How to Configure Windows Firewall Rules with PowerShell

Windows Defender Firewall is built into every Windows Server install and is on by default. The GUI (wf.msc) is fine for one-off changes; PowerShell is the only sane way to do it repeatably.

Prerequisites

• Windows Server 2019 / 2022 with an administrator account.
• A PowerShell session running as administrator.

Step 1: Confirm the firewall is on

Get-NetFirewallProfile | Format-Table Name, Enabled

All three profiles (Domain, Private, Public) should report True. If not:

Set-NetFirewallProfile -Profile Domain,Private,Public -Enabled True

Step 2: Allow a port (inbound)

Allow HTTPS to a web server:

New-NetFirewallRule `
    -DisplayName "HTTPS Inbound" `
    -Direction Inbound `
    -Action Allow `
    -Protocol TCP `
    -LocalPort 443 `
    -Profile Any

Allow RDP from a single subnet only:

New-NetFirewallRule `
    -DisplayName "RDP from corp subnet" `
    -Direction Inbound `
    -Action Allow `
    -Protocol TCP `
    -LocalPort 3389 `
    -RemoteAddress 10.0.10.0/24

Block an outbound destination:

New-NetFirewallRule `
    -DisplayName "Block bad.example.com out" `
    -Direction Outbound `
    -Action Block `
    -RemoteAddress 203.0.113.55/32

Step 3: List and inspect rules

# All rules
Get-NetFirewallRule | Where-Object Enabled -eq True | Sort-Object Direction

# Just one
Get-NetFirewallRule -DisplayName "HTTPS Inbound"

# Rule + its port + address detail
$r = Get-NetFirewallRule -DisplayName "HTTPS Inbound"
$r | Get-NetFirewallPortFilter
$r | Get-NetFirewallAddressFilter

Step 4: Modify an existing rule

Set-NetFirewallRule -DisplayName "HTTPS Inbound" -RemoteAddress 10.0.0.0/8
Disable-NetFirewallRule -DisplayName "HTTPS Inbound"
Enable-NetFirewallRule  -DisplayName "HTTPS Inbound"

Step 5: Delete a rule

Remove-NetFirewallRule -DisplayName "HTTPS Inbound"

For a clean slate (lab only — do not run on production):

Get-NetFirewallRule | Where-Object DisplayName -like "Test*" | Remove-NetFirewallRule

Step 6: Enable application logging

Useful when a connection should work but doesn't:

Set-NetFirewallProfile -Profile Public `
    -LogAllowed True -LogBlocked True -LogIgnored True `
    -LogFileName "%systemroot%\system32\LogFiles\Firewall\pfirewall.log" `
    -LogMaxSizeKilobytes 8192

Get-Content "$env:windir\system32\LogFiles\Firewall\pfirewall.log" -Tail 30 -Wait

Verify

Test-NetConnection www.example.sa -Port 443
Get-NetTCPConnection -State Listen | Sort-Object LocalPort
Get-NetFirewallRule -Enabled True | Measure-Object

Conclusion

PowerShell rules are scriptable, source-controllable, and idempotent — three properties the GUI cannot give you. For repeatable lab/production roll-outs, build a firewall.ps1 and check it into git alongside the Windows DSC.

Next steps

• Install the OS itself with Install Windows Server 2022.
• Promote it to a DC via Active Directory promotion.
• Schedule maintenance with Windows Task Scheduler.