# Script to configure Firewall on Windows devices Windows Firewall is a security mechanism that protects the device from unauthorized access. It helps secure the endpoints and permits you to create network rules for regulating network traffic. This doc assists you on how to configure firewall settings and rules using scripts, which can be [deployed to devices from the Hexnode UEM console](https://www.hexnode.com/mobile-device-management/help/executing-custom-scripts-for-windows/). Note: The script is supported for execution on the following Windows versions: - Windows 10 v1803+. - Windows 10 v1703 to Windows 10 v1709 (if .NET Framework v4.7.1+ is installed on the device). - Windows 11 (Pro, Enterprise, Education). Disclaimer:The sample scripts provided below are adapted from third-party open-source sites. Setting up Windows Firewall using scripts ----------------------------------------- You can use both the Batch files and PowerShell commands to enable the firewall on Windows devices from the Hexnode console. ### 1. Batch Script - To enable Firewall on all profiles specifically domain, private and public: Enable Firewall on all profiles netsh advfirewall set allprofiles state on 1 netsh advfirewall set allprofiles state on - To disable Firewall on all profiles specifically domain, private and public: Disable Firewall on all profiles netsh advfirewall set allprofiles state off 1 netsh advfirewall set allprofiles state off - To enable Firewall on current profile: Enable Firewall on current profile netsh advfirewall set currentprofile state on 1 netsh advfirewall set currentprofile state on Replace ‘currentprofile’ with ‘domainprofile’, ‘publicprofile’, or ‘privateprofile’ to set the Firewall state for a particular profile. - To disable Firewall on current profile: Disable Firewall on current profile netsh advfirewall set currentprofile state off 1 netsh advfirewall set currentprofile state off Replace ‘currentprofile’ with ‘domainprofile’, ‘publicprofile’, or ‘privateprofile’ to set the Firewall state for a particular profile. - To add a Firewall rule name for any given application (for instance, Google Chrome) meant for the inbound traffic to the device: Add a Firewall rule name for any given application netsh advfirewall firewall add rule name="SetUpFirewall" dir=in Program="C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" action=block 1 netsh advfirewall firewall add rule name="SetUpFirewall" dir=in Program="C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" action=block - To allow a port for inbound traffic in Firewall: Allow a port for inbound traffic netsh advfirewall firewall add rule name="Allow Port 80" dir=in action=allow protocol=TCP remoteport=80 1 netsh advfirewall firewall add rule name="Allow Port 80" dir=in action=allow protocol=TCP remoteport=80 - To block a port for inbound traffic in Firewall: Block a port for inbound traffic netsh advfirewall firewall add rule name="Allow Port 80" dir=in action=block protocol=TCP remoteport=80 1 netsh advfirewall firewall add rule name="Allow Port 80" dir=in action=block protocol=TCP remoteport=80 - To remove a configured Firewall rule: Remove configured Firewall netsh advfirewall firewall delete rule name="new\_rule" 1 netsh advfirewall firewall delete rule name="new\_rule" Replace *new\_rule* with the name of the configured Firewall rule. ### 2. PowerShell Script - To enable Firewall on all profiles specifically domain, private and public: Enable Firewall on all profiles Set-NetFirewallProfile -All -Enabled True 1 Set-NetFirewallProfile -All -Enabled True Replace ‘All’ with ‘Domain,’ ‘Private,’ or ‘Public’ to enable Firewall across respective profiles. - To disable Firewall on all profiles specifically domain, private and public: Disable Firewall on all profiles Set-NetFirewallProfile -All -Enabled False 1 Set-NetFirewallProfile -All -Enabled False Replace ‘All’ with ‘Domain,’ ‘Private,’ or ‘Public’ to enable Firewall across respective profiles. - To add Firewall rule name for any given application (for instance, Google Chrome) meant for the inbound traffic to the device: Add Firewall rule name for any given application New-NetFirewallRule -Name "Chrome Internet Access" -DisplayName "Chrome Internet Access" -Direction Outbound -Program "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" -Enabled True -Profile Any -Action Block 1 New-NetFirewallRule -Name "Chrome Internet Access" -DisplayName "Chrome Internet Access" -Direction Outbound -Program "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" -Enabled True -Profile Any -Action Block - To allow a port for outbound traffic in Firewall: Allow a port for outbound traffic in Firewall New-NetFirewallRule -Name "Block Port 80" -DisplayName "Block Port 80" -Direction Outbound -Enabled True -Action Allow -Protocol TCP -RemotePort 80 1 New-NetFirewallRule -Name "Block Port 80" -DisplayName "Block Port 80" -Direction Outbound -Enabled True -Action Allow -Protocol TCP -RemotePort 80 - To block the same port for outbound traffic in Firewall: Block a port for outbound traffic in Firewall Set-NetFirewallRule -DisplayName "Block Port 80" -Direction Outbound -Enabled True -Action Block -Protocol TCP -RemotePort 80 1 Set-NetFirewallRule -DisplayName "Block Port 80" -Direction Outbound -Enabled True -Action Block -Protocol TCP -RemotePort 80 - To remove a configured Firewall rule: Remove a configured Firewall rule Remove-NetFirewallRule -Name "new\_rule" 1 Remove-NetFirewallRule -Name "new\_rule" Replace *new\_rule* with the name of the configured Firewall rule. Notes:- It is recommended to manually validate the script execution on a system before executing the action in bulk. - Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.