windows defender firewall cheat sheet

windows defender firewall cheat sheet

==========================================================================================================
Firewall.cpl            Windows Firewall
WF.msc                        Windows Firewall with Advanced Security
==========================================================================================================
#Bard

This command will return a table with the profile name, the status of the Windows Defender Firewall for the profile, and the name of the profile
Get-NetFirewallProfile | Select-Object -Property ProfileName, Enabled, Name

If you want to check the status of the Windows Defender Firewall for a specific profile
Get-NetFirewallProfile -Name <profile_name> | Select-Object -Property Enabled, Name
Get-NetFirewallProfile -Name Private | Select-Object -Property Enabled, Name

check whether or not the teams application is allowed on Windows Defender Firewall:
Get-NetFirewallRule -Name *teams* | Select-Object -Property Name,Enabled,Profile

Get-NetFirewallRule -Name *gotomeeting* -Profile Domain | Select-Object -Property Enabled
==========================================================================================================
If the command Get-NetFirewallRule -Name *gotomeeting* | Select-Object -Property Enabled returns nothing, it means that there are no firewall rules with names containing "gotomeeting" on the system. Since there are no specific firewall rules for GoToMeeting, we cannot determine from this command alone whether GoToMeeting is allowed or not.

The absence of a specific firewall rule for GoToMeeting does not necessarily mean that GoToMeeting is allowed or blocked by the firewall. The behavior of the firewall depends on its default settings and any other existing rules that may affect network traffic.

In a typical scenario, if there are no specific firewall rules for an application like GoToMeeting, it is more likely that the default behavior of the firewall will be applied. This means that GoToMeeting's network traffic will be subject to the default firewall rules, which could allow or block certain types of connections.

To conclusively determine if GoToMeeting is allowed or blocked by the firewall, you would need to check the overall firewall settings and rules, not just the ones specifically named with "gotomeeting." Additionally, you might need to consult the system administrator or refer to the firewall's documentation to understand the exact rules and policies in place.

==========================================================================================================
#start or stop Windows Defender Firewall

Method 1: Using the Windows Security App

    Click on the Windows Start button and type "Windows Security" in the search bar.
    Click on the "Windows Security" app that appears in the search results.
    In the Windows Security app, click on "Firewall & network protection".
    Click on the "Manage settings" link under "Windows Defender Firewall".
    If you want to stop Windows Defender Firewall, click on the toggle switch next to "Windows Defender Firewall" to turn it off. If you want to start it again, click on the same toggle switch to turn it back on.

Method 2: Using the Command Prompt

    Click on the Windows Start button and type "cmd" in the search bar.

    Right-click on "Command Prompt" and select "Run as administrator".    
netsh advfirewall set allprofiles state off
netsh advfirewall set allprofiles state on
==========================================================================================================
At the command prompt, type netstat -ano > netstat.txt, and then press Enter.
At the command prompt, type tasklist > tasklist.txt, and then press Ente
If you want to create a text file for services rather than programs, at the command prompt, type tasklist /svc > tasklist.txt.
Open the tasklist.txt and the netstat.txt files.
In the tasklist.txt file, write down the Process Identifier (PID) for the process you are troubleshooting.
Compare the PID with that in the Netstat.txt file
Write down the protocol that is used. 
The information about the protocol used can be useful when reviewing the information in the firewall log file.

==========================================================================================================
#Enable Windows Defender Firewall with Advanced Security

netsh advfirewall set allprofiles state on

PowerShell
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
==========================================================================================================
netsh advfirewall set allprofiles firewallpolicy blockinbound,allowoutbound
netsh advfirewall set allprofiles settings inboundusernotification enable
netsh advfirewall set allprofiles settings unicastresponsetomulticast enable
netsh advfirewall set allprofiles logging filename %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log

Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow –NotifyOnListen True -AllowUnicastResponseToMulticast True –LogFileName %SystemRoot%\System32\LogFiles\Firewall\pfirewall.log
==========================================================================================================
#Disable Windows Defender Firewall with Advanced Security

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False 
==========================================================================================================
#Create firewall rules
netsh advfirewall firewall add rule name="Allow Inbound Telnet" dir=in program= %SystemRoot%\System32\tlntsvr.exe remoteip=localsubnet action=allow

PowerShell
New-NetFirewallRule -DisplayName “Allow Inbound Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow
==========================================================================================================
 #add a basic firewall rule that blocks outbound traffic from a specific application and local port to a Group Policy Object (GPO) in Active Directory.
 
netsh advfirewall set store gpo=domain.contoso.com\gpo_name
netsh advfirewall firewall add rule name="Block Outbound Telnet" dir=out program=%SystemRoot%\System32\telnet.exe protocol=tcp localport=23 action=block

PowerShell
New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe –Protocol TCP –LocalPort 23 -Action Block –PolicyStore domain.contoso.com\gpo_name

#reduce the burden on busy domain controllers, Windows PowerShell allows you to load a GPO to your local session
$gpo = Open-NetGPO –PolicyStore domain.contoso.com\gpo_name
New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\telnet.exe –Protocol TCP –LocalPort 23 -Action Block –GPOSession $gpo
Save-NetGPO –GPOSession $gpo

#change the remote endpoint of the Allow Web 80 rule
Get-NetFirewallPortFilter | ?{$_.LocalPort -eq 80} | Get-NetFirewallRule | ?{ $_.Direction –eq “Inbound” -and $_.Action –eq “Allow”} | Set-NetFirewallRule -RemoteAddress 192.168.0.2

#returns an array of firewall rules associated with a particular program
Get-NetFirewallApplicationFilter -Program "*svchost*" | Get-NetFirewallRule

#add both inbound and outbound Telnet firewall rules to the group Telnet Management
New-NetFirewallRule -DisplayName “Allow Inbound Telnet” -Direction Inbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow –Group “Telnet Management”
New-NetFirewallRule -DisplayName “Block Outbound Telnet” -Direction Outbound -Program %SystemRoot%\System32\tlntsvr.exe -RemoteAddress LocalSubnet -Action Allow –Group “Telnet Management”

#the rule can be added to the rule group using dot notation
$rule = Get-NetFirewallRule -DisplayName “Allow Inbound Telnet”
$rule.Group = “Telnet Management”
$rule | Set-NetFirewallRule

#enables all rules in a predefined group containing remote management influencing firewall rules.
netsh advfirewall firewall set rule group="Windows Defender Firewall remote management" new enable=yes

Powershell
Set-NetFirewallRule -DisplayGroup “Windows Defender Firewall Remote Management” –Enabled True

#enabling rules by group or by other properties of the rule.
Enable-NetFirewallRule -DisplayGroup “Windows Defender Firewall Remote Management” -Verbose

#Delete a firewall rule

netsh advfirewall firewall delete rule name=“Allow Web 80”

Remove-NetFirewallRule –DisplayName “Allow Web 80”

Remove-NetFirewallRule –Action Block #all blocking firewall rules are deleted from the device.

#may be safer to query the rules with the Get command and save it in a variable, 
#observe the rules to be affected, then pipe them to the Remove command
#view all the blocking firewall rules, and then delete the first four rules.
$x = Get-NetFirewallRule –Action Block
$x
$x[0-3] | Remove-NetFirewallRule


#Manage remotely,Remote management using WinRM is enabled by default

Get-NetFirewallRule –CimSession RemoteDevice #returns all firewall rules of the persistent store on a device named RemoteDevice

