CmdID / Commands / netsh

netsh advfirewall

The netsh advfirewall command configures and manages the Windows Firewall with Advanced Security utility. Windows commands reference

On Windows

Windows

from the Windows commands reference, CC BY 4.0

The netsh advfirewall command configures and manages the Windows Firewall with Advanced Security utility. This tool allows administrators to configure firewall rules, security policies, and monitor various aspects of the firewall's behavior. --- --- --- ---

netsh advfirewall consec | dump | export | firewall | help | import | mainmode | monitor | reset | set | show | ?

netsh advfirewall [consec | firewall | mainmode] <add> <delete> <dump> <help> <set> <show> <?>

netsh advfirewall [monitor] <delete> <dump> <help> <show> <?>

netsh advfirewall export <path\filename>

netsh advfirewall import <path\filename>

netsh advfirewall reset [export <path\filename>]

netsh advfirewall set [allprofiles | currentprofile | domainprofile | privateprofile | publicprofile] state <on> <off> <notconfigured>

netsh advfirewall set firewallpolicy <blockinbound> <blockinboundalways> <allowinbound> <allowoutbound> <blockoutbound> <notconfigured>

netsh advfirewall set settings <localfirewallrules> <localconsecrules> <inboundusernotification> <remotemanagement> <unicastresponsetomulticast>

netsh advfirewall set logging <allowedconnections> <droppedconnections> <filename> <maxfilesize>

netsh advfirewall set global [statefulftp | statefulpptp] <enable> <disable> <notconfigured>

netsh advfirewall set global ipsec [strongcrlcheck <value>] [saidletimemin <value>] [defaultexemptions <value>] [ipsecthroughnat <value>] [authzcomputergrp <value>] [authzusergrp <value>]

To add a connection security rule requiring authentication, run the following command

netsh advfirewall consec add rule name="RequireAuth" endpoint1=any endpoint2=any action=requireinrequestoutIdentify

To add a new connection security rule that uses Kerberos for authentication, run the following command

netsh advfirewall consec add rule name="KerberosAuthRule" endpoint1=any endpoint2=any action=requireinrequireout auth1=computerkerb

Identify

To delete a connection security rule by its name, run the following command

netsh advfirewall consec delete rule name="RuleName"Identify

Trips 1 Sigma rule: mediumFirewall Rule Deleted Via Netsh.EXE by frack113

To save the current advanced firewall configuration to a text file, run the following command

netsh advfirewall dump > "C:\path\to\firewall_dump.txt"Identify

To display the current firewall configuration in CMD, run the following command

netsh advfirewall dumpIdentify

To include the advanced firewall state in the main dump for diagnostics, run the following command

netsh advfirewall dump | findstr "State"Identify

To export the current firewall policy for backup, run the following command

netsh advfirewall export "C:\folder\firewall_backup.wfw"Identify

To add a rule allowing inbound traffic on port 8080, run the following command

netsh advfirewall firewall add rule name="Allow8080" protocol=TCP dir=in localport=8080 action=allowIdentify

Trips 1 Sigma rule: mediumNew Firewall Rule Added Via Netsh.EXE by Markus Neis, Sander Wiebing

To block outgoing traffic to a specific IP, run the following command

netsh advfirewall firewall add rule name="BlockOutIP" protocol=TCP dir=out remoteip=192.168.1.100 action=blockIdentify

Trips 1 Sigma rule: mediumNew Firewall Rule Added Via Netsh.EXE by Markus Neis, Sander Wiebing

To remove a specific firewall rule by name, run the following command

netsh advfirewall firewall delete rule name="MyRule"Identify

Trips 1 Sigma rule: mediumFirewall Rule Deleted Via Netsh.EXE by frack113

To get help for all firewall commands, run the following command

netsh advfirewall firewall ?Identify

To find out syntax details for adding a firewall rule, run the following command

netsh advfirewall firewall add rule ?Identify

Trips 1 Sigma rule: mediumNew Firewall Rule Added Via Netsh.EXE by Markus Neis, Sander Wiebing

