> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/windows/essential-commands/firewall-management.md).

# Firewall Management

### `netsh advfirewall` – Firewall Control via Command Line

**Syntax:**

```cmd
netsh advfirewall <context> <action> [parameters]
```

***

**Check Firewall Status**

* Check current profile status:

  ```cmd
  netsh advfirewall show currentprofile
  ```
* Check all profiles (Domain, Private, Public):

  ```cmd
  netsh advfirewall show allprofiles
  ```

***

**Enable or Disable Firewall**

* Enable all profiles:

  ```cmd
  netsh advfirewall set allprofiles state on
  ```
* Enable current profile only:

  ```cmd
  netsh advfirewall set currentprofile state on
  ```
* Disable all profiles:

  ```cmd
  netsh advfirewall set allprofiles state off
  ```
* Disable current profile only:

  ```cmd
  netsh advfirewall set currentprofile state off
  ```

***

**Manage Application Rules**

* Allow a program through the firewall:

  ```cmd
  netsh advfirewall firewall add rule name="Example Rule" dir=in action=allow program="C:\Path\to\YourProgram.exe" enable=yes
  ```
* Disable a program rule:

  ```cmd
  netsh advfirewall firewall add rule name="Example Rule" dir=in action=allow program="C:\Path\to\YourProgram.exe" enable=no
  ```
* View a specific rule:

  ```cmd
  netsh advfirewall firewall show rule name="Example Rule"
  ```

***

**Create Port-Based Rules**

* Allow inbound TCP on port 8080:

  ```cmd
  netsh advfirewall firewall add rule name="port-allow" dir=in action=allow protocol=TCP localport=8080
  ```

***

**Delete Firewall Rules**

* Delete a specific rule:

  ```cmd
  netsh advfirewall firewall delete rule name="Example Rule"
  ```

***

**View Enabled/Disabled Rules**

* Show all enabled rules:

  ```cmd
  netsh advfirewall firewall show rule name=all status=enabled
  ```
* Show all disabled rules:

  ```cmd
  netsh advfirewall firewall show rule name=all status=disabled
  ```
* Show all rules (enabled and disabled):

  ```cmd
  netsh advfirewall firewall show rule name=all
  ```

***

### PowerShell – Firewall Control with Cmdlets

**Syntax:**

```powershell
<cmdlet> -Parameter <Value>
```

***

**Check Firewall Status**

* Check current profile status:

  ```powershell
  Get-NetFirewallProfile
  ```
* Check all profiles:

  ```powershell
  Get-NetFirewallProfile -All
  ```

***

**Enable or Disable Firewall**

* Enable firewall on all profiles:

  ```powershell
  Set-NetFirewallProfile -All -Enabled True
  ```
* Enable on specific profiles:

  ```powershell
  Set-NetFirewallProfile -Profile Private,Public,Domain -Enabled True
  ```
* Disable firewall on all profiles:

  ```powershell
  Set-NetFirewallProfile -All -Enabled False
  ```
* Disable on specific profiles:

  ```powershell
  Set-NetFirewallProfile -Profile Private,Public,Domain -Enabled False
  ```

***

**Create Port-Based Rules**

* Create an inbound rule for TCP port 8080:

  ```powershell
  New-NetFirewallRule -Name "Port-8080-Inbound" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 8080
  ```

***

**Delete Firewall Rules**

* Remove a specific rule:

  ```powershell
  Remove-NetFirewallRule -Name "Example Rule"
  ```

***

**View Enabled/Disabled Rules**

* List all enabled rules:

  ```powershell
  Get-NetFirewallRule | Where-Object { $_.Enabled -eq "True" }
  ```
* List all disabled rules:

  ```powershell
  Get-NetFirewallRule | Where-Object { $_.Enabled -eq "False" }
  ```
* Show all rules (enabled and disabled):

  ```powershell
  Get-NetFirewallRule
  ```