# remove a specific firewall rule from a remote device.
$RemoteSession = New-CimSession –ComputerName RemoteDevice
Remove-NetFirewallRule –DisplayName “AllowWeb80” –CimSession $RemoteSession -Confirm
==========================================================================================================
#Modify an existing firewall rule

netsh advfirewall firewall set rule name="Allow Web 80" new remoteip=192.168.0.2

PowerShell
Set-NetFirewallRule –DisplayName “Allow Web 80” -RemoteAddress 192.168.0.2
==========================================================================================================
#check Windows Firewall configuration



netsh firewall show config

netsh advfirewall firewall set rule group="Remote Administration" new enable=yes
netsh firewall set service type=remoteadmin mode=enable #create Remote Administration group
netsh advfirewall firewall set rule group="remote administration" new enable=yes #update firewall rules
==========================================================================================================

==========================================================================================================
#Step 1: Open firewall ports in Windows firewall
"c:\psexec \\remote_machine_name cmd" #get command line access for that remote box
"netsh advfirewall set currentprofile state off" #disable/stop the firewall
"netsh advfirewall firewall set rule group=”remote desktop” new enable=Yes" #allow only Remote Desktop while still leaving the rest of the firewall as is
==========================================================================================================
# troubleshooting Windows Firewall Is Blocking a Program

#The first step in diagnosing dropped or blocked traffic situations is to determine if the firewall is turned on and which network location profile is active: domain, private, or publi
#verify that the firewall is enabled for the current network location profile
netsh advfirewall show currentprofile

#By default, Windows Firewall with Advanced Security blocks all unsolicited inbound network traffic, and allows all outbound network traffic.
==========================================================================================================
#Windows Firewall with Advanced Security troubleshooting guidance
#https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/troubleshoot-windows-firewall-with-advanced-security-guidance


Considerations for firewall rules
Only one firewall rule is used to determine if a network packet is allowed or dropped. If the network packet matches multiple rules, the rule that is used is selected using the following precedence:

    Rules that specify the action Allow if Secure and also the option Block Override
    Rules that specify the action Block
    Rules that specify the action Allow

Enable audit events

auditpol.exe /list /category  get the list of event categories recognized by the auditpol tool,
auditpol /list /subcategory:"Detailed Tracking" get the list of subcategories under a category
auditpol /list /subcategory:"Detailed Tracking","Object Access"

auditpol.exe /set /category:"CategoryName" /SubCategory:"SubcategoryName"  set a category and a subcategory to enable

At the command prompt, type netstat -ano > netstat.txt, and then press Enter. network statistics
At the command prompt, type tasklist > tasklist.txt, and then press Enter. text file for programs
At the command prompt, type tasklist /svc > tasklist.txt.text file for services 

In the tasklist.txt file, write down the Process Identifier (PID) for the process you are troubleshooting. 
Compare the PID with that in the Netstat.txt file. Write down the protocol that is used. 
The information about the protocol used can be useful when reviewing the information in the firewall log file.
==========================================================================================================
#enable windows firewall logging on windows 2022.

Type "wf.msc" (without quotes) and press Enter. This will open the Windows Firewall with Advanced Security window.
Select on "Windows Firewall with Advanced Security" in the left pane.

Action > Properties
==========================================================================================================
#ChatGPT

Explain how to enable windows firewall logging on windows 10.

To enable Windows Firewall logging on Windows 10, follow these steps:

    Press the Windows key + R to open the Run dialog box.

    Type "wf.msc" (without quotes) and press Enter. This will open the Windows Firewall with Advanced Security window.

    Click on "Windows Firewall with Advanced Security" in the left pane.

    Click on "Monitoring" in the left pane.

    Click on "Firewall" in the left pane.

    Click on the "Properties" link in the right pane.

    Click on the "Logging" tab.

    Under "Log Settings," select "Yes" next to "Log dropped packets" to enable logging for blocked connections.

    If you want to log successful connections as well, select "Yes" next to "Log successful connections."

    Under "Name," select a location where you want to store the log file. You can either use the default location or specify a custom location.

    Under "Size limit (KB)," select a maximum file size for the log file. Once the file reaches this size, it will start overwriting the oldest entries.

    Under "Log file name," you can either use the default file name or specify a custom file name.