Show 15 options

consec <add> <delete> <help> <set> <show> rule name=<string> consec <dump>Switches to the netsh advfirewall consec context to configure connection security rules. - add - Adds a new connection security rule. - delete - Deletes all matching connection security rules. - dump - Displays a configuration script. - help - Displays a list of commands. - set - Sets new values for properties of an existing rule. - show - Displays a specified connection security rule.

dumpDisplays a configuration script that can be used to restore the current configuration.

export <path\filename>Exports the current firewall policy settings to a specified file.

firewall <add> <delete> <help> <set> <show> rule name=<string> firewall <dump>Switches to the netsh advfirewall firewall context to configure firewall rules. - add - Adds a new inbound or outbound firewall rule. - delete - Deletes all matching firewall rules. - dump - Displays a configuration script. - help - Displays a list of commands. - set - Sets new values for properties of an existing rule. - show - Displays a specified firewall rule.

help or ?Displays a list of commands and their descriptions in the current context.

import <path\filename>Imports firewall policy settings from a specified file into the current policy store.

mainmode <add> <delete> <help> <set> <show> rule name=<string> mainmode <dump>Switches to the netsh advfirewall mainmode context to configure main mode settings. - add - Adds a new mainmode rule. - delete - Deletes all matching mainmode rules. - dump - Displays a configuration script. - help - Displays a list of commands. - set - Sets new values for properties of an existing rule. - show - Displays a specified mainmode rule.

monitor delete mmsa \qmsa <source destination \ all> monitor <help> monitor show <consec> <currentprofile> <firewall> <mainmode> <mmsa> <qmsa> monitor <dump> Switches to the netsh advfirewall monitor context to display monitoring information. - delete - Deletes all matching security associations. The source destination is one or more IP addresses. All specifies that the operation should apply to all entries. - dump - Displays a configuration script. - help - Displays a list of commands. - show - Shows the runtime Firewall policy settings: - consec displays current consec state information. - currentprofile displays the currently active profiles. - firewall displays current firewall state information. - mainmode displays current mainmode state information. - mmsa displays the main mode SAs. - qmsa displays the quick mode SAs.

reset <export path\filename>Resets the Windows Defender Firewall with Advanced Security policies to the default settings. The current active policy can be optionally exported to a specified file. In a Group Policy object, this command returns all settings to notconfigured and deletes all connection security and firewall rules.

set allprofiles \currentprofile \ domainprofile \ privateprofile \ publicprofile \ parameter <value> Configures per-profile or global settings for the firewall. - allprofiles - Sets properties in all profiles. - currentprofile - Sets properties in the active profile. - domainprofile - Sets properties in the domain profile. - global - Sets the global properties. - privateprofile - Sets properties in the private profile. - publicprofile - Sets properties in the public profile. The notconfigured value is valid only for a Group Policy store. The available parameter and <value> are as follows: state - Configures the firewall state. - <on> - Enables the firewall. When the firewall is on, it actively filters network traffic based on the configured rules. - <off> - Disables the firewall. No filtering or protection is applied, and all network traffic is allowed. - <notconfigured> - sets the firewall state to its default configuration as per the system policy or administrative template settings. firewallpolicy - Configures the default inbound and outbound behavior. - <blockinbound> - Blocks inbound connections that don't match an inbound rule. …

set global [statefulftp | statefulpptp] <enable> <disable> <notconfigured>Configures the global settings including advanced IPsec options. The use of DES, MD5, and DHGroup1 isn't recommended. These cryptographic algorithms are provided for backward compatibility only. The mmsecmethods keyword default sets the policy to dhgroup2-aes128-sha1,dhgroup2-3des-sha1 statefulftp - This option controls the firewall's behavior regarding FTP (File Transfer Protocol) traffic. statefulpptp - This option manages the handling of PPTP (Point-to-Point Tunneling Protocol) traffic. <enable> - Activates stateful inspection for the selected protocol. This ensures that the firewall can dynamically adjust rules to correctly handle corresponding traffic. <disable> - Deactivates stateful inspection for the selected protocol. This might lead to issues with correctly handling protocol-specific traffic as the firewall doesn't dynamically adjust its rules. <notconfigured> - Resets the setting to the default behavior as determined by the system's policy or configuration. This allows the system to apply its default rules without user-specified changes.

