{"id":17871,"date":"2010-07-03T00:01:00","date_gmt":"2010-07-03T00:01:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2010\/07\/03\/hey-scripting-guy-weekend-scripter-how-to-retrieve-enabled-windows-firewall-rules\/"},"modified":"2010-07-03T00:01:00","modified_gmt":"2010-07-03T00:01:00","slug":"hey-scripting-guy-weekend-scripter-how-to-retrieve-enabled-windows-firewall-rules","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/hey-scripting-guy-weekend-scripter-how-to-retrieve-enabled-windows-firewall-rules\/","title":{"rendered":"Hey, Scripting Guy! Weekend Scripter: How to Retrieve Enabled Windows Firewall Rules"},"content":{"rendered":"

 \nMicrosoft Scripting Guy Ed Wilson here. The Scripting Wife and I are getting ready to head up to the mountains in search of a bit of cool air. Even if it is hot up there, it will still be cool because we are meeting one of my old high school friends. Actually, all of my high school friends are old now, but that is another story. John was in one of my rock bands when we were in high school together. In fact, I taught him how to play the bass guitar. Now he is a microbiologist, and he is bringing his wife and daughter with him. It should be a nice weekend.\nWhile the Scripting Wife is packing, I thought I would work on a script that retrieves Windows Firewall<\/a> rules that are enabled on my laptop. Maybe it is because my friend John is a microbiologist and he works with viruses that the thought of working with the firewall jumped into my head.\nThe Windows Firewall is documented on MSDN, but many of the items of concern to people writing in Windows PowerShell<\/a> are not documented. This is not a problem. Using Windows PowerShell, we can discover much of the information that is needed. After the hnetcfg.fwpolicy2<\/strong> COM object is created and stored in the $fw<\/strong> variable, its members can be explored by the Get-Member<\/strong> cmdlet. This is shown here:\n <\/p>\n

$fw<\/span> <\/span>=<\/span> <\/span>New-Object<\/span> <\/span>-ComObject<\/span> <\/span>hnetcfg.fwpolicy2<\/span>
<\/span>$fw<\/span> <\/span>|<\/span> <\/span>Get-Member<\/span>
<\/span>TypeName:<\/span> <\/span>System.__ComObject<\/span>#<\/span>{98325047-c671-4174-8d81-defcd3f03186}<\/span>
<\/span>Name<\/span> <\/span>MemberType<\/span> <\/span>Definition<\/span>
<\/span>—-<\/span> <\/span>———-<\/span> <\/span>———-<\/span>
<\/span>EnableRuleGroup<\/span> <\/span>Method<\/span> <\/span>void<\/span> <\/span>EnableRuleGroup<\/span> <\/span>(int,<\/span> <\/span>string,<\/span> <\/span>bool)<\/span>
<\/span>IsRuleGroupEnabled<\/span> <\/span>Method<\/span> <\/span>bool<\/span> <\/span>IsRuleGroupEnabled<\/span> <\/span>(int,<\/span> <\/span>string)<\/span>
<\/span>RestoreLocalFirewallDefaults<\/span> <\/span>Method<\/span> <\/span>void<\/span> <\/span>RestoreLocalFirewallDefaults<\/span> <\/span>()<\/span>
<\/span>BlockAllInboundTraffic<\/span> <\/span>ParameterizedProperty<\/span> <\/span>bool<\/span> <\/span>BlockAllInboundTraffic<\/span> <\/span>(NET_FW_PROFI…<\/span>
<\/span>DefaultInboundAction<\/span> <\/span>ParameterizedProperty<\/span> <\/span>NET_FW_ACTION_<\/span> <\/span>DefaultInboundAction<\/span> <\/span>(NET_…<\/span>
<\/span>DefaultOutboundAction<\/span> <\/span>ParameterizedProperty<\/span> <\/span>NET_FW_ACTION_<\/span> <\/span>DefaultOutboundAction<\/span> <\/span>(NET…<\/span>
<\/span>ExcludedInterfaces<\/span> <\/span>ParameterizedProperty<\/span> <\/span>Variant<\/span> <\/span>ExcludedInterfaces<\/span> <\/span>(NET_FW_PROFIL…<\/span>
<\/span>FirewallEnabled<\/span> <\/span>ParameterizedProperty<\/span> <\/span>bool<\/span> <\/span>FirewallEnabled<\/span> <\/span>(NET_FW_PROFILE_TYPE…<\/span>
<\/span>IsRuleGroupCurrentlyEnabled<\/span> <\/span>ParameterizedProperty<\/span> <\/span>bool<\/span> <\/span>IsRuleGroupCurrentlyEnabled<\/span> <\/span>(string)…<\/span>
<\/span>NotificationsDisabled<\/span> <\/span>ParameterizedProperty<\/span> <\/span>bool<\/span> <\/span>NotificationsDisabled<\/span> <\/span>(NET_FW_PROFIL…<\/span>
<\/span>UnicastResponsesToMulticastBroadcastDisabled<\/span> <\/span>ParameterizedProperty<\/span> <\/span>bool<\/span>…<\/span>
<\/span>CurrentProfileTypes<\/span> <\/span>Property<\/span> <\/span>int<\/span> <\/span>CurrentProfileTypes<\/span> <\/span>()<\/span> <\/span>{get}<\/span>
<\/span>LocalPolicyModifyState<\/span> <\/span>Property<\/span> <\/span>NET_FW_MODIFY_STATE_<\/span> <\/span>LocalPolicyModifySta…<\/span>
<\/span>Rules<\/span> <\/span>Property<\/span> <\/span>INetFwRules<\/span> <\/span>Rules<\/span> <\/span>()<\/span> <\/span>{get}<\/span>
<\/span>ServiceRestriction<\/span> <\/span>Property<\/span> <\/span>INetFwServiceRestriction<\/span> <\/span>ServiceRestricti…<\/span>  <\/div>\n

