2

I'm using the following command in a powershell script to add a firewall rule to open port 80 for a webserver.

netsh advfirewall firewall add rule name= "RemoteData Open Port 80 in" dir=in action=allow protocol=TCP localport=80

This however always adds a rule, which causes me to create subsequent rules when i run the script again. I do not want this, I want 1 rule even when executing my script multiple times.

enter image description here

I also tried to use set new rather than add but that requires the rule to already be present - it does not add a new rule if no such rule can be found:

netsh advfirewall firewall set new rule name= "RemoteData Open Port 80 in" dir=in action=allow protocol=TCP localport=80

enter image description here

Powershell script i'm using is nothing interesting:

function New-FirewallRule
{
    # NOTE add creates a new rule each time
    Write-Host Creating new firewall rule '"RemoteData Open Port 80 in"'
    & netsh advfirewall firewall set rule name= "RemoteData Open Port 80 in" dir=in action=allow protocol=TCP localport=80
   
    # Below is uncommented and can be uncommented when needed.
    # Write-Host Creating new firewall rule '"RemoteData Open Port 80 out"'
    # & netsh advfirewall firewall add rule name= "RemoteData Open Port 80 out" dir=out action=allow protocol=TCP localport=80
}

function Run-Main {
    
    Run-PreFlightCheck
    
    New-FirewallRule
}
2
  • 2
    I don't really have experience managing Windows Firewall with command line tools, but PowerShells Get/Set/New/-NetFirewallRule look way more promising than their Batch counterparts. run get-command *NetFirewallRule* or even get-command -m NetSecurity
    – SimonS
    Feb 10, 2021 at 13:10
  • @SimonS Hiya. Hm.. you're right, however the current solution seems to work as it should. Interesting for future readers however. I remember at some point also taking a very brief look at the powershell options but i wrote them off for some reason, likely because again this was quicker and more familiar.
    – sommmen
    Feb 10, 2021 at 13:41

3 Answers 3

1

You may use this snippet in your PowerShell script to check if the rule already exists:

if (netsh advfirewall firewall show rule name="RemoteData Open Port 80 in" -contains "No rules match the specified criteria.")
{
  netsh advfirewall firewall set new rule name= "RemoteData Open Port 80 in" dir=in action=allow protocol=TCP localport=80
}
1
  • I'm amazed there is no option to add or update the service or something. I'll try this now.
    – sommmen
    Feb 10, 2021 at 11:27
2

You could first check if the firewall rule already exists, and create it only if it doesn't.

netsh advfirewall firewall show rule "RemoteData Open Port 80 in"

If it does not exist, you will get

No rules match the specified criteria.

If it does, it returns the rule's properties.

5
  • Welcome to SU. I suggest that checking the existing answers before answering would help avoid awkward situations.
    – harrymc
    Feb 10, 2021 at 11:03
  • @harrymc I was already writing my answer when you posted yours. The page didn't update so I didn't realize. Feb 10, 2021 at 13:59
  • When you see an informative message that an answer was posted, it's prudent to click to see the new answer - as somebody might just have been faster.
    – harrymc
    Feb 10, 2021 at 14:51
  • 1
    Not shown in mobile. Feb 10, 2021 at 15:47
  • 1
    Unfortunate. Have a nice day.
    – harrymc
    Feb 10, 2021 at 16:20
0

The answer from harrymc worked. I've opted to delete the rule beforehand, to be homogenous with another part of the script. Here's the adapted code for that:

function New-FirewallRule
{
    # NOTE add creates a new rule each time
    Write-Host Creating new firewall rule $FireWallRuleName

    if ((& netsh advfirewall firewall show rule name= `"$FireWallRuleName`") -notcontains "No rules match the specified criteria.")
    {
        Write-Host $FireWallRuleName already exists and will be deleted prior to starting
        Write-Host (& netsh advfirewall firewall delete rule name= `"$FireWallRuleName`")
    }

    Write-Host (& netsh advfirewall firewall add rule name= "RemoteData Open Port 80 in" dir=in action=allow protocol=TCP localport=80)
   
    # Below is uncommented and can be uncommented when needed.
    # Write-Host Creating new firewall rule '"RemoteData Open Port 80 out"'
    # & netsh advfirewall firewall add rule name= "RemoteData Open Port 80 out" dir=out action=allow protocol=TCP localport=80
}

Do note that if you have multiple rules with the same name, this will delete all of them. I consider this a feature.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .