Managing the Windows Firewall with PowerShell

• Author
• Recent Posts

Wolfgang Sommergut

Wolfgang Sommergut has over 20 years of experience in IT journalism. He has also worked as a system administrator and as a tech consultant. Today he runs the German publication WindowsPro.de.

Latest posts by Wolfgang Sommergut (see all)

• New Group Policy settings in Windows 11 23H2 - Mon, Nov 20 2023
• Windows Server 2025 will support SMB over QUIC in all editions - Fri, Nov 17 2023
• Switch between Windows Terminal and the legacy console - Thu, Nov 16 2023

In general, the MMC-based Window Firewall with Advanced Security is a powerful tool for managing existing rules and creating new ones. It also offers a few predefined filters that can help you to get a better overview of the large number of rules. On the other hand, netsh.exe suffers from its unintuitive syntax.

Filtering rules with Get-NetFirewallRule

PowerShell offers more flexible filters than the GUI and is easier to use than netsh.exe. The most important cmdlet for the analysis of existing rules is the Get-NetFirewallRule cmdlet. If you run it without parameters, you will receive a list of all rules with some of their properties.

For example, if you want to find out if the firewall blocks communication with a remote computer, you'll want to limit the output to those rules that could cause the problem.

For this purpose, a couple of parameters allow you to filter the list according to the most important properties, such as rule name and group name (Name, DisplayName, Group, DisplayGroup):

Get-NetFirewallRule -DisplayGroup Remote*

The wildcard "*" ensures that all group names that start with "Remote" are in the list, e.g. Remote Management and Remote Desktop.

Inbound/outbound and allow/block

Other important parameters are Action, Enabled, and Direction. Action accepts the values Allowand Block, Direction supports Inbound and Outbound, and Enabled expects True or False.

Get-NetFirewallRule -Action Block -Enabled True -Direction Inbound

This command displays all inbound rules that are enabled and block the corresponding connection.

The next example will refine the filter even further and limit the output to rule groups starting with "Network":

Get-NetFirewallRule -Action Allow -Enabled False -Direction Inbound -DisplayGroup Network* | select DisplayName, DisplayGroup

Displaying firewall rules with Get NetFirewallRule

Displaying programs in rules

In most cases the kind of information you receive this way is insufficient because you don't see to which programs the rules apply. If the name or the rule description doesn't contain a hint, you can to pipe the output of Get-NetFirewallRule to Get-NetFirewallApplicationFilter to display more details:

Get-NetFirewallRule -Action Block -Enabled True | %{$_.Name; $_ | Get-NetFirewallApplicationFilter}

Distinguishing network profiles

An important feature of the Windows Firewall is its ability to distinguish between network profiles (Private, Public, and Domain). For instance, if you want find the rules in a domain environment that block a certain application, you can ignore all rules which apply to the profiles "private" and "public".

Displaying firewall rules of the network profile Domain

Theoretically, you could define a filter using Where-Object that examines the Profile property. However, this method is a bit cumbersome because the property will have the value Any if a rule is enabled for all profiles. Using Get-NetFirewallProfile is more straightforward here:

Get-NetFirewallProfile -Name Domain | Get-NetFirewallRule | ? DisplayName ‑like File*

This command shows you all rules for the Domainprofile where DisplayName begins with File*. You will get the default properties output by Get-NetFirewallRule.

Disabling, enabling, and deleting rules

If you want to disable rules because they block a required connection, the Disable-NetFirewallRule cmdlet is what you need. In most cases you will pass the name of a single rule you want to disable. Alternatively, with the help of the Action, Enabled, and Directionparameters, you can filter the rules you want to deactivate:

Disable-NetFirewallRule -Action Block -Enabled True -Direction Inbound

Because such a command can have undesirable side effects, I recommend that you first execute it with the additional parameter WhatIf. This will give you an overview of the affected rules.

The Disable-NetFirewallRule cmdlet only disables firewall rules and doesn't change their configuration. If needed, you can enable these rules again with its counterpart Enable-NetFirewallRule.

By contrast, Remove-NetFirewallRule deletes rules, and you have to recreate them in case you need them again. All three cmdlets support the same parameters as Get-NetFirewallRule to limit rules.