A walk through Windows Firewall & Netsh commands

Rhydham Joshi

M.S. in Software Engineering, San Jose State University

Phone : (+1) 408-987-1991 | Email : rhydham.joshi@yahoo.com

Blog : malwareforensics1.blogspot.com | Linkedin : www.linkedin.com/in/rhydhamjoshi

Contents: Navigation to firewall settings Firewall Tabs:

• Allow an app or feature through firewall• Change notification settings• Turn Windows Firewall on/off• Restore defaults• Advanced settings

Windows Firewall with Advanced Security Tabs: Activate logging for allowed/denied traffic Inbound and outbound rules in brief Monitoring Tab: The things we need to take care about

• Firewall• Logs Exploration

Netsh commands References

Navigation to Firewall settings• Control Panel -> System and Security -> Windows Firewall• Run command : firewall.cpl• Type : Windows Firewall in Windows search box.

Allow an app or feature through windows firewall

• Allow/Deny any app/services in Private/Public network

Allow an app or feature through windows firewall

Change Notification Settings &Turn Windows Firewall on or off

Advanced Settings:

Tabs: Windows Firewall with Advanced Security

Activate Logging for allowed/denied traffic

• In Domain Profile Tab Logging Customize See the dialog box for “Customize Logging Settings for the Domain Profile”• Click YES for “Log Dropped Packets” & “Log Successful Connections”• Repeat steps for “Private Profile” & “Public Profile”

Activate Logging for allowed/denied traffic

Inbound Rules and Outbound Rules

Inbound & Outbound Rules

Inbound & Outbound Rules

Inbound & Outbound Rules

Inbound & Outbound Rules

Inbound & Outbound Rules

Inbound & Outbound Rules

Inbound & Outbound Rules

Inbound & Outbound Rules

Monitoring: The thing “WE” need to care about

Monitoring Firewall

Explore the logs

Network shell commands

• Import/Export Firewall Settings• Enable Remote Desktop

Connection• Enable a program• Enable/disable a port• Enable Remote Management• Allow/Disallow Ping• Change Logging path• Restore Defaults • Enable/disable Windows Firewall• Query Firewall logs

Netsh Commands Reference Links:

Netsh Commands reference link:https://technet.microsoft.com/en-us/library/cc732279(v=ws.10).aspxNetsh Commands for Windows Firewall:https://technet.microsoft.com/en-us/library/cc771046(v=ws.10).aspxNetsh Commands for Windows Firewall and Advanced Security:https://technet.microsoft.com/en-us/library/cc771920(v=ws.10).aspxTop 10 Netsh firewall commands:http://windowsitpro.com/windows-server/top-10-windows-firewall-netsh-commands

Thank you.!