    Under "Log file type," select the format for the log file. You can choose from the following options:
        ASCII (text file)
        Unicode (text file)
        Binary (binary file)

    Click on "OK" to save the changes.

Once logging is enabled, you can view the log file by navigating to the location you specified in step 10. The log file will contain information about all the connections that have been blocked or allowed by the firewall, along with the reason for each action.
==========================================================================================================
#ChatGPT

When configuring access with Windows Defender Firewall on a computer that is not a member of a domain and is located in a DMZ (Demilitarized Zone), you should choose the Public network location type.

A DMZ is a network segment that is isolated from the internal network and is typically used to host servers that need to be publicly accessible, such as web servers or email servers. The Public network location type is designed for use in public locations, such as a Wi-Fi hotspot, where the computer is not connected to a trusted network.

In the case of a DMZ, the Public network location type provides the most restrictive settings for Windows Defender Firewall, which is desirable for security reasons. By default, it blocks all inbound traffic to the computer, while still allowing outbound traffic. This means that only traffic initiated from the computer itself will be allowed to pass through the firewall.

It's worth noting that when configuring access with Windows Defender Firewall in a DMZ, you should ensure that only the necessary ports are open to allow for the required network traffic to pass through. This helps to minimize the attack surface of the computer and reduce the risk of unauthorized access.

In summary, when configuring access with Windows Defender Firewall on a computer that is not a member of a domain and is located in a DMZ, you should choose the Public network location type for maximum security. However, you should also ensure that only the necessary ports are open to allow for the required network traffic.
==========================================================================================================
#ChatGPT

Explain how to enable log dropped packets in windows firewall on windows 10.

To enable logging of dropped packets in Windows Firewall on Windows 10, follow these steps:

    Open the Start menu and type "Windows Defender Firewall" in the search box. Select "Windows Defender Firewall with Advanced Security" from the results.
    In the left-hand pane, right click on "Windows Defender Firewall with Advanced Security".
    Domain Profile > Logging > Customize     
    Click "OK" to save the changes.

After enabling logging of dropped packets, you can view the log files by going to the specified log file path or by using the Windows Event Viewer. In the Windows Event Viewer, look for events with the source "Windows Firewall with Advanced Security" and event ID 5031 for dropped packets.
==========================================================================================================
#ChatGPT

To view the log of dropped packets in Windows Defender Firewall on Windows 10, follow these steps:

    Open the Windows Defender Firewall with Advanced Security by typing "Windows Defender Firewall with Advanced Security" in the Start menu search bar and selecting it from the search results.

    In the left pane, click on "Monitoring" and then select "Firewall" from the submenu.

    In the middle pane, click on the "Properties" link located on the bottom right corner.

    In the "Firewall Properties" window, click on the "Domain Profile", "Private Profile", or "Public Profile" tab depending on the network profile you want to view the logs for.

    Under the "Logging Settings" section, click on the "%systemroot%\system32\LogFiles\Firewall\pfirewall.log" link

==========================================================================================================
#ChatGPT

When a Windows 10 installed computer connects to another Windows 10 installed computer in a corporate domain network, the Windows Defender Firewall should be configured with the Domain profile.

The Domain profile is designed for use when a computer is connected to a domain network, which is a network in a corporate environment where all computers are managed by a central server. This profile provides the most restrictive settings and blocks inbound connections that are not authorized by the network administrator. Outbound connections are allowed by default, but can also be restricted if needed.

By configuring the Windows Defender Firewall with the Domain profile, the computer can be protected from unauthorized inbound connections while still allowing necessary outbound connections. This is particularly important in a corporate environment, where the security of the network is a top priority.

It is worth noting that the Domain profile can only be applied when the computer is joined to a domain. If the computer is not joined to a domain, the Private profile should be used instead.
==========================================================================================================
#ChatGPT

When configuring the scope in the New Inbound Rule Wizard in the Windows Defender Firewall on Windows 10, you can specify the local and remote IP addresses to control which incoming network traffic is allowed or blocked by the firewall.

The local IP address refers to the IP address of the device running the firewall, while the remote IP address refers to the IP address of the device that is sending the incoming traffic. The scope can be set to allow or block traffic based on the local and remote IP addresses.

In the New Inbound Rule Wizard, you can select the "Scope" option to specify the local and remote IP addresses. Under the "Scope" section, you can choose from the following options:

    Any IP address: This option allows incoming traffic from any IP address.
    These IP addresses: This option allows incoming traffic from a specific IP address or range of IP addresses. You can specify individual IP addresses or a range of addresses using CIDR notation.
    These computers: This option allows incoming traffic from a specific device or devices. You can specify the device name or IP address.
    Any IP address on a local subnet: This option allows incoming traffic from any device on the same subnet as the local device.

By setting the local and remote IP addresses in the scope of an inbound rule, you can control which incoming network traffic is allowed or blocked by the firewall. This can help protect your computer or network from unauthorized access and potential security threats.
==========================================================================================================
#ChatGPT

Compare Domain,Private,Public Profiles  in windows defender firewall on windows 10

Windows Defender Firewall on Windows 10 includes three different profiles: Domain, Private, and Public. These profiles determine the level of protection provided by the firewall based on the network location of the device. Here's how they compare:

    Domain Profile: This profile is applied when the device is connected to a domain network, such as a network in a corporate environment. This profile provides the most restrictive settings and blocks inbound connections that are not authorized by the network administrator. Outbound connections are allowed by default, but can also be restricted if needed.

    Private Profile: This profile is applied when the device is connected to a private network, such as a home or work network. This profile provides a balance between security and usability, allowing most types of inbound and outbound connections, but still blocking potentially harmful traffic.

    Public Profile: This profile is applied when the device is connected to a public network, such as a Wi-Fi hotspot or an airport network. This profile provides the most permissive settings and allows the device to be discoverable by other devices on the network. Inbound connections are blocked by default, but outbound connections are allowed.

In summary, the Domain profile provides the highest level of security and is designed for use in enterprise environments, while the Private profile balances security and usability and is designed for use in home and work networks. The Public profile is the most permissive and is designed for use in public networks, where security risks are higher.
==========================================================================================================
Understand rule precedence for inbound rules

    Explicitly defined allow rules will take precedence over the default block setting.
    Explicit block rules will take precedence over any conflicting allow rules.
    More specific rules will take precedence over less specific rules, except if there are explicit block rules as mentioned in 2. (For example, if the parameters of rule 1 include an IP address range, while the parameters of rule 2 include a single IP host address, rule 2 will take precedence.)
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/best-practices-configuring

==========================================================================================================
#ChatGPT

Inbound rules and outbound rules are two types of rules in Windows Firewall that control incoming and outgoing network traffic respectively. Here are some of the key differences between inbound and outbound rules:

    Direction of Traffic: Inbound rules are designed to control incoming network traffic, while outbound rules control outgoing network traffic.

    Target of the Rules: Inbound rules are typically used to control access to local resources from external sources, while outbound rules are used to control access to external resources from the local system.

    Port Numbers: Inbound rules are often used to control access to specific TCP or UDP ports on the local system, while outbound rules can be used to control access to specific remote ports.

    Protocol Types: Inbound and outbound rules can be used to control traffic for various protocol types such as TCP, UDP, ICMP, and others.

    Default Settings: Inbound rules are usually more restrictive than outbound rules by default because inbound traffic is more likely to be malicious or unwanted.

    Network Location Awareness: Inbound and outbound rules can be configured differently depending on the network location, such as private, public, or domain networks.

