Bobcares

WeSupport

Call Us! 1-800-383-5193
Call Us! 1-800-383-5193
Call Us! 1-800-383-5193

Need Help?

Emergency Response Time custom

Our experts have had an average response time of 11.06 minutes in March 2021 to fix urgent issues.

We will keep your servers stable, secure and fast at all times for one fixed price.

Configure Windows Firewall Rules with PowerShell

by | May 6, 2021

Wondering how to Configure Windows Firewall Rules with PowerShell? We will help you it.

Here at Bobcares, we have seen several such Firewall related queries as part of our Server Management Services

Today, let’s see some of its benefits and how our Support Engineers configure it.

Configure Windows Firewall Rules with PowerShell

 

Usually, Windows Firewall settings are managed from the graphic console: Control Panel -> System and Security -> Windows Defender Firewall.

Previously, we could use the following command to manage Windows Firewall rules and settings:

netsh advfirewall firewall

There are 85 commands available in the NetSecurity module on Windows. We can display the whole list:

Get-Command -Module NetSecurity

 

How to Manage Windows Firewall Network Profiles from PowerShell

Usually, there are three types of network profiles in Windows Firewall:

  • Domain – can apply to the computers in an Active Directory domain
  • Private – home or corporate networks
  • Public – public networks

Generally, network Location Awareness (NLA) keeps the information about network types in its database. We can change our network profile (location) if it has been detected incorrectly.

  • Firstly, to enable all three network profiles: Domain, Public and Private, use this command:
Set-NetFirewallProfile -All -Enabled True
  • Or, set the specific profile instead All:
Set-NetFirewallProfile -Profile Public -Enabled True
  • In order to,  disable the firewall for all three network location, use the command:
Set-NetFirewallProfile -All -Enabled False
  • Generally, using the Set-NetFirewallProfile cmdlet, we can change profile options (a default action, logging, a path to and a size of a log file, notification settings, etc.).
  • Next, allow all outbound connections and block inbound ones (except allowed ones) in the profile settings.
  • Let us change the default action for the Public profile to block all inbound connections.
Set-NetFirewallProfile –Name Public –DefaultInboundAction Block
  • We can display the current profile settings as follows:
Get-NetFirewallProfile -Name Public
  • If we manage Windows Firewall settings using GPO, we can display the current resulting profile settings as follows:
Get-NetFirewallProfile -policystore activestore
  • Make sure to apply all firewall settings to all network interfaces of the computer.
Get-NetFirewallProfile -Name Public | fl DisabledInterfaceAliases
  • If all interfaces are protected, the command will return the following:
DisabledInterfaceAliases : {NotConfigured}
  • To disable the specific interface profile (to display the list of interface names, use the Get-NetIPInterface):
Set-NetFirewallProfile -Name Public -DisabledInterfaceAliases “Ethernet0”
  • As we can see, Public profile is no longer applied to Ethernet0:
DisabledInterfaceAliases : {Ethernet0}
  • Set network connection logging options at the profile level.

By default, Windows Firewall logs are stored in %systemroot%\system32\LogFiles\Firewall and the file size is 4MB.

  • Enable all connection logging and change the maximum file size:
Set-NetFireWallProfile -Profile Domain -LogBlocked True -LogMaxSize 20000 -LogFileName ‘%systemroot%\system32\LogFiles\Firewall\pfirewall.log’

How to Create, Edit or Remove Windows Firewall Rules with PowerShell

There are 9 cmdlets to manage our firewall rules:

New-NetFirewallRule
Copy-NetFirewallRule
Disable-NetFirewallRule
Enable-NetFirewallRule
Get-NetFirewallRule
Remove-NetFirewallRule
Rename-NetFirewallRule
Set-NetFirewallRule
Show-NetFirewallRule

For example, if we want to allow inbound TCP connections to ports 80 and 443 for Domain and Private profiles, use this command:

