PowerShell Firewall administration

The NetSecurity module manages Windows Firewall. Get-NetFirewallRule lists rules, New-NetFirewallRule creates them, and Set-NetFirewallRule changes them.

Lesson 2 min read Windows PowerShell 5.1 and PowerShell 7

Documentation: Microsoft Learn

Written and tested by Dhrub Bharali · Updated 02 October 2026

Overview

The design catches people out. A rule object does not carry its ports or addresses; those live in separate filter objects. To see which port a rule covers you pipe the rule into Get-NetFirewallPortFilter, and for addresses into Get-NetFirewallAddressFilter. So finding the rule that blocks port 445 is a two-step query, not a one-line filter on the rule list.

Profiles are the second trap. Rules apply per profile: Domain, Private, Public. A rule can be Enabled and still have no effect because the active profile is not one it applies to. Get-NetFirewallProfile shows which profile is active, and checking it first saves you from debugging a rule that was never in scope.

When creating rules, be specific. New-NetFirewallRule with -RemoteAddress limits who can connect, and a rule scoped to a subnet is a very different thing from one open to any address.

Rules created by PowerShell are permanent. Remove them with Remove-NetFirewallRule when you are done testing, or they quietly outlive their reason.

Inspect this example’s structure

Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.

[pscustomobject]@{
  Rules = 'Get-NetFirewallRule -Enabled True -Direction Inbound'
  Ports = 'Get-NetFirewallRule | Get-NetFirewallPortFilter'
  Profiles = 'Get-NetFirewallProfile'
  Note = 'a rule can be enabled and inactive if its profile is not current'
} | Format-List

Stage 1[pscustomobject]@{Positional values or no named parameters
Stage 2Format-ListPositional values or no named parameters

An example to inspect

Preview the example. Sign in for the full lesson and activities.

[pscustomobject]@{
  Rules = 'Get-NetFirewallRule -Enabled True -Direction Inbound'
  Ports = 'Get-NetFirewallRule | Get-NetFirewallPortFilter'
  Profiles = 'Get-NetFirewallProfile'
  Note = 'a rule can be enabled and inactive if its profile is not current'
} | Format-List

What happens

This prints the three queries you need together, because the answer is spread across three cmdlets. The Ports line shows the piping pattern that joins a rule to its port filter. The note is the failure mode: enabled is not the same as active.

Worth remembering

Ports and addresses live in filter objects, not on the rule.
Pipe a rule into Get-NetFirewallPortFilter to see its ports.
Rules apply per profile; check the active profile first.
Scope new rules with -RemoteAddress rather than leaving them open.

Primary documentation

PowerShell objects and pipelines documentation

Try it

Expected output · prints command text; does not execute these commands

1PS> [pscustomobject]@{

2PS> Rules = 'Get-NetFirewallRule -Enabled True -Direction Inbound'

3PS> Ports = 'Get-NetFirewallRule | Get-NetFirewallPortFilter'

4PS> Profiles = 'Get-NetFirewallProfile'

5PS> Note = 'a rule can be enabled and inactive if its profile is not current'

6PS> } | Format-List

Example reader

Inspect this page's example

Fictional browser data when supported

Run supported commands against the practice data, or inspect the example without executing it.

[pscustomobject]@{
  Rules = 'Get-NetFirewallRule -Enabled True -Direction Inbound'
  Ports = 'Get-NetFirewallRule | Get-NetFirewallPortFilter'
  Profiles = 'Get-NetFirewallProfile'
  Note = 'a rule can be enabled and inactive if its profile is not current'
} | Format-List

Ready to inspect.

Prints the three firewall queries and the enabled-versus-active caveat.

Show reference output

Expected output · prints command text; does not execute these commands

Rules    : Get-NetFirewallRule -Enabled True -Direction Inbound
Ports    : Get-NetFirewallRule | Get-NetFirewallPortFilter
Profiles : Get-NetFirewallProfile
Note     : a rule can be enabled and inactive if its profile is not current

Keep going

Next: Windows Update PowerShell commands: inventory and checks

Check your understanding