PowerShell provides ample opportunities to manage Windows Firewall rules from the command prompt. You can automatically run PowerShell scripts to open/close ports if certain events happen. 

Here at Ibmi Media, as part of our Server Management Services, we regularly help our Customers to resolve related Firewall queries.

In this context, we shall look into how to Configure Windows Firewall Rules with PowerShell.

Configure Windows Firewall Rules with PowerShell

Usually, we can manage Windows Firewall settings from the graphic console: Control Panel -> System and Security -> Windows Defender Firewall.

Previously, the following command was used to manage Windows Firewall rules and settings:

netsh advfirewall firewall

There are 85 commands available in the NetSecurity module on Windows. We can display the whole list:

Get-Command -Module NetSecurity

How to Manage Windows Firewall Network Profiles from PowerShell ?

Usually, there are three types of network profiles in Windows Firewall:

• Domain – is applied to the computers in an Active Directory domain.
• Private – home or corporate networks.
• Public – public networks.

Generally, network Location Awareness (NLA) keeps the information about network types in its database. We can change our network profile (location) if it has been detected incorrectly.

i. Firstly, to enable all three network profiles: Domain, Public and Private, use this command:

Set-NetFirewallProfile -All -Enabled True

ii. Or, set the specific profile instead All:

Set-NetFirewallProfile -Profile Public -Enabled True

iii. In order to,  disable the firewall for all three network location, use the command:

Set-NetFirewallProfile -All -Enabled False

iv. Generally, using the Set-NetFirewallProfile cmdlet, we can change profile options (a default action, logging, a path to and a size of a log file, notification settings, etc.).

iv. Next, all outbound connections are allowed and inbound ones are blocked (except allowed ones) in the profile settings.

v. Let us change the default action for the Public profile to block all inbound connections.

Set-NetFirewallProfile –Name Public –DefaultInboundAction Block

vi. We can display the current profile settings as follows:

Get-NetFirewallProfile -Name Public

vii. If we manage Windows Firewall settings using GPO, we can display the current resulting profile settings as follows:

Get-NetFirewallProfile -policystore activestore

viii. Make sure that all firewall settings are applied to all network interfaces of the computer.

Get-NetFirewallProfile -Name Public | fl DisabledInterfaceAliases

ix. If all interfaces are protected, the command will return the following:

DisabledInterfaceAliases : {NotConfigured}

x. To disable the specific interface profile (to display the list of interface names, use the Get-NetIPInterface):

Set-NetFirewallProfile -Name Public -DisabledInterfaceAliases “Ethernet0”

xi. As we can see, Public profile is no longer applied to Ethernet0:

DisabledInterfaceAliases : {Ethernet0}

xii. Set network connection logging options at the profile level.

By default, Windows Firewall logs are stored in %systemroot%\system32\LogFiles\Firewall and the file size is 4MB.

xiii. Enable all connection logging and change the maximum file size:

Set-NetFireWallProfile -Profile Domain -LogBlocked True -LogMaxSize 20000 -LogFileName ‘%systemroot%\system32\LogFiles\Firewall\pfirewall.log’

How to Create, Edit or Remove Windows Firewall Rules with PowerShell ?

There are 9 cmdlets to manage our firewall rules:

New-NetFirewallRule

Copy-NetFirewallRule

Disable-NetFirewallRule

Enable-NetFirewallRule

Get-NetFirewallRule

Remove-NetFirewallRule

Rename-NetFirewallRule

Set-NetFirewallRule

Show-NetFirewallRule

For example, if we want to allow inbound TCP connections to ports 80 and 443 for Domain and Private profiles, use this command:

New-NetFirewallRule -DisplayName ‘HTTP-Inbound’ -Profile @(‘Domain’, ‘Private’) -Direction Inbound -Action Allow -Protocol TCP -LocalPort @(’80’, ‘443’)

i. Firstly, to allow or block network access for an app. For example, we want to block outbound connections for Firefox:

New-NetFirewallRule -Program “C:\Program Files (x86)\Mozilla Firefox\firefox.exe” -Action Block -Profile Domain, Private -DisplayName “Block Firefox browser” -Description “Block Firefox browser” -Direction Outbound

ii. Then, to allow inbound RDP connection on port 3389 from one IP address only:

New-NetFirewallRule -DisplayName “AllowRDP” –RemoteAddress 192.168.2.200 -Direction Inbound -Protocol TCP –LocalPort 3389 -Action Allow

iii. Next, to allow ping (ICMP) for addresses from the specified IP subnet or IP range, use these commands:

$ips = @(“192.168.2.15-192.168.2.40”, “192.168.100.15-192.168.100.200”, ”10.1.0.0/16”)
New-NetFirewallRule -DisplayName “Allow inbound ICMPv4” -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress $ips -Action Allow
New-NetFirewallRule -DisplayName “Allow inbound ICMPv6” -Direction Inbound -Protocol ICMPv6 -IcmpType 8 -RemoteAddress $ips -Action Allow

iv. In order to, edit an existing firewall rule, the Set-NetFirewallRule cmdlet is used. For example, to allow inbound connections from the specified IP address for the rule created earlier:

Get-NetFirewallrule -DisplayName ‘HTTP-Inbound’ | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress 192.168.1.10

v. To add multiple IP addresses to a firewall rule, use this script:

$ips = @(“192.168.2.15”, “192.168.2.17”,”192.168.100.15”)
Get-NetFirewallrule -DisplayName ‘WEB-Inbound’|Set-NetFirewallRule -RemoteAddress $ips

vi. In order to, display all IP addresses in a firewall rule:

Get-NetFirewallrule -DisplayName ‘Allow inbound ICMPv4’|Get-NetFirewallAddressFilter

vii. Then, enable/disable firewall rules using Disable-NetFirewallRule and Enable-NetFirewallRule cmdlets.

Disable-NetFirewallRule –DisplayName ‘WEB-Inbound’

viii. Next, to allow ICMP (ping), run this command:

Enable-NetFirewallRule -Name FPS-ICMP4-ERQ-In

In order to  remove a firewall rule, the Remove-NetFirewallRule cmdlet is used.

How to List Windows Firewall Rules with PowerShell ?

1. Firstly, we can display the list of active firewall rules for our inbound traffic as follows:

Get-NetFirewallRule | where {($_.enabled -eq $True) -and ($_.Direction -eq “Inbound”)} |ft

2. Next, to display the list of outbound blocking rules:

Get-NetFirewallRule -Action Block -Enabled True -Direction Outbound

3. Then, to display an app name in a rule:

Get-NetFirewallRule -Action Block -Enabled True -Direction Outbound | %{$_.Name; $_ | Get-NetFirewallApplicationFilter

4. As we can see, the Get-NetFirewallRule cmdlet does not show network ports and IP addresses for our firewall rules.

To display the detailed information about allowed inbound (outbound) connections in a more convenient way showing the port numbers, use the following PowerShell script:

Get-NetFirewallRule -Action Allow -Enabled True -Direction Inbound |
Format-Table -Property Name,
@{Name=’Protocol’;Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},
@{Name=’LocalPort’;Expression={($PSItem | Get-NetFirewallPortFilter).LocalPort}},
@{Name=’RemotePort’;Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}},
@{Name=’RemoteAddress’;Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}},
Enabled,Profile,Direction,Action.

[ Need urgent assistance to configure filters in Nagios log server? – We're available 24*7 ]