set global ipsec parameter <value>strongcrlcheck - Configures the enforcement level of Certificate Revocation List (CRL) checking. <0> - Disables CRL checking (default setting). <1> - Fails the connection if the certificate is revoked. <2> - Fails the connection on any CRL-related error. <notconfigured> - Resets the value to the not configured state. saidletimemin - Sets the idle time in minutes for a Security Association (SA) before it's considered inactive. Acceptable values range from 5 to 60 minutes. <notconfigured> - Defaults to 5 minutes. defaultexemptions - Manages default protocols exempted from IPsec protection. The default is to exempt IPv6 neighbordiscovery protocol and DHCP from IPsec. Acceptable values include: <none> <neighbordiscovery> <icmp> <dhcp> <notconfigured> ipsecthroughnat - Configures the conditions under which IPsec can establish security associations with devices behind a Network Address Translator (NAT). Acceptable values include: <never> - Associations aren't permitted (default). <serverbehindnat> - Only if the server is behind a NAT. <serverandclientbehindnat> - If both the server and client are behind a NAT. <notconfigured> - Defaults to <never>. …

set global mainmode parameter <value> \<notconfigured> mmkeylifetime - Sets the duration for which the keys in Main Mode are valid. Key lifetime is defined by time in minutes [<num> min], number of sessions [<num> sess], or both. The minimum lifetime of the keys in minutes range from 1 minute and maximum of 2880 minutes. The minimum number of sessions for which the keys are valid range from 0 sessions to a maximum of 2,147,483,647 sessions. mmsecmethods - Configures the list of security proposals for the Main Mode IPsec negotiations, which includes key exchange, encryption, and integrity algorithms. You can use a comma-separated list of proposals in the format keyexch:enc-integrity. Each proposal consists of a set of algorithms from each category. - keyexch: Specifies the Diffie-Hellman (DH) or Elliptic Curve Diffie-Hellman groups used for the key exchange. Acceptable values are: <dhgroup1> <dhgroup2> <dhgroup14> <dhgroup24> <ecdhp256> <ecdhp384> - enc: Specifies the encryption algorithm used for securing the data. Acceptable values are: <3des> <des> <aes128> <aes192> <aes256> - integrity: Specifies the algorithm used to ensure the data integrity. Acceptable values are: <md5> <sha1> <sha256> <sha384> …

show allprofiles \currentprofile \ domainprofile \ privateprofile \ publicprofile \ parameter Displays the current profile or global properties for the firewall. - allprofiles - Displays the properties for all profiles. - currentprofile - Displays the properties for the active profile. - domainprofile - Displays the properties in the domain profile. - global - Displays the global properties. - privateprofile - Displays the properties for the private profile. - publicprofile - Displays the properties for the public profile. - store - Displays the current policy store. If a parameter isn't specified for the profiles, all properties are displayed. The available parameters are as follows: state: Displays whether the Windows Defender Firewall with Advanced Security is currently enabled or disabled for each profile. firewallpolicy: Shows the default actions for inbound and outbound connections, indicating whether such connections are allowed or blocked by default for each profile. settings: Provides detailed properties of the firewall, including configuration settings for each profile. …

show global parameterDisplays the global settings for Windows Defender Firewall with Advanced Security. If no parameter is specified, all properties are displayed. The available parameters are as follows: ipsec: Displays the specific IPsec settings. statefulftp: Displays the configuration for Stateful FTP support. statefulpptp: Shows the configuration for Stateful PPTP support. mainmode: Displays the configuration for Main Mode, a phase in the IPsec negotiation process where both parties authenticate each other and establish a secure channel for further communication. categories: Displays the configuration related to Firewall Categories.