Windows Firewall control from the CMD line

One of the key things we do in Incident Response is avoid using the GUI if at all possible, we can also fall victim to the Windows Firewall blocking our remote connections. More as an memory jogger I thought I would publish the below list of Windows Firewall commands that will allow us to control the Firewall from the command line.

Windows XP

Show Firewall Status

netsh firewall show opmode (Can be redirected to record current state using > fw_state.txt)

Turn off Firewall

netsh firewall set opmode disable

Open Port for Imaging Tool

netsh firewall add portopening TCP 8888 netcat enable subnet

Delete Opened Port

netsh firewall delete portopening protocol=TCP port=8888

Turn Firewall on

netsh firewall set opmode enable

Windows Vista/Windows Server 2008

Show Firewall Status

netsh firewall show opmode

Turn Firewall Off

netsh advfirewall set currentprofile state off

Open Port for Imaging Tool

netsh advfirewall firewall add rule name=netcat dir=in action=allow protocol=TCP localport=8888

Delete Opened Port

netsh advfirewall firewall delete rule name=netcat protocol=TCP localport=8888

Turn Firewall on

netsh advfirewall set currentprofile state on