Firewall - OsbornePro

Firewalk Bypass Commands

Hping3 Firewall Bypass Commands

# Below are command examples of hping3 usage
hping3 -1 osbornepro.com
(Sends ICMP echo and receives ICMP reply like a ping)

hping3 -traceroute -V -1 osbornepro.com
(Similar to tracert)

hping3 -V -S -p 80 -s 5050 osbornepro.com
(SYN packet is sent to port 80 from local port 5050

hping3 -S 192.168.0.1 -a 10.10.10.10 -p 80 --flood
-S is for SYN -a is for alias (Sends a SYN Flood to 192.168.0.1 on port 80 from 10.10.10.10)

hping --traceroute -V -S -p 80 -s 5050 osbornepro.com
(Does a traceroute to a specified port 80 and watches where the packet is blocked)

hping3 -c 1 -V -1 -C 17 osbornepro.com
(Sends an ICMP address mask request type 17)

hping3 -c -1 -V -p 80 -s 5050 -A osbornepro.com
(Performs an ACK scan to see if a host is alive when ping is blocked to receive an RST response._

hping3 -c 1 -V -p 80 -s 5050 -M 0 -UPF osbornepro.com
(Performs an XMAS scan by setting sequence number to 0 and URG + PSH + FIN flags in the packet to 1. If port is open the target discards the TCP xmas scan sending no reply. If CLOSED the target sends a TCP RST packet in reply)

hping3 -c 1 -V -p 80 -s 5050 -Y osbornepro.com
(Performs a NULL scan. Sets sequence number to 0 and has no flags set in the packet. If the target devices port is closed the device sends a TCP RST paclet in reply. If open the scan is disregarded)

hping3 -1 --flood -a VICTIM_IP_BROADCAST_ADDRESS
(Smurf attack DoS that floods a target system via spoofed broadcast ping messages)

hping3 -V -c 100000 -d 120 -S -w 64 -p 445 -s 445 --flood --rand-source 192.168.0.1
(DOS Land Attack)

--flood (sent packets fast as possible)
--rand-dest (random destination address mode)
-V Verbose
-c packet count
-d data size
-S SYNC flags
-w winsize default is 64
-p destination port
-s base source port
-i interval wait
-q quiet
-I interface
-D debug
--beep beep for every matching packet received

Firewall-cmd Reference

# Default service ports are configured in /etc/services

# Get version
firewall-cmd -V

# Get state
firewall-cmd --state

# View firewall rules
firewall-cmd --list-all

# List all firewall rule zones
firewall-cmd --list-all-zones

# Get the default firewall zone
firewall-cmd --get-default-zone

# Get active firewall zones
firewall-cmd --get-active-zones

# Create a new permanent firewall zone called private
firewall-cmd --permanent --new-zone=private

# Delete a permanent firewall zone
firewall-cmd --permanent --delete-zone=private

# Get info on a specific firewall zone
firewall-cmd --permanent --info-zone=private

# Prevent applications running as root from changing your firewall configuration
firewall-cmd --lockdown-on

# Apply any newly made firewall configuration changes and rules
firewall-cmd --reload

# Reload firewall confiuration changes, rules, and netfilter kernel modules
firewall-cmd --complete-reload

# Allow applications running as root to change your firewall configuraion
firewall-cmd --lockdown-off

# Get description of a firewall zone
firewall-cmd --permanent --zone=public --get-description

# Get ICMP types
firewall-cmd --get-icmptypes

# Check panic mode status
firewall-cmd --query-panic

# STOP ALL INCOMING AND OUTGOING TRAFFIC
firewall-cmd --panic-on

# Turn the panic state off
firewall-cmd --panic-off

# List allowed services
firewall-cmd --list-services

# List firewall allowed ports on system
firewall-cmd --list-ports

# Get firewall rule helpers for currently blocked ports
firewall-cmd --get-automatic-helpers

# Enable HTTP port 80 in the public firewall zone
firewall-cmd --zone=public --add-service=http
firewall-cmd --permanent --zone=public --add-service=http

