Windows Firewall Management

Windows Firewall Service Management

Check Windows Firewall Service Status

• Retrieves the configuration details of the Windows Firewall service

sc qc mpssvc

• Checks the current status of the Windows Firewall service

sc query mpssvc

Start and Stop Windows Firewall Service

sc stop mpssvc

sc start mpssvc

Configuring Windows Firewall using netsh

Access Windows Firewall Settings

• Opens the Windows Firewall settings in the command-line interface

netsh advfirewall firewall

Display Help for firewall commands

netsh advfirewall /?

netsh advfirewall show /?

Display Firewall profiles

• Display the current firewall porfile

netsh advfirewall show currentprofile

• Shows the firewall settings for the public profile

netsh advfirewall show publicprofile

• Shows the firewall settings for the private profile

netsh advfirewall show privateprofile

• Shows the firewall settings for all profiles

netsh advfirewall show allprofile

Enable or disable Windows Firewall

• Disables the windows Fireall

netstat firewall set opmode disable

• Enables the windows firewall

netsh firewall set opmode enable

• Turn off firewall for all profile

netsh advfireall set allprofiles state off

• Turn on firewall for all profiles

netsh advfirewall set allprofiles state on

View and Modify Firewall Rules

• Displays help for firewall rule commands

netsh advfirewall firewall /?

• Dump the current firewall configuration

netsh advfirewall firewall dump

• Opens TCP port 23 for Telnet service

netsh firewall add portopening tcp 23 "Telnet Service"

• Display the current state of the firewall

netsh firewall show state

• Add a rule to allow inbound FTO client connections

netsh advfirewall firewall add rule name="Permit FTP Cient" dir=in action=allowenable=yes profile=any program=%SystemRoot%\System32\ftp.exe

• Displays all configured firewall rules

netsh advfirewall firewall show rule

netsh advfirewall firewall show rule name=nc64

• Display all Dynamic inbound rules

netsh advfirewall firewall show rule name=all dir=in type=dynamic

• Displays details of the "Permit FTP Client" rule

netsh advfirewall firewall show rule name="Permit FTP Client"

Adding and Removing Speicific Rules

• Allow inbound RDP traffic on port 3389

netsh advfirewall firewall add rule name="RDP" dir=in action=allow enable=yes profile=any protocol=TCP localport=3389

• Deletes the "RDP" rule

netsh advdirewall firewall delete rule name="RDP" dir=in

Modifying Firewall Rules

• Display help for firewall rule modifications

netsh advfirewall firewall set /?

• Display help for modifying exiting firewall rules.

netsh advfirewall firewall set rule /?

• Modifies the "HTTP 80" rule to allow traffic on additional ports(80,80,82,83)

netsh advfirewall firewall set rule name="HTTP 80" new localport=80,81,82,83 action=allow

Managing Windows Firewall Using PowerShell

• List all firewall rules

get-netfirewall -all

• lists all firewall rules from the configurable service store

get-netfirewall -policystore configurableservice -all

Windows Defender Antivirus Management

Check Windows Defender status

• Checks the status o fwindows defender

sc query windefend

• Retrieves the configuration details of windows defender

sc qc windefend