How to get the list of IP addresses from a firewall rule?

Question

I'm trying to get the current list of configured IP addresses from a certain firewall rule, so that I can compare it to a list of addresses to add and eliminate the ones that already exist.

Using the syntax found here, I'm able to display the first few IP addresses from the rule:

$Rule = Get-NetFirewallRule -Action Block -Enabled True -Direction Inbound
$Rule | Format-Table -Property DisplayName,@{Name='RemoteAddress';Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}}

Output:

DisplayName                     RemoteAddress
-----------                     -------------
Block SMTP Brute Force (TCP-In) {5.34.207.103, 103.145.254.105, 46.148.40.171, 80.94.95.206...}

This shows that I have indeed been able to access the list, but it stops short of actually allowing me to enumerate it.

How can I get this list into a runtime variable for processing?

Here's a netsh-like powershell function that shows remoteaddress, localport, program, etc https://stackoverflow.com/questions/42110526/why-doesnt-get-netfirewallrule-show-all-information-of-the-firewall-rule/58138487#58138487 — js2010, Dec 27 '22 at 16:19

score 2 · Answer 1 · edited Aug 15 '23 at 16:33

2

Use the following code:

(Get-NetFirewallRule | Where-Object { $_.DisplayName -eq 'RULE_NAME' } | Get-NetFirewallAddressFilter).RemoteAddress

edited Aug 15 '23 at 16:33

allexiusw

1,533
2
16
23

answered Aug 04 '23 at 09:31

Dmytro Nesterenko

21
2

Interesting, thanks. Nice shortcut. – InteXX Aug 06 '23 at 07:03
Hello Dmytro! This is good but if you don't need to apply a filter you can simplify it a bit more by omitting those pipes `(Get-NetFirewallRule -name $RuleName).RemoteAddress` :) – RiverHeart Aug 08 '23 at 14:03

InteXX · Accepted Answer · 2022-12-27T14:43:23.600

0

I was able to accomplish this by altering the syntax slightly:

$Rules = Get-NetFirewallRule -Action Block -Enabled True -Direction Inbound
$Rules | % { 
  $Rule = $_
  $List = ($Rule | Get-NetFirewallAddressFilter).RemoteAddress
  Write-Output $Rule.DisplayName
  Write-Output "----------------"
  Write-Output $List
  Write-Output ""
}

edited Dec 27 '22 at 14:43

answered Dec 27 '22 at 09:54

InteXX

6,135
6
43
80

How to get the list of IP addresses from a firewall rule?

2 Answers2