connection logging options at the profile level.

By default, Windows Firewall logs are stored in %systemroot%\system32\LogFiles\Firewall and the file size is 4MB.

• Enable all connection logging and change the maximum file size:

Set-NetFireWallProfile -Profile Domain -LogBlocked True -LogMaxSize 20000 -LogFileName ‘%systemroot%\system32\LogFiles\Firewall\pfirewall.log’Copy Code

How to Create, Edit or Remove Windows Firewall Rules with PowerShell

There are 9 cmdlets to manage our firewall rules:

New-NetFirewallRule
Copy-NetFirewallRule
Disable-NetFirewallRule
Enable-NetFirewallRule
Get-NetFirewallRule
Remove-NetFirewallRule
Rename-NetFirewallRule
Set-NetFirewallRule
Show-NetFirewallRuleCopy Code

For example, if we want to allow inbound TCP connections to ports 80 and 443 for Domain and Private profiles, use this command:

New-NetFirewallRule -DisplayName ‘HTTP-Inbound’ -Profile @(‘Domain’, ‘Private’) -Direction Inbound -Action Allow -Protocol TCP -LocalPort @(’80’, ‘443’)Copy Code

• Firstly, to allow or block network access for an app. For example, we want to block outbound connections for Firefox:

New-NetFirewallRule -Program “C:\Program Files (x86)\Mozilla Firefox\firefox.exe” -Action Block -Profile Domain, Private -DisplayName “Block Firefox browser” -Description “Block Firefox browser” -Direction OutboundCopy Code

• Then, to allow inbound RDP connection on port 3389 from one IP address only:

New-NetFirewallRule -DisplayName “AllowRDP” –RemoteAddress 192.168.2.200 -Direction Inbound -Protocol TCP –LocalPort 3389 -Action AllowCopy Code

• Next, to allow ping (ICMP) for addresses from the specified IP subnet or IP range, use these commands:

$ips = @(“192.168.2.15-192.168.2.40”, “192.168.100.15-192.168.100.200”, ”10.1.0.0/16”)
New-NetFirewallRule -DisplayName “Allow inbound ICMPv4” -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress $ips -Action Allow
New-NetFirewallRule -DisplayName “Allow inbound ICMPv6” -Direction Inbound -Protocol ICMPv6 -IcmpType 8 -RemoteAddress $ips -Action AllowCopy Code

• In order to, edit an existing firewall rule, the Set-NetFirewallRule cmdlet is used. For example, to allow inbound connections from the specified IP address for the rule created earlier:

Get-NetFirewallrule -DisplayName ‘HTTP-Inbound’ | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress 192.168.1.10Copy Code

• To add multiple IP addresses to a firewall rule, use this script:

$ips = @(“192.168.2.15”, “192.168.2.17”,”192.168.100.15”)
Get-NetFirewallrule -DisplayName ‘WEB-Inbound’|Set-NetFirewallRule -RemoteAddress $ipsCopy Code

• In order to, display all IP addresses in a firewall rule:

Get-NetFirewallrule -DisplayName ‘Allow inbound ICMPv4’|Get-NetFirewallAddressFilterCopy Code

• Then, enable/disable firewall rules using Disable-NetFirewallRule and Enable-NetFirewallRule cmdlets.

Disable-NetFirewallRule –DisplayName ‘WEB-Inbound’Copy Code

• Next, to allow ICMP (ping), run this command:

Enable-NetFirewallRule -Name FPS-ICMP4-ERQ-InCopy Code

• In order to  remove a firewall rule, the Remove-NetFirewallRule cmdlet is used.

Listing Windows Firewall Rules with PowerShell

• Firstly, we can display the list of active firewall rules for our inbound traffic as follows:

Get-NetFirewallRule | where {($_.enabled -eq $True) -and ($_.Direction -eq “Inbound”)} |ftCopy Code

• Next, to display the list of outbound blocking rules:

Get-NetFirewallRule -Action Block -Enabled True -Direction OutboundCopy Code

• Then, to display an app name in a rule:

Get-NetFirewallRule -Action Block -Enabled True -Direction Outbound | %{$_.Name; $_ | Get-NetFirewallApplicationFilterCopy Code

• As we can see, the Get-NetFirewallRule cmdlet does not show network ports and IP addresses for our firewall rules.

To display the detailed information about allowed inbound (outbound) connections in a more convenient way showing the port numbers, use the following PowerShell script:

Get-NetFirewallRule -Action Allow -Enabled True -Direction Inbound |
Format-Table -Property Name,
@{Name=’Protocol’;Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},
@{Name=’LocalPort’;Expression={($PSItem | Get-NetFirewallPortFilter).LocalPort}},
@{Name=’RemotePort’;Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}},
@{Name=’RemoteAddress’;Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}},
Enabled,Profile,Direction,ActionCopy Code
.

Need any further assistance to configure filters in Nagios log server? – We’re available 24*7 

Conclusion

Today, we saw how our Support Techs configure Windows Firewall Rules with PowerShell