Audit inbound firewall block rules
Documentation: Microsoft Learn
Get-NetFirewallRule is constrained by three parameters at once, returning rules that are enabled, inbound, and set to block.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-NetFirewallRule -Enabled True -Direction Inbound -Action Block | Select-Object DisplayName,Profile,Direction,Action- Stage 1Get-NetFirewallRule
-Enabled -Direction -Action - Stage 2Select-Object
Positional values or no named parameters
How it works
Get-NetFirewallRule is constrained by three parameters at once, returning rules that are enabled, inbound, and set to block. The projection reports the display name with the profiles the rule applies to alongside its direction and action.
Adapting it
Pipe the results into Get-NetFirewallPortFilter to attach the ports each rule actually covers, because a rule display name rarely reveals what it blocks.
If the result is unexpected
An inbound-block report fails to explain which firewall rule applies.
Rule state, profile, direction and associated port or address filters must be interpreted together.
- Inspect the active profile and the matching rule's port, address and application filters.
Validate the result
The candidate rule matches the affected connection's direction and endpoints.
Keep the check reliable
Keep rule identifiers and associated filters together in exports.