# Allow traffic to a specific TCP port
firewall-cmd --add-port=2222/tcp
firewall-cmd --permanent --add-port=2222/tcp

# Remove a firewall rule for a TCP port
firewall-cmd --permanent --remove-port=444/tcp

# Allow the SSH service
firewall-cmd --permanent --add-service=ssh

# Remove firewall rule for the mysql service
firewall-cmd --permanent --remove-service=mysql

# Whitelist an IP address
firewall-cmd --permanent --add-source=10.0.0.1

# Whitelist an IP range
firewall-cmd --permanent --add-source=10.0.0.0/24

# Remove a whitelisted IP
firewall-cmd --permanent --remove-source=10.0.0.1

# Block and IP Address or Range of IP's
firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='10.0.0.1' reject"
firewall-cmd --permanent --add-rich-rule="rule family='ipv4' source address='10.0.0.0/24' reject"

# Whitelist an IP address or range for a specific port
firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.1" port protocol="tcp" port="3306" accept'

# Remove a rich rule
firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="10.0.0.1" port protocol="tcp" port="3306" accept'

iptables Reference

# List entries in iptables
sudo iptables -L

# View all active iptable rules
iptables -n -L -v
iptables -n -L -v --line-numbers
iptables -L INPUT -n -viptables -L OUTPUT -n -v --line-numbers

# List iptable rules for a specfic chain
iptables -L INPUT
iptables -S INPUT
iptables -L INPUT -v

# Accept all connetoins on all chains
iptables --policy INPUT ACCEPT
iptables --policy OUTPUT ACCEPT
iptables --policy FORWARD ACCEPT

# Drop all connections on all chains
iptables --policy INPUT DROP
iptables --policy OUTPUT DROP
iptables --policy FORWARD DROP

# Set default policy for Input to Accept
iptables --policy INPUT ACCEPT

# Set default policy for OUTPUT to DROP
iptables --policy OUTPUT DROP

# Set Default Policy for FORWARD to REJECT
iptables --policy FORWARD REJECT

# ACCEPT Connections From a Single IP Address
iptables -A INPUT -s 10.0.0.1 -j ACCEPT

# DROP Connections for an IP Range
iptables -A INPUT -s 10.0.0.0/24 -j DROP

# REJECT OUTBOUND Connections for an IP on a Specific Port (SSH)
iptables -A OUTPUT -p tcp --dport ssh -s 10.0.0.1 -j REJECT

# DROP all OUTPUT connections
iptables --policy OUTPUT DROP

# ALLOW only CONNECTIONS to 10.0.0.1
iptables -A OUTPUT -d 10.0.0.1 -j ACCEPT

# Insert iptables rule
iptables -I INPUT 2 -s 10.0.0.1 -j DROP

# Clear all the iptables rules
iptables -F

# Delete rule that allows port 111 tcp conections from 127.0.0.1
iptables -D INPUT -s 127.0.0.1 -p tcp -dport 111 -j ACCEPT

# Delete iptables rule based on its rule number
iptables -D INPUT 4

# Delete rule by specification
iptables -D INPUT -m conntrack --ctstate INVALID -j DROP

# Flush a single chain
iptables -F INPUT

# Flush All Rules, Delete All Chains, and Accept All
iptables -P INPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -P OUTPUT ACCEPT
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X

# Allow loopback connections
iptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPT

# Allow Established and Related Incoming Connections
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Allow Established Outgoing Connections
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Internal to External
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT

# Drop Invalid Packets
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

# Block an IP Address
iptables -A INPUT -s 192.168.1.10 -j DROP

# Block and IP Address and Reject
iptables -A INPUT -s 192.168.1.10 -j REJECT

# Block Connections to a Network Interface
iptables -A INPUT -i eth0 -s 192.168.1.10 -j DROP

# Allow All Incoming SSH
iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow Incoming SSH from Specific IP address or subnet
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow Outgoing SSH
iptables -A OUTPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow Incoming Rsync from Specific IP Address or Subnet
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 873 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 873 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow Incoming HTTP
iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow Incoming HTTPS
iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow Incoming HTTP and HTTPS
iptables -A INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow MySQL from Specific IP Address or Subnet
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow MySQL to Specific Network Interface
iptables -A INPUT -i eth1 -p tcp --dport 3306 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 3306 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow PostgreSQL from Specific IP Address or Subnet
iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow PostgreSQL to Specific Network Interface
iptables -A INPUT -i eth1 -p tcp --dport 5432 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth1 -p tcp --sport 5432 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Block Outgoing SMTP Mail
iptables -A OUTPUT -p tcp --dport 25 -j REJECT

