How can I add a Windows firewall rule with a custom group name?

Question

I know I can use netsh advfirewall firewall add rule or wf.msc to create new firewall rules; but when I create a rule this way, it will NOT have a groupName and thus I can't manage multiple rules at the same time.

Is there a way to specify a groupName for some firewall rules?

score 9 · Answer 1 · answered Jul 16 '17 at 13:21

9

The following Powershell one-liner adds/renames Group name for the rules with DisplayName='GTA V'. Works for Windows 8+

Get-NetFirewallRule -DisplayName 'GTA V' | ForEach { $_.Group = 'games'; Set-NetFirewallRule -InputObject $_ }

answered Jul 16 '17 at 13:21

maoizm

682
13
17

score 6 · Accepted Answer · answered Aug 14 '12 at 16:11

OK! I know how I should do it now :)
Using PowerShell and WMI COM-Objects I can do what I want!
This is a ps1 script I wrote to add firewall rules so that I can connect to my SQL Server remotely.

function isFirewallPortOpen {
    param( [int] $port )
    $fw = New-Object -ComObject hnetcfg.fwpolicy2 
    if ($fw.Rules | Where {$_.LocalPorts -eq $port }) {
        return [bool]$true
    } else {
        return [bool]$false
    }
}

function existsFirewallRule {
    param( [string] $name )
    $fw = New-Object -ComObject hnetcfg.fwpolicy2 
    if ($fw.Rules | Where { $_.Name -eq $name }) {
        return [bool]$true
    } else {
        return [bool]$false
    }
}

function addFirewallRule {
    param(
        [string] $name,
        [int] $port,
        [int] $protocol
    )
    $fw = New-Object -ComObject hnetcfg.fwpolicy2 
    if (isFirewallPortOpen $port -or existsFirewallRule $name) {
        Write-Host -ForegroundColor:Red "**Rule Already Exists or Port Already Open."
    } else {
        $rule = New-Object -ComObject HNetCfg.FWRule

        $rule.Name = $name
        $rule.Protocol = $protocol # 6=NET_FW_IP_PROTOCOL_TCP and 17=NET_FW_IP_PROTOCOL_UDP
        $rule.LocalPorts = $port
        $rule.Enabled = $true
        $rule.Grouping = "SQL Server"
        $rule.Profiles = 7 # all
        $rule.Action = 1 # NET_FW_ACTION_ALLOW
        $rule.EdgeTraversal = $false

        $fw.Rules.Add($rule)
        Write-Host -ForegroundColor:Blue "A rule named '$name' has been added to Windows' Firewall."
    }
}

addFirewallRule -name:"Transact SQL Debugger" -port:135 -protocol:6
addFirewallRule -name:"SQL Traffic" -port:1433 -protocol:6
addFirewallRule -name:"SQL Browser Traffic" -port:1434 -protocol:17
addFirewallRule -name:"SQL Analytics Traffic" -port:2383 -protocol:6
addFirewallRule -name:"SQL Broker Traffic" -port:4022 -protocol:6

score 1 · Answer 3 · edited Mar 09 '13 at 03:10

1

$fw= New-Object -ComObject hnetcfg.fwpolicy2
$fw.rules | ? {$_.name -like "*sql*"} | ft name,grouping
$fw.rules | ? {$_.name -like "*sql*"} | % {$gn="_mssqlservices";$_.grouping = $gn}
$fw.rules | ? {$_.name -like "*sql*"} | ft name,grouping

edited Mar 09 '13 at 03:10

Bohemian

412,405
93
575
722

answered Mar 09 '13 at 02:50

xun yang

11
1

4

Welcome to stack overflow, by providing an explanation as well as code your answer will be of more use. – 1321941 Mar 09 '13 at 03:10
2

For those future readers who don't know what "`ft`" or "`%`" or "`?`" means, `ft` is "`Format-Table`", `%` is "`ForEach-Object`" and `?` is "`Where-Object`" – Achilles Mar 09 '13 at 10:46

score 0 · Answer 4 · edited Dec 08 '19 at 08:57

0

$rule = Get-NetFirewallRule -Name 'nameme'; $rule.Group = 'nameme'; $rule | Set-NetFirewallRule; 
netsh advfirewall firewall show rule name=nameme
netsh advfirewall set allprofiles state on
netsh advfirewall set allgroups on
netsh advfirewall firewall add rule name="nameme" dir=out action=Allow
netsh advfirewall export "C:\temp\WFconfiguration.wfw"
netsh advfirewall import "C:\temp\WFconfiguration.wfw"

NOTE: you must first create the rule name in Windows firewall, then change nameme to the name run PowerShell administrator.

For the group name= any

Managing Windows Firewall is now easier than ever Just go download it

edited Dec 08 '19 at 08:57

DxTx

3,049
3
23
34

answered Aug 18 '18 at 00:03

Spyzerone

1
1

"Managing Windows Firewall is now easier than ever" Nope, it's easier than _it was before_. Easier than ever would be to just allow setting a group for the rule in Windows Firewall itself, via Properties, right click or such. – Yin Cognyto May 06 '21 at 16:24

How can I add a Windows firewall rule with a custom group name?

4 Answers4