netsh advfirewall firewall

Commands in the «netsh advfirewall firewall» context

`help`, `?`	Displays a list of commands.
`add`	Adds a new inbound or outbound firewall rule.
`delete`	Deletes all matching firewall rules.
`dump`	Displays a configuration script.
`set`	Sets new values for properties of a existing rule.
`show`	Displays a specified firewall rule.

Enabling programs / remove allowed programs

netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=private

netsh advfirewall firewall delete rule name="My Application" program="C:\MyApp\MyApp.exe"   REM ???

These commands replace the deprecated netsh firewall add allowedprogram … and netsh firewall delete allowedprogram… commands.

Enable/disable specific ports

netsh advfirewall firewall add    rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

netsh advfirewall firewall delete rule name=…              protocol=udp localport=500      REM ???

These commands replace the deprecated netsh firewall add portopening TCP 80 … and netsh delete portopening protocol commands.

Configure ICMP Settings

Allow ping requests:

netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any   dir=in action=allow
netsh advfirewall firewall add rule name="All ICMP V4"                         protocol=icmpv4:any,any dir=in action=allow
netsh advfirewall firewall add rule name="Block Type 13 ICMP V4"               protocol=icmpv4:13,any  dir=in action=block

Such a rule might then deleted again with

netsh advfirewall firewall delete rule "ICMP Allow incoming V4 echo request"

Logging

netsh advfirewall set currentprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set currentprofile logging maxfilesize 4096
netsh advfirewall set currentprofile logging droppedconnections enable
netsh advfirewall set currentprofile logging allowedconnections enable

Enable firewall

netsh advfirewall set currentprofile state on
netsh advfirewall set currentprofile firewallpolicy blockinboundalways,allowoutbound
netsh advfirewall set domainprofile  firewallpolicy blockinbound,allowoutbound

Enable specific services

netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
netsh advfirewall firewall set rule group="remote desktop"           new enable=Yes
netsh advfirewall firewall set rule group="remote desktop"           new enable=Yes profile=domain
netsh advfirewall firewall set rule group="remote desktop"           new enable=Yes profile=private