PowerShell scripts to automatically create rules for Windows firewall
Windows Firewall Ruleset
![Alt Text][corporate firewall]
Table of Contents
- Table of Contents - About Windows Firewall Ruleset - Firewall rules - Firewall framework - The vision of this firewall - License - Requirements - Requirements details - I don't meet the requirements - First time user - Warning - Note - Quick start - Firewall management - Automated and interactive firewall deployment - Manage GPO rules - Deploying individual rulesets - Deleting rules - Export/Import rules - Remote firewall deployment - Support, updates and documentation - The futureAbout Windows Firewall Ruleset
[![Alpha release][badge status]][alpha]
A fully automated solution for Windows firewall with PowerShell
Windows Firewall Ruleset configures Windows firewall automatically and applies restrictive firewall rules specific for target system and software installed on the system.
Status of this project is still alpha, click on "status" badge above to learn more.\ This project consists of two major parts, firewall rules and firewall framework as follows:
Firewall rules
Windows firewall rules sorted into individual PowerShell scripts according to:
- Rule group
- Traffic direction (ex. inbound, outbound or IPSec)
- Software type and publisher
- IP version (IPv4 / IPv6)
- ICMP traffic
- Browser rules
- Built in OS software
- Store apps
- Windows services
- Multiplayer Games
- Microsoft programs
- 3rd party programs
- broadcast traffic
- multicast traffic
Firewall framework
- Firewall framework consists of a number of PowerShell modules, scripts and documentation used to
- Computers on network - Installed programs - IP subnet math - Remote or local system users - Network configuration - GPO configuration - Firewall management - Quick analysis of packet trace and audit logs - Various troubleshooting, firewall, system and network utility functions
- Thus this repository is a good starting point to easily extend your firewall to include more rules
- Currently there are some 800+ firewall rules, 10+ modules with 100+ functions, several scripts
- You can interactively choose which rules you want, and deploy only those or you could automate the
The vision of this firewall
[![Managed in VSCode][badge vscode]][vscode] [![PowerShell][badge language]][powershell]
- Detailed firewall configuration is time consuming process, takes a lot of troubleshooting,
- Unlike firewall rules in control panel, these rules are loaded into GPO firewall
- Rules based on programs and services will have their specified executable file checked for
- Default outbound is "block" unless there is a rule to allow network traffic, in most firewalls
- Unlike in usual scenario, you will know which rules no longer have an effect or are redundant
- Unlike predefined Windows firewall rules, these rules are more restrictive such as,
- Updating, filtering or searching rules and attributes such as ports, addresses and similar is
CTRL + F to perform bulk operations on your rules, doing this in
any firewall UI is not possible due to user interface limitations.
- A good portion of code is dedicated to provide automated solution to build and define firewall
License
[![MIT license][badge license]](/LICENSE "View license")
This project Windows Firewall Ruleset is licensed under the MIT license.
Some scripts, files or modules are not MIT licensed or may have their own Copyright holders for this reason license and Copyright notices are maintained "per file".
Requirements
[![Windows][badge system]][windows]
The following table lists operating systems on which Windows Firewall Ruleset has been tested
| OS | Edition | Version | Architecture | | ------------------- | ------------- | ----------- | ------------ | | Windows 10 | Pro | 1809 - 22H2 | x64 | | Windows 10 | Pro Education | 20H2 | x64 | | Windows 10 | Enterprise | 1809 - 20H2 | x64 | | Windows 10 | Education | 20H2 - 22H2 | x64 | | Windows 11 | Pro Education | 21H2 | x64 | | Windows 11 | Pro | 22H2 - 23H2 | x64 | | Windows 11 | Enterprise | 22H2 | x64 | | Windows Server 2019 | Essentials | 1809 | x64 | | Windows Server 2019 | Standard | 1809 | x64 | | Windows Server 2019 | Datacenter | 1809 | x64 | | Windows Server 2022 | Standard | 21H2 | x64 | | Windows Server 2022 | Datacenter | 21H2 | x64 |
- Windows PowerShell 5.1 or PowerShell Core 7.3.x [Download PowerShell Core][download core]
- .NET Framework 4.5 (Windows PowerShell only) [Download Net Framework][download .net]
sigcheck64.exe(Highly recommended) [Download sigcheck][sigcheck]- Git (Optional) [Download Git][download git]
- Visual Studio Code (Recommended) [Download VSCode][vscode]
- PowerShell Support for VSCode (Recommended) [Download extension][download powershell extension]
- PSScriptAnalyzer (Recommended) [Download PSScriptAnalyzer][module psscriptanalyzer]
Requirements details
