Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Dumb question:

Is there an equivalent of iptables on Windows? Could I install one via cygwin?

The real question: how can I accomplish on Windows what I can accomplish via iptables? Just looking for basic firewall functionality (e.g. blocking certain IP addresses)

share|improve this question
5  
No such thing as a dumb question – Mark Henderson Nov 30 '10 at 23:07
1  
Of course there's such a thing as a dumb question, this just isn't one. – Task May 29 '14 at 17:36
up vote 26 down vote accepted

One way would be with the netsh command:

share|improve this answer
5  
+1 - netsh advfirewall is an absolute nessesary rule to learn for anyone scripting anything security related on Windows Server – Mark Henderson Nov 30 '10 at 23:06
1  
exactly what i was looking for, thanks. – Aaron F. Nov 30 '10 at 23:28
    
Does netsh advfirewall support URLs, or just IP addresses? – Parker Apr 26 '13 at 1:55
    
Just IP addresses and such, though it can also filter based on the executable sending or receiving network traffic, or the AD credentials of the user/group/computer involved. For URL filtering, you'd want to look for a filtering proxy of some kind. – James Sneeringer Apr 26 '13 at 14:11

WIPFW looks very promising, especially if your after that iptables rule creation flavor.

share|improve this answer

There is a built-in firewall in XP, Server 2003 and later releases.

It has an API through which you can programatically change, enable, and disable rules.

share|improve this answer
1  
I want something I can access programmtically -- add IP addresses to the firewall from within a script or software module. – Aaron F. Nov 30 '10 at 22:51

Example 1: Enable a program

Old command New command

netsh firewall add allowedprogram C:\MyApp\MyApp.exe "My Application" ENABLE    
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes
netsh firewall add allowedprogram program=C:\MyApp\MyApp.exe name="My Application" mode=ENABLE scope=CUSTOM addresses=157.60.0.1,172.16.0.0/16,LocalSubnet profile=Domain   netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh firewall add allowedprogram program=C:\MyApp\MyApp.exe name="My Application" mode=ENABLE scope=CUSTOM addresses=157.60.0.1,172.16.0.0/16,LocalSubnet profile=ALL  

Run the following commands:

netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain

netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=private

For more information about how to add firewall rules, run the following command:

netsh advfirewall firewall add rule ?

Example 2: Enable a port

Old command New command

netsh firewall add portopening TCP 80 "Open Port 80"    
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

For more information about how to add firewall rules, run the following command:

netsh advfirewall firewall add rule ?

Example 3: Delete enabled programs or ports

Old command New command

netsh firewall delete allowedprogram C:\MyApp\MyApp.exe netsh advfirewall firewall delete rule name=rule name program="C:\MyApp\MyApp.exe"
delete portopening protocol=UDP port=500    netsh advfirewall firewall delete rule name=rule name protocol=udp localport=500

For more information about how to delete firewall rules, run the following command:

netsh advfirewall firewall delete rule ?

Example 4: Configure ICMP settings

Old command New command

netsh firewall set icmpsetting 8    netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow
netsh firewall set icmpsetting type=ALL mode=enable netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow
netsh firewall set icmpsetting 13 disable all   netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block

For more information about how to configure ICMP settings, run the following command:

netsh advfirewall firewall add rule ?

Example 5: Set logging

Old command New command netsh firewall set logging %systemroot%\system32\LogFiles\Firewall\pfirewall.log 4096 ENABLE ENABLE Run the following commands:

netsh advfirewall set currentprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log

netsh advfirewall set currentprofile logging maxfilesize 4096
netsh advfirewall set currentprofile logging droppedconnections enable

netsh advfirewall set currentprofile logging allowedconnections enable

For more information, run the following command:

netsh advfirewall set currentprofile ?

If you want to set logging for a particular profile, use one of the following options instead of the "currentprofile" option:
Domainprofile
Privateprofile
Publicprofile

Example 6: Enable Windows Firewall

Old command New command

netsh firewall set opmode ENABLE    netsh advfirewall set currentprofile state on
netsh firewall set opmode mode=ENABLE exceptions=enable 

Run the following commands:

Netsh advfirewall set currentprofile state on 

netsh advfirewall set currentprofile firewallpolicy blockinboundalways,allowoutbound
netsh firewall set opmode mode=enable exceptions=disable profile=domain 

Run the following commands:

Netsh advfirewall set domainprofile state on 

netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
netsh firewall set opmode mode=enable profile=ALL   Run the following commands:

netsh advfirewall set domainprofile state on 

netsh advfirewall set privateprofile state on

For more information, run the following command:

netsh advfirewall set currentprofile ?

If you want to set the firewall state for a particular profile, use one of the following options instead of the "currentprofile" option: Domainprofile
Privateprofile
Publicprofile

Example 7: Restore policy defaults

Old command New command

netsh firewall reset
netsh advfirewall reset

For more information, run the following command: netsh advfirewall reset ? Example 8: Enable specific services

Old command New command netsh firewall set service FileAndPrint netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes netsh firewall set service RemoteDesktop enable netsh advfirewall firewall set rule group="remote desktop" new enable=Yes netsh firewall set service RemoteDesktop enable profile=ALL Run the following commands:

netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=domain

netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=private

share|improve this answer
2  
You might want to work on the formatting. Currently it is horrible to read, inviting downvotes. – Gerald Schneider Aug 27 '15 at 12:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.