# Allow All Incoming SMTP
iptables -A INPUT -p tcp --dport 25 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 25 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow All Incoming IMAP
iptables -A INPUT -p tcp --dport 143 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 143 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow All Incoming IMAPS
iptables -A INPUT -p tcp --dport 993 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 993 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow All Incoming POP3
iptables -A INPUT -p tcp --dport 110 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 110 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Allow All Incoming POP3S
iptables -A INPUT -p tcp --dport 995 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp --sport 995 -m conntrack --ctstate ESTABLISHED -j ACCEPT

# Drop Private Network Address On Public Interface
iptables -A INPUT -i eth1 -s 192.168.1.0/24 -j DROP
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP

# Drop All Outgoing to Facebook Networks -----------------------------------
Get Facebook AS:
whois -h v4.whois.cymru.com " -v $(host facebook.com | grep "has address" | cut -d " " -f4)" | tail -n1 | awk '{print $1}'

Drop:
for i in $(whois -h whois.radb.net -- '-i origin AS1273' | grep "^route:" | cut -d ":" -f2 | sed -e 's/^[ \t]*//' | sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | cut -d ":" -f2 | sed 's/$/;/') ; do  iptables -A OUTPUT -s "$i" -j REJECTdone
#---------------------------------------------------------------------------

# Log and Drop Packets
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j LOG --log-prefix "IP_SPOOF A: "
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP

# Log and Drop Packets with Limited Number of Log Entries
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -m limit --limit 5/m --limit-burst 7 -j LOG --log-prefix "IP_SPOOF A: "
iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP

# Drop or Accept Traffic From Mac Address
iptables -A INPUT -m mac --mac-source 00:0F:EA:91:04:08 -j DROP
iptables -A INPUT -p tcp --destination-port 22 -m mac --mac-source 00:00:00:90:00:00 -j ACCEPT

# Block or Allow ICMP Ping Request
iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
iptables -A INPUT -i eth1 -p icmp --icmp-type echo-request -j DROP

# Specifying Multiple Ports with multiport
iptables -A INPUT -i eth0 -p tcp -m state --state NEW -m multiport --dports ssh,smtp,http,https -j ACCEPT

# Load Balancing with random* or nth*
_ips=("172.31.250.10" "172.31.250.11" "172.31.250.12" "172.31.250.13")for ip in "${_ips[@]}" ; do  iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m nth --counter 0 --every 4 --packet 0 \    -j DNAT --to-destination ${ip}:80done
_ips=("172.31.250.10" "172.31.250.11" "172.31.250.12" "172.31.250.13")for ip in "${_ips[@]}" ; do  iptables -A PREROUTING -i eth0 -p tcp --dport 80 -m state --state NEW -m random --average 25 \    -j DNAT --to-destination ${ip}:80done

# Restricting the Number of Connections with limit and iplimit*
iptables -A FORWARD -m state --state NEW -p tcp -m multiport --dport http,https -o eth0 -i eth1 -m limit --limit 20/hour --limit-burst 5 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW --dport http -m iplimit --iplimit-above 5 -j DROP

# Maintaining a List of recent Connections to Match Against
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 100 -j DROPiptables -A FORWARD -p tcp -i eth0 --dport 443 -m recent --name portscan --set -j DROP

# Matching Against a string* in a Packet's Data Payload
iptables -A FORWARD -m string --string '.com' -j DROP
iptables -A FORWARD -m string --string '.exe' -j DROP

# Time-based Rules with time*
iptables -A FORWARD -p tcp -m multiport --dport http,https -o eth0 -i eth1 -m time --timestart 21:30 --timestop 22:30 --days Mon,Tue,Wed,Thu,Fri -j ACCEPT

# Packet Matching Based on TTL Values
iptables -A INPUT -s 1.2.3.4 -m ttl --ttl-lt 40 -j REJECT

# Protection against port scanning
iptables -N port-scanningiptables -A port-scanning -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s --limit-burst 2 -j RETURNiptables -A port-scanning -j DROP

# SSH brute-force protection
iptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --setiptables -A INPUT -p tcp --dport ssh -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

# Syn-flood protection
iptables -N syn_floodiptables -A INPUT -p tcp --syn -j syn_floodiptables -A syn_flood -m limit --limit 1/s --limit-burst 3 -j RETURN
iptables -A syn_flood -j DROPiptables -A INPUT -p icmp -m limit --limit  1/s --limit-burst 1 -j ACCEPT
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 1 -j LOG --log-prefix PING-DROP:
iptables -A INPUT -p icmp -j DROPiptables -A OUTPUT -p icmp -j ACCEPT