- All Windows 10.0 systems (Major 10, Minor 0) and above except
Homeeditions are supported,
PowerShell Coreis not built into Windows, you will need to install it separately or use
.NET Frameworkmin. version 4.5 is required if using Windows PowerShell (Desktop edition)
sigcheck64.exe(or 32 bitsigcheck.exe) is a digital signature verification tool which you can
C:\tools directory or to %PATH%
environment variable.\
Windows Firewall Ruleset will use it to perform hash based online malware analysis on VirusTotal
for every executable that is not digitally signed before a firewall rule is made for that executable.\
This is only a recommendation, if there is no sigcheck64.exe in PATH you're offered to download
it and if you decline no malware analysis is made.\
By using this functionality you're agree to [VirusTotal Terms of Service][virustotal terms],
[VirusTotal Privacy Policy][virustotal privacy] and [Sysinternals Software License Terms][sysinternals terms]
- You might want to have git to check out for updates,
- VS Code is preferred and recommended editor to navigate code and or to edit scripts for your
- If you get VSCode, you'll also need PowerShell extension for code navigation and PowerShell
- To navigate and edit code with VSCode
PSScriptAnalyzeris highly recommended, otherwise editing
- There are no hardware requirements, but if you plan to write and debug code recommendation is min.
I don't meet the requirements
At the moment this firewall is tested and designed for most recent Windows Desktop/Servers and that is known to work, to make use of it on older systems requires additional work.
Testing is done on 64 bit Windows, a small fraction of rules won't work for 32 bit system and need adjustment, full functionality for 32 bit system is work in progress.\ For now you can load rules on 32 bit system just fine with the exception of few rules probably not relevant at all for your configuration.
For information on how to make use of this firewall on older Windows systems such as Windows 7 or Windows Server 2008 see Legacy Support
First time user
The following are brief warnings and notices first time user should be aware of before deploying firewall
Warning
- You might loose internet connectivity for some of your programs or in rare cases even lose
.\Scripts\Reset-Firewall.ps1 -Remoting -Service, to reset GPO firewall to system defaults,
remove all rules and restore WinRM and modified services to system defaults.
(afterwards PowerShell restart is required)
- Inside
docsdirectory there is aResetFirewall.md, a guide on how to do it manually, by hand,
- Your existing rules will not be deleted unless you have rules in GPO with exact same group names
Scripts\Reset-Firewall.ps1 which
will clear GPO rules completely and leave only those in control panel.
- If you want to be 100% sure please export your GPO rules as explained in
- You will be asked which rules to load (if you select interactive deployment, see later),
- Default configuration will set global firewall behavior which is not configurable in GPO,
Stateful FTP and PPTP or global IPSec settings, if you need specific setup please
visit Scripts\Complete-Firewall.ps1 and take a look at Set-NetFirewallSetting.\
Note that Scripts\Complete-Firewall.ps1 is automatically called by Scripts\Deploy-Firewall.ps1
- Some scripts require you (network adapter) to be connected to network, for example to determine
- Everything on system should be up to date because otherwise some rules may be skipped or incorrect,
Note
- Loading rules into an empty GPO should be very fast, however loading into GPO which already
- All errors and warnings will be saved to
Logsdirectory, you can review these logs later if you
- Any rule that results in "Access is denied" while loading should be reloaded by executing specific
- If the repository was manually downloaded, transferred from another computer or media then you should\
Scripts\Unblock-Project.ps1\
Master script Scripts\Deploy-Firewall.ps1 does this in case if you forget, but initial YES/NO
questions will still be present in that case.
- If you have "Ransomware protection" enabled (in Windows Defender),
pwsh.exe (Core edition) or powershell.exe (Desktop edition)
or both, otherwise errors happens in develop mode during installation of modules.\
If Repository code is downloaded to a folder under ransomware protection anything may be blocked.\
PowerShell console might need to be restarted for "Controlled folder access" changes to take effect.
- By default rules are made for
Usersgroup while forAdministratorsgroup only if necessary,
DefaultGroup variable in Config\ProjectSettings.ps1 and specify Administrators.
See SecurityAndPrivacy.md for more information why using Administrator account is not recommended for security reasons.\ Your administrative account used to deploy firewall must have a password set.