In summary, inbound rules and outbound rules serve different purposes and control traffic in opposite directions. Inbound rules are typically more restrictive and are used to control access to local resources from external sources, while outbound rules are used to control access to external resources from the local system. Both types of rules can be configured based on protocol type, port numbers, and network location awareness.
==========================================================================================================
#ChatGPT

The error "Get-WmiObject : The RPC server is unavailable" usually occurs when the remote computer is not reachable or the Remote Procedure Call (RPC) service is not running on the remote computer. Here are some steps you can take to fix this error:

    Check that the remote computer is reachable: Ensure that the remote computer is powered on, connected to the network, and the IP address or hostname you specified is correct.

    Check that the Remote Procedure Call (RPC) service is running on the remote computer: You can check the status of the RPC service on the remote computer by following these steps:
    a. Open the "Services" console on the remote computer by typing "services.msc" in the Start menu search box and pressing Enter.
    b. Scroll down to the "Remote Procedure Call (RPC)" service and ensure that its status is "Running". If it is not running, right-click on the service and select "Start" to start the service.

    Check that the Windows Firewall on the remote computer is not blocking the connection: If the Windows Firewall is blocking the connection, you can add an exception to allow the connection by following these steps:
    a. Open the "Windows Firewall with Advanced Security" console on the remote computer by typing "wf.msc" in the Start menu search box and pressing Enter.
    b. In the left pane, select "Inbound Rules".
    c. In the right pane, select "New Rule..." to launch the "New Inbound Rule Wizard".
    d. Follow the wizard to create a new rule to allow incoming connections on the WMI (Windows Management Instrumentation) ports (TCP 135 and dynamic ports).

Once you have checked and resolved the above issues, you can try running the PowerShell script again to see if the error has been resolved.
==========================================================================================================
#troubleshooting, domain member 2022 server
#warning that says "some settings are managed by your organization" when trying to enable Remote Desktop on Windows 2022, 
#it means that your computer is being managed by a system administrator or an IT department that has restricted certain setting

# option is disabled and administrator can not change it.
Start-Settings-System-Remote Desktop-Enable Remote Desktop

Press the Windows key + R on your keyboard to open the Run dialog box.

Type "gpedit.msc" into the Run dialog box and press Enter.

In the Local Group Policy Editor, navigate to Computer Configuration > Administrative Templates > Network > Network Connections > Windows Firewall > Domain Profile.

Look for the policy named "Windows Defender Firewall: Allow inbound Remote Desktop exceptions" and double-click it to open its properties.

Select the "Enabled" option
==========================================================================================================
#ChatGPT, "GoToSetup.exe" chosen as GoToMeeting application

To allow the GoToMeeting desktop application through Windows Defender Firewall on Windows 10, you can follow these steps:

Open Windows Defender Firewall settings:

Press the Windows + S keys on your keyboard to open the search bar.
Type "Windows Defender Firewall" and select the appropriate search result.
Allow an app through Windows Defender Firewall:

On the left-hand side of the Windows Defender Firewall window, click on the option "Allow an app or feature through Windows Defender Firewall." You may need administrator privileges to proceed.
Click on "Change settings" (if required):

If the option is grayed out, click on the "Change settings" button at the top of the window and provide administrative permission if prompted.
Locate the GoToMeeting application:

In the "Allowed apps and features" list, scroll down or use the search bar to find the GoToMeeting application.
There should be two entries for GoToMeeting: "GoToMeeting" and "GoToMeeting Corporate."
Enable access for GoToMeeting:

Ensure that both checkboxes for "GoToMeeting" and "GoToMeeting Corporate" are ticked. If they are not, click on the checkboxes to enable access.
Save changes:

Once you have allowed the GoToMeeting application, click on the "OK" button at the bottom of the window to save the changes.
By following these steps, you have now allowed the GoToMeeting desktop application through the Windows Defender Firewall on your Windows 10 system. It should now be able to communicate through the firewall without any interruptions.
==========================================================================================================
Ensure that the Windows Firewall or any third-party firewall on the server allows RDP traffic.
Allow inbound connections on port 3389.
Use netsh advfirewall firewall add rule name="RDP" protocol=TCP dir=in localport=3389 action=allow to add a firewall rule.
==========================================================================================================