# Mitigating SYN Floods With SYNPROXY
iptables -t raw -A PREROUTING -p tcp -m tcp --syn -j CT --notrack
iptables -A INPUT -p tcp -m tcp -m conntrack --ctstate INVALID,UNTRACKED -j SYNPROXY --sack-perm --timestamp --wscale 7 --mss 1460
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

# Block New Packets That Are Not SYN
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -t mangle -A PREROUTING -p tcp ! --syn -m conntrack --ctstate NEW -j DROP

# Force Fragments packets check
iptables -A INPUT -f -j DROP

# XMAS packets
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Drop all NULL packets
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# Block Uncommon MSS Values
iptables -t mangle -A PREROUTING -p tcp -m conntrack --ctstate NEW -m tcpmss ! --mss 536:65535 -j DROP

# Block Packets With Bogus TCP Flags
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,SYN FIN,SYN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,RST FIN,RST -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags FIN,ACK FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,URG URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,FIN FIN -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ACK,PSH PSH -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL ALL -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL NONE -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,FIN,PSH,URG -j DROP
iptables -t mangle -A PREROUTING -p tcp --tcp-flags ALL SYN,RST,ACK,FIN,URG -j DROP

# Save rules on Debian OS's
netfilter-persistent save

# Save rules on RHEL Systems
service iptables save

ufw Reference

# Get Status
sudo ufw status

# Enable the firewall
sudo ufw enable

# Disable the firewall
sudo ufw disable

# Block an IP Address
sudo ufw deny from 10.0.0.1

# Block a subnet
sudo ufw deny from 10.0.0.0/24

# Block incoming connection by interface
sudo ufw deny in on eth0 from 10.0.0.1

# Allow an IP address
sudo ufw allow from 10.0.0.1

# Allow incoming connection by IP address
sudo ufw allow in on eth0 from 10.0.0.1

# Delete a firewall rule
sudo ufw delete allow from 10.0.0.1

# List firewall rules and get associated numbers
sudo ufw status numbered

# Remove firewall rule by number
sudo ufw delete 1

# Lis application profiles
sudo ufw app list

# Allow one of those listed application profiles
sudo ufw allow “OpenSSH”

# Allow access to a specific port
sudo ufw allow 22

# Allow only HTTPS access to your Nginx application
sudo ufw allow "Nginx HTTPS"
sudo ufw delete allow "Nginx Full"

# Allow incoming SSH from a specific IP address or subnet
sudo ufw allow from 10.0.0.1 proto tcp to any port 22
sudo ufw allow from 10.0.0.0/24 proto tcp to any port 22

# Allow incoming rsync traffic from a specific IP or subnet
sudo ufw allow from 10.0.0.1 to any port 873
sudo ufw allow from 10.0.0.0/24 to any port 873

# Allow all incoming HTTP and HTTPS connections
sudo ufw allow proto tcp from any to any port 80,443

# Block outgoing SMTP
sudo ufw deny out 25

PowerShell Firewall Commands

# Disable Windows Firewall
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled False

# List existing firewall rules
Get-NetFirewallRule | Select-Object DisplayName, Enabled, Direction, Action

# View detailed list of allowed and disallowed ports on inbound and outbound connections
Get-NetFirewallRule -Action Allow -Enabled True -Direction Inbound |
Format-Table -Property Name,
@{Name='Protocol';Expression={($PSItem | Get-NetFirewallPortFilter).Protocol}},
@{Name='LocalPort';Expression={($PSItem | Get-NetFirewallPortFilter).LocalPort}},
@{Name='RemotePort';Expression={($PSItem | Get-NetFirewallPortFilter).RemotePort}},
@{Name='RemoteAddress';Expression={($PSItem | Get-NetFirewallAddressFilter).RemoteAddress}},
Enabled,Profile,Direction,Action