To retrieve the rules, all I need to do is query the Rules<\/strong> property. This is shown here:\nPS<\/span> <\/span>C:Usersed.NWTRADERS><\/span> <\/span>$fw<\/span> <\/span>=<\/span> <\/span>New-Object<\/span> <\/span>-ComObject<\/span> <\/span>hnetcfg.fwpolicy2<\/span>
<\/span>$fw<\/span>.rules<\/span>
<\/span>Name<\/span> <\/span>:<\/span> <\/span>Zune<\/span> <\/span>Network<\/span> <\/span>Sharing<\/span> <\/span>Service<\/span> <\/span>(UPnPHost-Out)<\/span>
<\/span>Description<\/span> <\/span>:<\/span> <\/span>Outbound<\/span> <\/span>rule<\/span> <\/span>for<\/span> <\/span>the<\/span> <\/span>Zune<\/span> <\/span>Network<\/span> <\/span>Sharing<\/span> <\/span>Service<\/span> <\/span>to<\/span> <\/span>allow<\/span> <\/span>use<\/span> <\/span>of<\/span> <\/span>Universal<\/span> <\/span>Plug<\/span> <\/span>and<\/span> <\/span>Play.<\/span> <\/span>[TCP]<\/span>
<\/span>ApplicationName<\/span> <\/span>:<\/span> <\/span>C:Windowssystem32svchost.exe<\/span>
<\/span>serviceName<\/span> <\/span>:<\/span> <\/span>upnphost<\/span>
<\/span>Protocol<\/span> <\/span>:<\/span> <\/span>6<\/span>
<\/span>LocalPorts<\/span> <\/span>:<\/span> <\/span>*<\/span>
<\/span>RemotePorts<\/span> <\/span>:<\/span> <\/span>*<\/span>
<\/span>LocalAddresses<\/span> <\/span>:<\/span> <\/span>*<\/span>
<\/span>RemoteAddresses<\/span> <\/span>:<\/span> <\/span>LocalSubnet<\/span>
<\/span>IcmpTypesAndCodes<\/span> <\/span>:<\/span> 
<\/span>Direction<\/span> <\/span>:<\/span> <\/span>2<\/span>
<\/span>Interfaces<\/span> <\/span>:<\/span> 
<\/span>InterfaceTypes<\/span> <\/span>:<\/span> <\/span>All<\/span>
<\/span>Enabled<\/span> <\/span>:<\/span> <\/span>False<\/span>
<\/span>Grouping<\/span> <\/span>:<\/span> <\/span>@e:Program<\/span> <\/span>Fileszuneresources.dll,-270<\/span>
<\/span>Profiles<\/span> <\/span>:<\/span> <\/span>7<\/span>
<\/span>EdgeTraversal<\/span> <\/span>:<\/span> <\/span>False<\/span>
<\/span>Action<\/span> <\/span>:<\/span> <\/span>1<\/span>
<\/span>EdgeTraversalOptions<\/span> <\/span>:<\/span> <\/span>0<\/span> <\/p>\n

<\/span><output<\/span> <\/span>truncated><\/span>
<\/span>\nThe output goes on and on and on. One thing I noticed is that there is an Enabled<\/strong> property returned for the Rule<\/strong> object. Therefore, filtering for enabled rules will reduce the output. In addition, I am primarily concerned with the protocol, the port, the direction, and of course the name of the rule. A table will be a nice way to display that information. The revised script is shown here.\nDisplayEnabledFirewallRules.ps1<\/strong>\n$fw<\/span> <\/span>=<\/span> <\/span>New-Object<\/span> <\/span>-ComObject<\/span> <\/span>hnetcfg.fwpolicy2<\/span> <\/p>\n

<\/span>$fw<\/span>.rules<\/span> <\/span>|<\/span> <\/p>\n

<\/span>Where-Object<\/span> <\/span>{<\/span> <\/span>$_<\/span>.enabled<\/span> <\/span>}<\/span> <\/span>|<\/span> <\/p>\n

<\/span>Sort-Object<\/span> <\/span>-Property<\/span> <\/span>direction<\/span> <\/span>|<\/span> <\/p>\n

<\/span>Format-Table<\/span> <\/span>-Property<\/span> <\/span>direction,<\/span> <\/span>protocol,<\/span> <\/span>localports,<\/span> <\/span>name<\/span> <\/span>-AutoSize<\/span> <\/span>-Wrap<\/span>\n \nWhen the DisplayEnabledFirewallRules.ps1 script runs, the output shown in the following image is displayed.\n\"Image<\/a>\n \nIf you want to know exactly what we will be looking at tomorrow, follow us on Twitter<\/a> or Facebook<\/a>. If you have any questions, send e-mail to us at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.\n \nEd Wilson and Craig Liebendorfer, Scripting Guys<\/strong><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

  Microsoft Scripting Guy Ed Wilson here. The Scripting Wife and I are getting ready to head up to the mountains in search of a bit of cool air. Even if it is hot up there, it will still be cool because we are meeting one of my old high school friends. Actually, all of […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[161,3,63,61,45],"class_list":["post-17871","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-firewall","tag-scripting-guy","tag-security","tag-weekend-scripter","tag-windows-powershell"],"acf":[],"blog_post_summary":"

  Microsoft Scripting Guy Ed Wilson here. The Scripting Wife and I are getting ready to head up to the mountains in search of a bit of cool air. Even if it is hot up there, it will still be cool because we are meeting one of my old high school friends. Actually, all of […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17871","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=17871"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/17871\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=17871"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=17871"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=17871"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}