New-NetFirewallRule -DisplayName ‘HTTP-Inbound’ -Profile @(‘Domain’, ‘Private’) -Direction Inbound -Action Allow -Protocol TCP -LocalPort @(’80’, ‘443’)
  • Firstly, to allow or block network access for an app. For example, we want to block outbound connections for Firefox:
New-NetFirewallRule -Program “C:\Program Files (x86)\Mozilla Firefox\firefox.exe” -Action Block -Profile Domain, Private -DisplayName “Block Firefox browser” -Description “Block Firefox browser” -Direction Outbound
  • Then, to allow inbound RDP connection on port 3389 from one IP address only:
New-NetFirewallRule -DisplayName “AllowRDP” –RemoteAddress 192.168.2.200 -Direction Inbound -Protocol TCP –LocalPort 3389 -Action Allow
  • Next, to allow ping (ICMP) for addresses from the specified IP subnet or IP range, use these commands:
$ips = @(“192.168.2.15-192.168.2.40”, “192.168.100.15-192.168.100.200”, ”10.1.0.0/16”)
New-NetFirewallRule -DisplayName “Allow inbound ICMPv4” -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress $ips -Action Allow
New-NetFirewallRule -DisplayName “Allow inbound ICMPv6” -Direction Inbound -Protocol ICMPv6 -IcmpType 8 -RemoteAddress $ips -Action Allow
  • In order to, edit an existing firewall rule, the Set-NetFirewallRule cmdlet is used. For example, to allow inbound connections from the specified IP address for the rule created earlier:
Get-NetFirewallrule -DisplayName ‘HTTP-Inbound’ | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress 192.168.1.10
  • To add multiple IP addresses to a firewall rule, use this script:
$ips = @(“192.168.2.15”, “192.168.2.17”,”192.168.100.15”)
Get-NetFirewallrule -DisplayName ‘WEB-Inbound’|Set-NetFirewallRule -RemoteAddress $ips
  • In order to, display all IP addresses in a firewall rule:
Get-NetFirewallrule -DisplayName ‘Allow inbound ICMPv4’|Get-NetFirewallAddressFilter
  • Then, enable/disable firewall rules using Disable-NetFirewallRule and Enable-NetFirewallRule cmdlets.
Disable-NetFirewallRule –DisplayName ‘WEB-Inbound’
  • Next, to allow ICMP (ping), run this command:
Enable-NetFirewallRule -Name FPS-ICMP4-ERQ-In
  • In order to  remove a firewall rule, the Remove-NetFirewallRule cmdlet is used.

Listing Windows Firewall Rules with PowerShell

  • Firstly, we can display the list of active firewall rules for our inbound traffic as follows:
Get-NetFirewallRule | where {($_.enabled -eq $True) -and ($_.Direction -eq “Inbound”)} |ft
  • Next, to display the list of outbound blocking rules:
Get-NetFirewallRule -Action Block -Enabled True -Direction Outbound
  • Then, to display an app name in a rule:
Get-NetFirewallRule -Action Block -Enabled True -Direction Outbound | %{$_.Name; $_ | Get-NetFirewallApplicationFilter
  • As we can see, the Get-NetFirewallRule cmdlet does not show network ports and IP addresses for our firewall rules.

To display the detailed information about allowed inbound (outbound) connections in a more convenient way showing the port numbers, use the following PowerShell script:

Get-NetFirewallRule -Action Allow -Enabled True -Direction Inbound |
Format-Table -Property Name,
@{Name=’Protocol’;Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},
@{Name=’LocalPort’;Expression={($PSItem | Get-NetFirewallPortFilter).LocalPort}},
@{Name=’RemotePort’;Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}},
@{Name=’RemoteAddress’;Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}},
Enabled,Profile,Direction,Action.

Need any further assistance to configure filters in Nagios log server? – We’re available 24*7 

Conclusion

Today, we saw how our Support Techs configure Windows Firewall Rules with PowerShell

PREVENT YOUR SERVER FROM CRASHING!

Never again lose customers to poor server speed! Let us help you.

Our server experts will monitor & maintain your server 24/7 so that it remains lightning fast and secure.

SEE SERVER ADMIN PLANS

var google_conversion_label = "owonCMyG5nEQ0aD71QM";

0 Comments

Submit a Comment

Your email address will not be published. Required fields are marked *

Privacy Preference Center

Necessary

Necessary cookies help make a website usable by enabling basic functions like page navigation and access to secure areas of the website. The website cannot function properly without these cookies.

PHPSESSID - Preserves user session state across page requests.

gdpr[consent_types] - Used to store user consents.

gdpr[allowed_cookies] - Used to store user allowed cookies.

PHPSESSID, gdpr[consent_types], gdpr[allowed_cookies]
PHPSESSID
WHMCSpKDlPzh2chML

Statistics

Statistic cookies help website owners to understand how visitors interact with websites by collecting and reporting information anonymously.

_ga - Preserves user session state across page requests.

_gat - Used by Google Analytics to throttle request rate

_gid - Registers a unique ID that is used to generate statistical data on how you use the website.

smartlookCookie - Used to collect user device and location information of the site visitors to improve the websites User Experience.

_ga, _gat, _gid
_ga, _gat, _gid
smartlookCookie

Marketing

Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

IDE - Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.

test_cookie - Used to check if the user's browser supports cookies.

1P_JAR - Google cookie. These cookies are used to collect website statistics and track conversion rates.

NID - Registers a unique ID that identifies a returning user's device. The ID is used for serving ads that are most relevant to the user.

DV - Google ad personalisation

IDE, test_cookie, 1P_JAR, NID, DV, NID
IDE, test_cookie
1P_JAR, NID, DV
NID
hblid

Security

These are essential site cookies, used by the google reCAPTCHA. These cookies use an unique identifier to verify if a visitor is human or a bot.

SID, APISID, HSID, NID, PREF
SID, APISID, HSID, NID, PREF