- Software or Windows updates may rename executables or their locations, also user accounts may be
- Before deploying firewall it is recommended to update system and user programs on target computer
Quick start
- If you don't have ssh keys and other setup required to clone via SSH then either clone with HTTPS
- Extract downloaded archive somewhere, these steps assume you've extracted the zip file
C:\ root drive directly.
- If you would like to use Windows PowerShell, see How to open Windows PowerShell
- If you don't have PowerShell context menu then move to
C:\root drive by executing the
c:
cd \
- cd into downloaded folder:
cd WindowsFirewallRuleset*
- To see current execution policy type the following command and hit enter:\
TAB key to auto complete as you type)
Get-ExecutionPolicy
Remember the output of the above command, note that PowerShell Core defaults to RemoteSigned while Windows PowerShell defaults to Restricted on non server editions.
- Set execution policy to unrestricted to be able to unblock project files,
RemoteSigned will work only once scripts are unblocked)
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy Unrestricted
You may be prompted to accept execution policy change, if so type Y and press enter to accept.\ For more information see [About Execution Policies][about execution policies]
- At this point you should "unblock" all repository files first by executing a script called\
Scripts\Unblock-Project.ps1, btw. repository files were blocked by Windows to prevent users from
running untrusted script code downloaded from internet:
.\Scripts\Unblock-Project.ps1
If asked, make sure your answer is R that is [R] Run once as many times as needed to unblock project. (approx. up to 8 times)
- Once repository files are unblocked change execution policy to
RemoteSigned:
Set-ExecutionPolicy -Scope CurrentUser -ExecutionPolicy RemoteSigned
You may be again prompted to accept execution policy change, type Y and press enter to accept.
- Rules for programs such as your web browser, games etc. depend on installation variables.\
Rules directory.\
It is recommended to close down all MMC management consoles such as gpedit.msc or secpol.msc
before running master script in the next step.
- Back to PowerShell console and run one of the two
Deploy-Firewallcommands below:
.\Scripts\Deploy-Firewall.ps1 -Force
Otherwise to be interactively prompted which rules to load run:
.\Scripts\Deploy-Firewall.ps1
Hit enter and you'll be asked questions such as what kind of rulesets you want.\ If you need help to decide whether to run some ruleset or not, type ? when prompted to run ruleset and press enter to get more info.\ If for what ever reason you want to interrupt and abort deployment (ex. to start a new) press CTRL + C on your keyboard while PowerShell is in focus and restart PowerShell console.
- Follow prompt output, (ex. hit enter to accept default action),
NOTE: If Administrator account is using Microsoft account to log in to computer you will be asked for credentials, which needs to be Microsoft email and password regardless if you're using Windows hello or not, specifying PIN ie. will not work and other Windows hello authentication methods are not supported.
If invalid credentials are supplied you'll get an error saying Access is denied.\ If this happens you'll need to restart PowerShell console and try again.
For more information why this is necessary see FAQ
- If you encounter errors, you can either ignore errors or update script that produced the error
- When done you might want to adjust some of the rules in Local Group Policy,
- Now go ahead and test your internet connection (ex. with a web browser or some other program),
- Temporarily open outbound firewall in GPO or Disable Firewall - Troubleshoot problems: Network troubleshooting detailed guide - You can Reset Firewall to previous state - Take a look into docs directory for more troubleshooting options and documentation
- As a prerequisite to deploy firewall, some system services have been started and set to
Logs directory you'll find Services_<DATE>.log to help you restore these
services to default if desired.\
For example Windows Remote Management service should not run if not needed
(the default is "Manual" startup)
Firewall management
The following section gives some hints to manage firewall with ease
Automated and interactive firewall deployment
Deploy-Firewall.ps1 script supports several parameters to let you customize deployment automation as follows:
- To automatically run all rules without prompt and concise output but only for programs which exist
.\Scripts\Deploy-Firewall.ps1 -Force -Quiet
- To go step by step and be prompted for confirmation on which rulesets to load
.\Scripts\Deploy-Firewall.ps1 -Interactive
- To be prompted only for ruleset selection run
Deploy-Firewallwithout any parameters:
.\Scripts\Deploy-Firewall.ps1
To learn the meaning of parmaters to be able to combine them on your own see Deploy-Firewall.ps1 script comment or run the following command:
Get-Help .\Scripts\Deploy-Firewall.ps1 -Detailed
Manage GPO rules
There are two mothods to manage GPO rules:
- Using Local Group Policy, this method gives you limited freedom on what you can do with rules
- Editing PowerShell scripts, this method gives you full control, you can change or remove existing
What ever your plan or setup is, you will surely want to perform additional work such as customizing rules, or adding new rules for programs not yet covered by this firewall.
