> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/evasion/evading-firewalls/windows-firewall.md). # Windows Firewall ## Disable the local firewall The operation requires elevation (Run as administrator). ### Via netsh.exe To disable the current firewall profile ```batch netsh advfirewall set currentprofile state off ``` To disable all firewall profiles ```batch netsh advfirewall set allprofiles state off ``` ### Via PowerShell To disable the local firewall (all profiles) ```powershell Set-NetFirewallProfile -Enabled False ``` To disable a specific profile (Domain, Private, or Public) ```powershell Set-NetFirewallProfile -Profile Private -Enabled False ``` ## Add firewall rules ### Via netsh.exe To add an incoming allow rule for port 2222 ```bat netsh advfirewall firewall add rule name="allow_ssh_2222" protocol=TCP dir=in localip=192.168.50.64 localport=2222 action=allow ``` To delete the rule after use ```bat netsh advfirewall firewall delete rule name="allow_ssh_2222" ``` ## List local firewall profile information ### Via netsh.exe To list information about the current firewall profile ```batch netsh.exe adv show currentprofile ``` To list general information about the firewall profiles ```batch netsh.exe adv show allprofiles ``` ### Via PowerShell To get the current firewall profile ```powershell Get-NetFirewallSetting -PolicyStore ActiveStore | Select-Object -ExpandProperty ActiveProfile ``` To list general information about the all firewall profiles ```powershell Get-NetFirewallProfile ``` To list information about a specific firewall profile (i.e. Domain, Private or Public) ```powershell Get-NetFirewallProfile -Name Private ``` ## List local firewall rules ### Via netsh.exe These commands does **NOT require** an elevated session! To list all local firewall rules ```batch netsh.exe adv firewall show rule name=all ``` To list all local firewall rules in verbose mode. The verbose mode include description, program and service. ```batch netsh.exe adv firewall show rule name=all verbose ``` To list all **inbound** local firewall rules ```batch netsh.exe adv firewall show rule name=all dir=in ``` To list specific firewall rule(s) by name ```batch netsh.exe adv firewall show rule name="SNMP Trap Service (UDP In)" verbose ``` ### Via PowerShell All these commands requires an **elevated PowerShell** session! To list all local firewall rules ```powershell Get-NetFirewallRule ``` To list all blocking firewall rules ```powershell Get-NetFirewallRule -Action Block ``` To list all inbound Allow rules ```powershell Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True ``` To list all outbound Allow rules ```powershell Get-NetFirewallRule -Direction Outbound -Action Allow -Enabled True ``` To list specific firewall rule(s) by display name. Note that display name ≠ name. ```powershell Get-NetFirewallRule -DisplayName 'discord.exe' ``` To list firewalls on a specific port, in this case 22 (ssh) ```powershell Get-NetFirewallPortFilter | Where-Object LocalPort -eq 22 | Get-NetFirewallRule ``` ## Resources **Get-NetFirewallPortFilter** - Microsoft Learn: **Get-NetFirewallProfile** - Microsoft Learn: **Set-NetFirewallProfile** - Microsoft Learn: **Get-NetFirewallRule** - Microsoft Learn: **netsh** - Microsoft Learn: **Netsh AdvFirewall** Firewall Commands - Microsoft Learn: **Netsh** Command Reference - Microsoft Learn: