PowerShell Firewall Rules: View and Manage with Get-NetFirewallRule
─□✕

PowerShell Firewall Rules: View and Manage with Get-NetFirewallRule

PowerShell Tips Editor 4 min read
PowerShell Firewall Rules: View and Manage with Get-NetFirewallRule

Opening port 443 on 50 servers for a new application rollout — or blocking an outbound connection from a compromised service — is the kind of task that should take one script run, not 50 Remote Desktop sessions. PowerShell firewall rules are managed through the NetSecurity module, which provides Get-NetFirewallRule, New-NetFirewallRule, Set-NetFirewallRule, and related cmdlets for complete control over Windows Firewall without touching the GUI.

List All Firewall Rules

Get-NetFirewallRule returns every rule in Windows Firewall — there are typically hundreds. Pipe through Select-Object to get the properties you care about. Note that port details are stored in a linked PortFilter object, not directly on the rule.

# List all rules with basic properties
Get-NetFirewallRule | Select-Object Name, DisplayName, Direction, Action, Enabled |
    Format-Table -AutoSize
# Get port details for each rule (joins PortFilter)
Get-NetFirewallRule | Get-NetFirewallPortFilter |
    Select-Object @{ N="RuleName"; E={ $_.InstanceID } }, Protocol, LocalPort, RemotePort

Filter Enabled Inbound Rules

Focus on what matters: inbound Allow rules that are currently enabled. This is your attack surface overview.

Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True |
    Select-Object DisplayName, Profile, @{ N="Ports"; E={ ($_ | Get-NetFirewallPortFilter).LocalPort } } |
    Format-Table -AutoSize

Filter by display name using wildcards to find rules related to a specific application:

Get-NetFirewallRule -DisplayName "*Remote Desktop*" | Select-Object DisplayName, Enabled, Direction, Action

Create a New Inbound Rule

Use New-NetFirewallRule to open a port. Always specify the -Profile parameter — rules without a profile apply to all profiles (Domain, Private, Public), which may be overly permissive. Requires administrator rights.

# Open TCP port 8080 for inbound connections (Domain and Private profiles only)
New-NetFirewallRule `
    -DisplayName "Allow App Port 8080 Inbound" `
    -Name "App-8080-Inbound" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 8080 `
    -Action Allow `
    -Profile Domain, Private `
    -Enabled True
# Allow inbound on a range of ports
New-NetFirewallRule `
    -DisplayName "Allow App Range 8080-8090" `
    -Name "App-8080-8090-Inbound" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 8080-8090 `
    -Action Allow `
    -Profile Domain `
    -Enabled True

Block an Outbound Application

Block a specific executable from making outbound connections. This is useful for preventing data exfiltration from a compromised application or restricting a tool to internal use only.

New-NetFirewallRule `
    -DisplayName "Block Telnet Outbound" `
    -Name "Block-Telnet-Outbound" `
    -Direction Outbound `
    -Program "C:\Windows\System32\telnet.exe" `
    -Action Block `
    -Profile Any `
    -Enabled True

Disable and Delete Rules

Disable a rule to temporarily stop it without deleting it. Delete it entirely with Remove-NetFirewallRule. Use the -Name parameter (the internal name) rather than -DisplayName for precise targeting — display names can contain wildcards accidentally.

# Disable a rule
Set-NetFirewallRule -Name "App-8080-Inbound" -Enabled False

# Re-enable
Set-NetFirewallRule -Name "App-8080-Inbound" -Enabled True

# Delete permanently
Remove-NetFirewallRule -Name "App-8080-Inbound" -Confirm:$false

Export Rules to CSV

Export firewall rules to CSV for documentation, auditing, or comparison across machines. Joining the port filter data requires a loop since Get-NetFirewallPortFilter works per rule.

$rules = Get-NetFirewallRule | Where-Object Enabled -eq "True"

$export = foreach ($rule in $rules) {
    $portFilter = $rule | Get-NetFirewallPortFilter
    [PSCustomObject]@{
        Name        = $rule.Name
        DisplayName = $rule.DisplayName
        Direction   = $rule.Direction
        Action      = $rule.Action
        Profile     = $rule.Profile
        Protocol    = $portFilter.Protocol
        LocalPort   = $portFilter.LocalPort
        RemotePort  = $portFilter.RemotePort
    }
}

$export | Export-Csv -Path "C:\Logs\firewall-rules-$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
Write-Output "Exported $($export.Count) rules."

Common Errors and Fixes

  • Requires admin to create or modify rules: All write operations against Windows Firewall — New-NetFirewallRule, Set-NetFirewallRule, Remove-NetFirewallRule — require an elevated session. Read operations like Get-NetFirewallRule work without elevation. When deploying rules to remote machines, use Invoke-Command with an admin credential.
  • Profile parameter often missed: Omitting -Profile creates a rule that applies to all three profiles (Domain, Private, Public). On laptops that roam between corporate Wi-Fi and public networks, this can be a security gap. Always explicitly specify the profile. Use Domain for corporate policy, Domain, Private for internal services, and Any only when truly needed.

Related Cmdlets / See Also

Wrapping Up

The NetSecurity module gives you complete, scriptable control over Windows Firewall — no GUI needed. As a next step, use Invoke-Command to deploy a new firewall rule across your entire server fleet simultaneously, verifying the result with Get-NetFirewallRule on each machine in the same script run.

#firewall#get-netfirewallrule#network#security
Send-Item -To