Rules are loaded into local group policy, if during firewall setup you accepted creating a shortcut to personalized firewall management console you can run the schortcut, otherwise follow steps mentioned in Manage GPO Firewall
For more information about GPO see: [Configure security policy settings][configure security policy settings]
Deploying individual rulesets
If you want to deploy only specific rules there are two ways to do this:
- Execute
Scripts\Deploy-Firewall.ps1and choseYesonly for rulesets you want, otherwise chose
No and hit enter to skip current ruleset.
- In PowerShell console navigate
cdto directory containing ruleset script you want and execute
cd .\Rules\IPv4\Outbound\Software followed by .\Adobe.ps1 to load rules for Adobe.
You might want to run Scripts\Complete-Firewall.ps1 afterwards to apply default firewall behavior if it's not already set, or you can do it manually in GPO but with limited power. "limited power" means Scripts\Complete-Firewall.ps1 configures some firewall parameters which can't be adjusted in firewall GUI.
In both cases all rules that match ruleset group, DisplayGroup, will be deleted before loading rules into GPO.
Deleting rules
At the moment there are three options to delete firewall rules:
- The easiest way is to select all rules you want to delete in GPO, right click and delete.
- To delete rules according to file there is a function for this purpose, located in:\
Modules\Ruleset.Firewall\Public\Remove-FirewallRule.ps1\
however you first need to export firewall to file before using it.
- To revert to your old firewall state (the one in control panel), you'll need to delete all
Not configured after right click on node:\
Windows Defender Firewall with Advanced Security - Local Group Policy Object
Deleting all rules or revetting to previous state can also be done with Scripts\Reset-Firewall.ps1\ Note that you'll also need to re-import your exported GPO rules if you had them.
Export/Import rules
If you want to export rules from GPO there are two methods available:
- Export in local group policy by clicking on
Export Policy...menu, after right click on node:\
Windows Defender Firewall with Advanced Security - Local Group Policy Object
- To export using PowerShell run
Scripts\Backup-Firewall.ps1\
Export-RegistryRule function located in Ruleset.Firewall
module, which let's you customize your export in almost any way you want.
If you want to import rules, importing by using GPO is same as for export, and to import with PowerShell just run Scripts\Restore-Firewall.ps1 which will pick up your previous export files.
To customize your export\import please take a look into Modules\Ruleset.Firewall\Public, which is where you'll find description on how to use export\import module functions.
NOTE: Export-FirewallRule function is really slow, you're advised to run Export-RegistryRule function instead which is as fast as it can be.
Remote firewall deployment
This section and functionality is currently experimental and not fully complete, at the moment deployment to single remote computer is supported.

In remote firewall deployment there are at least two computers involved,\ one is called management computer (client) and all others are called managed computers (servers).
Scripts are executed by administrator on management computer, and firewall is then deployed to or configured on multiple server computers simultaneously.
For implementation details see Modules\Ruleset.Remote module
NOTE: Remoting functionality is not exclusive to remote firewall deployment, deployment to localhost by design requires working WinRM and PS remoting configuration as well.
Before remote deployment can be performed, remote computer (server) needs to be configured to accept connection, example on how to establish SSL connection is as follows:
To allow execution, configure WinRM service and remote registry on server computer by running:
NOTE: If using PowerShell core omit -Protocol HTTPS from Enable-WinRMServer below, this will enable both HTTP and HTTPS which is a temporary workaround for compatibility module to work in remote session.
# On server computer
Set-ExecutionPolicy -Scope LocalMachine RemoteSigned
Set-Location C:\Path\to\WindowsFirewallRuleset
Import-Module .\Modules\Ruleset.Remote
Enable-WinRMServer -Protocol HTTPS -KeepDefault -Confirm:$false
Enable-RemoteRegistry -Confirm:$false
After performing these steps, inside \Exports directory you'll find SSL certificate (*.cer) file which needs to be copied to management computer also into \Exports directory.\ By default self signed SSL certificate is created if the server computer does not already have one.
NOTE: Configuring server computer manually is performed only once for initial setup, you don't need to repeat it for subsequent deployments.
