When it comes to working with the Windows Firewall,
you could do that using the Group Policy locally on the machine,
but you can also manage it from PowerShell.
In addition to that is making use of the Windows Admin Center.
Within the Windows Admin Center,
I'm going to navigate to one of my member servers.
And on my extension list on the left‑hand side,
you'll see that I have the Firewall extension.
Making use of this extension allows me to configure
the firewall on the local machine.
Initially, I have an overview of the different profiles that's currently enabled,
along with information about the Default Inbound Action and Outbound Action.
I can also look at the Incoming and Outgoing rules,
adding a new rule, modifying an existing rule,
and tweaking the rule settings if I would like to modify the IP addresses,
principals, and Advanced settings.
But what if you wanted to script your rule creation?
Well, this is where PowerShell comes into play.
Let's look at how we can use PowerShell to work with the Windows Firewall.
A dedicated firewall module that you can use within PowerShell
was introduced in Windows Server 2012 R2.
Since then, all the new versions of Windows Server included this module.
The module that I'm talking about is the NetSecurity PowerShell module.
To take a look at the existing commands that you
can leverage within this module,
we can view the module commands by using the
Get‑Command followed by defining the module.
As I scroll through this,
you'll see that there are quite a number of different
commands that you can use within this module,
and all of them relate to the firewall, so let's work with this modular
bit and configure our firewall on this member server.
So the first thing I'm going to do is actually enable
all three of the network profiles.
These, by default, should be enabled,
but I'm going to go ahead and just reenable them.
The command that I will use is the Set‑NetFirewallProfile followed by the ‑All,
which defines all of the profiles.
Now if I wanted to specify a specific profile,
I could use the ‑Profile followed by the profile name,
and then I'm going to set the ‑Enabled to a value of True.
I'll then go ahead and hit Enter, and now the command is completed successfully,
and I know for sure that all of my network profiles are enabled.
If I wanted to disable a specific profile,
I could do that using the exact same command,
but instead of True at the end, I would use False.
Now let's go ahead and explore what is currently set up for these profiles.
I'll start off with the Public profile because I want to ensure that
the Public profile is as restrictive as possible, so I'll go ahead and
use the command Get‑NetFirewallProfile, defining the name,
which is Public.
Now as I look through the results,
this seems pretty standard and straightforward,
and I'm not going to modify anything on this profile.
Let's go ahead and take a look at our Domain profile.
Now currently on our Domain profile,
we have a couple of actions that's not configured,
for example, the DefaultInboundAction,
and we do not have any rules that's currently configured.
So let's go ahead and set up a couple of rules on this
Domain profile to enable communication to the server for
common protocols such as Ping, SMB, and so forth.
The first thing that I'm going to do is turn the logging on for the firewall.
So using the command Set‑NetFirewallProfile,
I'm going to define my profile, which is Domain.
I'm going to use the LogAllowed with the value of True to turn the logging on.
I will then increase the log size in kilobytes,
and then I would like to also log any blocked traffic.
Let's go back and look at our profile and see if these changes have been added.
And sure enough, they have.
Next, I would like to modify the DefaultInboundAction.
I'll use the same command that we've used before,
but this time I'll define my DefaultInboundAction to be a value of Allow.
I'll hit Enter and then check if my changes have been enabled.
So now let's go ahead and create a firewall rule.
The first firewall rule that I'm going to create is to allow
remote desktop connection on port 3389 for my client machine so
that I could remote desktop to the server.
So in order to create this firewall rule,
I'm going to use a new command that is part of the NetSecurity suite,
and this command is going to be New‑NetFirewallRule,
which is pretty self explanatory as I'm creating a new rule.
I will then give it a DisplayName.
I will define my RemoteAddress, the Direction, the Protocol, the port.
Remember, this is the local port, so, in this case, it would be 3389.
And then I will define the Action, which is Allow.
As I hit Enter, we can see that the rule has now been successfully created.
Now if I wanted to list any rules that I have created in a specific direction,
I can do that using the Get‑NetFirewallRule command.
For example, looking for any rules that currently exist,
which has an Action of Allow and the Direction of
Inbound, I could use this command, and as I Enter,
I will now see all of the rules that match that command.
And you'll notice at the end, I've got my rule,
which I've just created for admin Remote Desktop.
Now if I wanted to disable a firewall rule,
I can simply do that using the Disable‑NetFirewallRule command,
specifying the DisplayName.
In this case, I have disabled the rule that I've just created,
and I can confirm that it's been disabled by running the Get‑NetFirewallRule,
and we'll see that this rule is disabled.
To delete the rule, all I need to do is run the Remove‑NetFirewallRule command,
followed by the DisplayName.
So this was a quick overview on how you could use
PowerShell to manage the Windows Firewall.
Microsoft has an extensive document,
which describes every single command within the NetSecurity module. Feel free to check it out by navigating to the link on your screen.