# Enable Domain Public and Private Firewall Rules
Set-NetFirewallProfile -All -Enabled True

# Enable a specific firewall group
Set-NetFirewallProfile -Profile Public -Enabled True

# Disable Domain Private and Public firewall rules
Set-NetFirewallProfile -All -Enabled False

# Change default action for Public firewall to block
Set-NetFirewallProfile –Name Public –DefaultInboundAction Block

# Remove an existing firewall rule
Remove-NetFirewallRule -DisplayName "Block WINS"

# Get current profile settings of Public
Get-NetFirewallProfile -Name Public

# Get firewall settings set by GPO
Get-NetFirewallProfile -PolicyStore ActiveStore

# Disable a specific interface profile
Set-NetFirewallProfile -Name Public -DisabledInterfaceAliases "Ethernet0"

# Set the network location logging for Domain profile and max log size
Set-NetFireWallProfile -Profile Domain -LogBlocked True -LogMaxSize 20000 -LogFileName ‘%systemroot%\system32\LogFiles\Firewall\domainfw.log’

# Allow HTTP and HTTPS traffic inbound on Domain and Private firewall
New-NetFirewallRule -DisplayName 'HTTP-Inbound' -Profile @('Domain', 'Private') -Direction Inbound -Action Allow -Protocol TCP -LocalPort @('80', '443')

# Block all outbound connections coming from Firefox
New-NetFirewallRule -Program “C:\Program Files (x86)\Mozilla Firefox\firefox.exe” -Action Block -Profile Domain, Private -DisplayName “Block Firefox browser” -Description “Block Firefox browser” -Direction Outbound

# Allow RDP Connections from one IP address
New-NetFirewallRule -DisplayName "AllowRDP" –RemoteAddress 10.0.0.1 -Direction Inbound -Protocol TCP –LocalPort 3389 -Action Allow

# Allow ICMP requets from a specified list of IP addresses
$ips = @("192.168.2.15-192.168.2.40", "192.168.100.15-192.168.100.200", ”10.1.0.0/16”)
New-NetFirewallRule -DisplayName "Allow inbound ICMPv4" -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress $ips -Action Allow
New-NetFirewallRule -DisplayName "Allow inbound ICMPv6" -Direction Inbound -Protocol ICMPv6 -IcmpType 8 -RemoteAddress $ips -Action Allow

# Modify and existing firewall rule
Get-NetFirewallrule -DisplayName 'HTTP-Inbound' | Get-NetFirewallAddressFilter | Set-NetFirewallAddressFilter -RemoteAddress 10.0.0.1

# List Enabled Firewall rules for inbound traffic
Get-NetFirewallRule | Where-Object -FilterScript {($_.Enabled -eq $True) -and ($_.Direction -eq "Inbound")} | Format-Table -AutoSize

# Display a list of outbound blocking rules
Get-NetFirewallRule -Action Block -Enabled True -Direction Outbound

# Display an ap name in a rule
Get-NetFirewallRule -Action Block -Enabled True -Direction Outbound | ForEach-Object {$_.Name; $_ | Get-NetFirewallApplicationFilter}

# Enable Remote Desktop Connections
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"

# Disable Remote Desktop Connections
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

Command Prompt Firewall Commands

# Enable a program to pass through firewall
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=private

# Allow port 80
netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80

# Delete application firewall rule
netsh advfirewall firewall delete rule name=rule name program="C:\MyApp\MyApp.exe"

# Delete a port firewall rule
netsh advfirewall firewall delete rule name=rule name protocol=udp localport=500

# Allow ping requests
netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow
netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow
netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block

# Set logging
netsh advfirewall set currentprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set currentprofile logging maxfilesize 4096
netsh advfirewall set currentprofile logging droppedconnections enable
netsh advfirewall set currentprofile logging allowedconnections enable

# Enable Windows Firewall
netsh advfirewall set currentprofile state on
netsh advfirewall set currentprofile firewallpolicy blockinboundalways,allowoutbound
netsh advfirewall set domainprofile state on
netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
netsh advfirewall set domainprofile state on
netsh advfirewall set privateprofile state on

# Restore policy defaults
netsh advfirewall reset

# Enable specific services
netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=domain
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=private

# Disable windows firewall
netsh advfirewall set allprofiles state off

Firewall Reference

Firewalk Bypass Commands

Hping3 Firewall Bypass Commands

Firewall-cmd Reference

iptables Reference

ufw Reference

PowerShell Firewall Commands

Command Prompt Firewall Commands

Site Links

Contact Info

Firewall Reference

Firewalk Bypass Commands

Hping3 Firewall Bypass Commands

Firewall-cmd Reference

iptables Reference

ufw Reference

PowerShell Firewall Commands

Command Prompt Firewall Commands

Site Links

Contact Info

Subscribe to OsbornePro TV