Next step is to move on to management computer and run scripts as wanted, for example:
# On management computer
cd C:\Path\to\WindowsFirewallRuleset\Scripts
Deploy-Firewall -Domain "RemoteComputerName"
Both sets of commands above need to be run in same edition of PowerShell, ex. if server was configured in PowerShell Core then client computer also needs PowerShell core for deployment.\ If either the server or management computer is a workstation (ex. not Windows server or part of domain) then it's network profile must be set to private profile.
Remote deployment can be customized in a great detail in the following locations:
- To customize WinRM service see:
Modules\Ruleset.Remote\Scripts\WinRMSettings.ps1 - To customize WSMan session configuration see:
Modules\Ruleset.Remote\Scripts\*Firewall.pssc - To customize self signed SSL certificate see:
Modules\Ruleset.Remote\Public\Register-SslCertificate.ps1 - To customize PS and CIM session configuration see:
Modules\Ruleset.Remote\Scripts\SessionSettings.ps1
Support, updates and documentation
For support, issue reports, suggestions or customization of this repository and methods to periodically update this firewall please refer to SUPPORT.md
The future
The following features are desired and might be available at some point in the future:
- Remote firewall administration
- Comprehensive firewall rulesets for Windows Server editions and dedicated gateway systems.
- On demand or scheduled registry scan to validate integrity of active firewall filtering policy
- Any firewall rule or setting in the registry that is not part of this repository is reported for review. - Because, malware, hackers and even trusted software can attempt to bypass firewall at any time
- Full functionality for the following not yet tested editions of Windows 10.0
- Functionality for x86 systems
[corporate firewall]: https://bitbucket.org/SuperAAAAA/shack/raw/60508e0e23d73aeb8f9a4fdc75b13ea94e56e62b/corporate.jpg "Corporate Firewall" [download core]: https://github.com/PowerShell/PowerShell "Download PowerShell Core" [download .net]: https://dotnet.microsoft.com/download/dotnet-framework "Download .NET Framework" [download git]: https://git-scm.com/downloads "Visit Git downloads page" [vscode]: https://code.visualstudio.com "Visit Visual Studio Code home page" [download powershell extension]: https://marketplace.visualstudio.com/items?itemName=ms-vscode.PowerShell "Visit Marketplace" [module psscriptanalyzer]: https://github.com/PowerShell/PSScriptAnalyzer "Visit PSScriptAnalyzer repository" [about execution policies]: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/aboutexecutionpolicies "About Execution Policies" [configure security policy settings]: https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/how-to-configure-security-policy-settings "Configure Security Policy Settings" [releases]: https://github.com/metablaster/WindowsFirewallRuleset/releases "Visit releases page now" [powershell]: https://docs.microsoft.com/en-us/powershell/scripting/overview "What is PowerShell anyway?" [windows]: https://learn.microsoft.com/en-us/windows/resources "Visit Windows client documentation for IT Pros" [alpha]: https://en.wikipedia.org/wiki/Softwarereleaselife_cycle#Alpha "What is alpha software? - Wikipedia" [badge status]: https://img.shields.io/static/v1?label=Status&message=Alpha&color=red&style=plastic [badge system]: https://img.shields.io/static/v1?label=OS&message=Windows&color=informational&style=plastic&logo=Windows [badge language]: https://img.shields.io/static/v1?label=Language&message=PowerShell&color=informational&style=plastic&logo=PowerShell [badge vscode]: https://img.shields.io/static/v1?label=Managed%20in&message=VSCode&color=informational&style=plastic&logo=Visual-Studio-Code [regression]: https://en.wikipedia.org/wiki/Software_regression "What is software regresssion?" [sigcheck]: https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck "Download sigcheck from Microsoft" [multicursor]: https://code.visualstudio.com/Docs/editor/codebasics#_multiple-selections-multicursor "Visit VSCode documentation" [virustotal terms]: https://support.virustotal.com/hc/en-us/articles/115002145529-Terms-of-Service "Visit VirusTotal site" [virustotal privacy]: https://support.virustotal.com/hc/en-us/articles/115002168385-Privacy-Policy "Visit VirusTotal site" [badge license]: https://img.shields.io/static/v1?label=License&message=MIT&color=success&style=plastic [sysinternals terms]: https://learn.microsoft.com/en-us/sysinternals/license-terms "Visit Microsoft site"