CODEWITHSUNDEEP
powershellfirewall
Keith
Keith

Reputation: 791

Windows Firewall Rule manipulation using PowerShell 2

I have the PowerShell code to manipulate Windows firewall rules so long as the installed PowerShell version is 4+. But I need to run these commands on windows servers with PowerShell 2. Everything I've read points me to use Netshadvfirewall but I have had no success finding correct way to use it for the purposes I need.

The following are the 5 PowerShell commands I need converted into PowerShell 2 commands:

Current Code that works on PowerShell 4+

$RuleName = 'Test Rule Name'
$IPAddress = '1.1.1.1'
$Port = 127
$LocLocation = 'C:\temp\Firewall.log'

$FireWallRule = (Get-NetFirewallRule  -DisplayName "$RuleName" -ErrorAction SilentlyContinue)
if ($null -ne $FireWallRule) {
  $FirewallRuleIP = ($FirewallRule | Get-NetFirewallAddressFilter).RemoteAddress
  $FirewallRulePort = ($FirewallRule | Get-NetFirewallPortFilter).LocalPort

  # Is the existing firewall rule correctly configured?
  if ($FirewallRule.Direction -eq "Inbound" -and $FirewallRule.Action -eq "Allow" -and $FirewallRule.Enabled -eq "true" -and $FirewallRuleIP -eq $IPAddress -and $FirewallRulePort -eq $Port) {
    $Message = "Firewall rule $RuleName already exists and is configured correctly with:  Direction:Inbound, Action:Allow, Protocol:TCP, RemoteAddress:$IPAddress, LocalPort:$Port"
  }
  else {
    Remove-NetFirewallRule  -DisplayName "$RuleName" | Out-Null
    New-NetFirewallRule -DisplayName "$RuleName" -Direction Inbound -Action Allow -Protocol TCP -RemoteAddress $IPAddress -LocalPort $Port | Out-Null
    $Message = "Firewall rule $RuleName was misconfigured.  It was deleted and recreated with:  Direction:Inbound, Action:Allow, Protocol:TCP, RemoteAddress:$IPAddress, LocalPort:$Port"
  }
}

Upvotes: 1

Views: 2218

Answers (2)

Keith
Keith

Reputation: 791

The commands I found that resolve my issue:

  1. To get a firewall rule: NetSH AdvFirewall Firewall show rule name=$RuleName
  2. To add a firewall rule: NetSH AdvFirewall Firewall Add Rule Name=$RuleName Dir=in Action=Allow Program=Any Enable=Yes RemoteIP=$IPAddress Protocol=TCP LocalPort=$Port
  3. To delete a firewall rule: NetSH AdvFirewall Firewall Delete Rule Name=$RuleName

The solution was determined by the link given by @JeffZeitlin in the comments

Upvotes: 1

AdminOfThings
AdminOfThings

Reputation: 25001

I think this will work for a translation:

$RuleName = 'Test Rule Name'
$IPAddress = '1.1.1.1'
$Port = 127
$LocLocation = 'C:\temp\Firewall.log'
$FireWallRule = $null

$FireWallRule = netsh advfirewall firewall show rule $RuleName
if ($FireWallRule -match "Rule Name") {
    $FireWallRuleIP = ($FireWallRule | Select-String -Pattern "^RemoteIP:.*?([0-9a-z].+$)").Matches |
        Foreach-Object { $_.groups[1].Value }
    $FirewallRulePort = ($FireWallRule | Select-String -Pattern "^LocalPort:.*?([0-9a-z].+$)").Matches |
        Foreach-Object { $_.groups[1].Value }
    $FireWallRuleDirection = ($FireWallRule | Select-String -Pattern "^Direction:.*?([0-9a-z].+$)").Matches |
        Foreach-Object { $_.groups[1].Value }
    $FireWallRuleAction = ($FireWallRule | Select-String -Pattern "^Action:.*?([0-9a-z].+$)").Matches |
        Foreach-Object { $_.groups[1].Value }
    $FirewallRuleEnabled = ($FireWallRule | Select-String -Pattern "^Enabled:.*?([0-9a-z].+$)").Matches |
        Foreach-Object { $_.groups[1].Value }

    if ($FirewallRuleDirection -eq "In" -and $FirewallRuleAction -eq "Allow" -and $FirewallRuleEnabled -eq "Yes" -and $FirewallRuleIP -like "$IPAddress*" -and $FirewallRulePort -eq $Port) {
            $Message = "Firewall rule $RuleName already exists and is configured correctly with:  Direction:Inbound, Action:Allow, Protocol:TCP, RemoteAddress:$IPAddress, LocalPort:$Port"
    }
        else {
            $null = netsh advfirewall firewall delete rule $RuleName
            $null = netsh advfirewall firewall add rule name=$RuleName dir=in protocol=TCP localport=$Port RemoteIP=$IPAddress action=allow
            $Message = "Firewall rule $RuleName was misconfigured.  It was deleted and recreated with:  Direction:Inbound, Action:Allow, Protocol:TCP, RemoteAddress:$IPAddress, LocalPort:$Port"
    }
}

Upvotes: 1

Related Questions