metablaster/windowsfirewallrulesetPowerShell scripts to automatically create rules for Windows firewall
![Alt Text][corporate firewall]
[![Alpha release][badge status]][alpha]
A fully automated solution for Windows firewall with PowerShell
Windows Firewall Ruleset configures Windows firewall automatically and applies restrictive
firewall rules specific for target system and software installed on the system.
Status of this project is still alpha, click on "status" badge above to learn more.
This project consists of two major parts, firewall rules and firewall framework as follows:
Windows firewall rules sorted into individual PowerShell scripts according to:
Such as for example:
Firewall framework consists of a number of PowerShell modules, scripts and documentation used to gather environment information relevant to build and deploy firewall specialized for target system such as:
Thus this repository is a good starting point to easily extend your firewall to include more rules and functionalities as desired.
Currently there are some 800+ firewall rules, 10+ modules with 100+ functions, several scripts and a good portion of useful documentation.
You can interactively choose which rules you want, and deploy only those or you could automate the process and deploy all the necessary rules and settings to your firewall.
[![Managed in VSCode][badge vscode]][vscode] [![PowerShell][badge language]][powershell]
Detailed firewall configuration is time consuming process, takes a lot of troubleshooting, changes require testing and security auditing and it only gets worse if you need to deploy firewall to hundreds or thousands of remote computers, for example not all computers might have same software or restriction requirements.
Unlike firewall rules in control panel, these rules are loaded into GPO firewall (Local Group Policy), meaning system settings changes or random programs which install rules as part of their installation process will have no effect on firewall unless you explicitly make an exception.
Rules based on programs and services will have their specified executable file checked for digital signature and will be scanned on VirusTotal if digital signature is missing, for security reasons rule is not created or loaded into firewall if this verification fails. (can be forced)
Default outbound is "block" unless there is a rule to allow network traffic, in most firewalls this is not possible unless you maintain rules for every possible program or service, thanks to this collection of rules, setting default outbound to block requires very little or no additional work.
Unlike in usual scenario, you will know which rules no longer have an effect or are redundant due to ex. uninstalled program, a missing system service which no longer exists, renamed executable after Windows update and similar reasons.
Unlike predefined Windows firewall rules, these rules are more restrictive such as, tied to explicit user accounts, rules apply to specific ports, network interfaces, specific executables, services etc. all of which is learned automatically from target system.
Updating, filtering or searching rules and attributes such as ports, addresses and similar is
much easier since these rules are in scripts, you can use editor tools such as regex,
[multicursor][multicursor] or CTRL + F to perform bulk operations on your rules, doing this in
any firewall UI is not possible due to user interface limitations.
A good portion of code is dedicated to provide automated solution to build and define firewall specialized for target system and users, minimizing the need to do something manually thus saving you much valuable administration time.
This project Windows Firewall Ruleset is licensed under the MIT license.
Some scripts, files or modules are not MIT licensed or may have their own Copyright holders
for this reason license and Copyright notices are maintained "per file".
[![Windows][badge system]][windows]
The following table lists operating systems on which Windows Firewall Ruleset has been tested
| OS | Edition | Version | Architecture |
|---|---|---|---|
| Windows 10 | Pro | 1809 - 22H2 | x64 |
| Windows 10 | Pro Education | 20H2 | x64 |
| Windows 10 | Enterprise | 1809 - 20H2 | x64 |
| Windows 10 | Education | 20H2 - 22H2 | x64 |
| Windows 11 | Pro Education | 21H2 | x64 |
| Windows 11 | Pro | 22H2 - 23H2 | x64 |
| Windows 11 | Enterprise | 22H2 | x64 |
| Windows Server 2019 | Essentials | 1809 | x64 |
| Windows Server 2019 | Standard | 1809 | x64 |
| Windows Server 2019 | Datacenter | 1809 | x64 |
| Windows Server 2022 | Standard | 21H2 | x64 |
| Windows Server 2022 | Datacenter | 21H2 | x64 |
sigcheck64.exe (Highly recommended) [Download sigcheck][sigcheck]