11 out of 19 rated this helpful - Rate this topic
Published: December 17, 2004

The following Netsh commands can be used in scripts or at the command line to configure Windows Firewall for IPv4 and IPv6 traffic when executed from the netsh firewall context:

  • add allowedprogram

  • set allowedprogram

  • delete allowedprogram

  • set icmpsetting

  • set multicastbroadcastresponse

  • set notifications

  • set logging

  • set opmode

  • add portopening

  • set portopening

  • delete portopening

  • set service

  • show commands

  • reset

The following sections describe each command and its syntax.

On This Page

add allowedprogram

set allowedprogram

delete allowedprogram

set icmpsetting

set multicastbroadcastresponse

set notifications

set logging

set opmode

add portopening

set portopening

delete portopening

set service

show commands

reset

add allowedprogram

Used to add a program-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

add allowedprogram

    [ program = ] path

    [ name = ] name

    [ [ mode = ] ENABLE|DISABLE

      [ scope = ] ALL|SUBNET|CUSTOM

      [ addresses = ] addresses

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Adds firewall allowed program configuration.

 Parameters:

 program - Program path and file name.

 name - Program name.

 mode - Program mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Program scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet)

    traffic through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Remarks: 'scope' must be 'CUSTOM' to specify

 'addresses'.

 Examples:

    add allowedprogram C:\MyApp\MyApp.exe MyApp

    ENABLE

    add allowedprogram C:\MyApp\MyApp.exe MyApp

    DISABLE

    add allowedprogram C:\MyApp\MyApp.exe MyApp

    ENABLE CUSTOM

        157.60.0.1,172.16.0.0/16,10.0.0.0/255.

        0.0.0,LocalSubnet

    add allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = ENABLE

    add allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = DISABLE

    add allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = ENABLE

        scope = CUSTOM 157.60.0.1,172.16.0.

        0/16,10.0.0.0/255.0.0.0,LocalSubnet

set allowedprogram

Used to modify the settings of an existing program-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set allowedprogram

   [ program = ] path

   [ [ name = ] name

     [ mode = ] ENABLE|DISABLE

     [ scope = ] ALL|SUBNET|CUSTOM

     [ addresses = ] addresses

     [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Sets firewall allowed program configuration.

 Parameters:

 program - Program path and file name.

 name - Program name (optional).

 mode - Program mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Program scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet)

    traffic through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Remarks: 'scope' must be 'CUSTOM' to specify

 'addresses'.

 Examples:

    set allowedprogram C:\MyApp\MyApp.exe MyApp

    ENABLE

    set allowedprogram C:\MyApp\MyApp.exe MyApp

    DISABLE

    set allowedprogram C:\MyApp\MyApp.exe MyApp

    ENABLE CUSTOM

        157.60.0.1,172.16.0.0/16,10.0.0.0

        /255.0.0.0,LocalSubnet

    set allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = ENABLE

    set allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = DISABLE

    set allowedprogram program = C:\MyApp

     \MyApp.exe name = MyApp mode = ENABLE

        scope = CUSTOM 157.60.0.1,172.16.

        0.0/16,10.0.0.0/255.0.0.0,LocalSubnet

delete allowedprogram

Used to delete an existing program-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

delete allowedprogram

    [ program = ] path

    [ [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

  Deletes firewall allowed program configuration.

  Parameters:

  program - Program path and file name.

  profile - Configuration profile (optional).

     CURRENT  - Current profile (default).

     DOMAIN   - Domain profile.

     STANDARD - Standard profile.

     ALL      - All profiles.

  Examples:

     delete allowedprogram C:\MyApp\MyApp.exe

     delete allowedprogram program = C:\MyApp

     \MyApp.exe

set icmpsetting

Used to specify excepted ICMP traffic.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set icmpsetting

    [ type = ] 2-5|8-9|11-13|17|ALL

    [ [ mode = ] ENABLE|DISABLE

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Sets firewall ICMP configuration.

 Parameters:

 type - ICMP type.

    2   - Allow outbound packet too big.

    3   - Allow outbound destination unreachable.

    4   - Allow outbound source quench.

    5   - Allow redirect.

    8   - Allow inbound echo request.

    9   - Allow inbound router request.

    11  - Allow outbound time exceeded.

    12  - Allow outbound parameter problem.

    13  - Allow inbound timestamp request.

    17  - Allow inbound mask request.

    ALL - All types.

 mode - ICMP mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not be

           specified together.

          'type' 2 and 'interface' may not

           be specified together.

 Examples:

    set icmpsetting 8

    set icmpsetting 8 ENABLE

    set icmpsetting ALL DISABLE

    set icmpsetting type = 8

    set icmpsetting type = 8 mode = ENABLE

    set icmpsetting type = ALL mode = DISABLE

set multicastbroadcastresponse

Used to specify the unicast response to a multicast or broadcast request behavior.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set multicastbroadcastresponse

    [ mode = ] ENABLE|DISABLE

    [ [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Sets firewall multicast/broadcast response

 configuration.

 Parameters:

 mode - Multicast/broadcast response mode.

    ENABLE  - Allow responses to multicast/broadcast

              traffic through the firewall.

    DISABLE - Do not allow responses to multicast

              /broadcast traffic through the firewall.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Examples:

    set multicastbroadcastresponse ENABLE

    set multicastbroadcastresponse DISABLE

    set multicastbroadcastresponse mode = ENABLE

    set multicastbroadcastresponse mode = DISABLE

set notifications

Used to specify the notification behavior.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set notifications

    [ mode = ] ENABLE|DISABLE

    [ [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Sets firewall notification configuration.

 Parameters:

 mode - Notification mode.

    ENABLE  - Allow pop-up notifications from

    firewall.

    DISABLE - Do not allow pop-up notifications

    from firewall.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Examples:

    set notifications ENABLE

    set notifications DISABLE

    set notifications mode = ENABLE

    set notifications mode = DISABLE

set logging

Used to specify logging options.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set logging

    [ [ filelocation = ] path

      [ maxfilesize = ] 1-32767

      [ droppedpackets = ] ENABLE|DISABLE

      [ connections = ] ENABLE|DISABLE ]

 Sets firewall logging configuration.

 Parameters:

 filelocation - Log path and file name (optional).

 maxfilesize - Maximum log file size in kilobytes

 (optional).

 droppedpackets - Dropped packet log mode (optional).

    ENABLE  - Log in firewall.

    DISABLE - Do not log in firewall.

 connections - Successful connection log mode

 (optional).

    ENABLE  - Log in firewall.

    DISABLE - Do not log in firewall.

 Remarks: At least one parameter must be specified.

 Examples:

    set logging %windir%\pfirewall.log 4096

    set logging %windir%\pfirewall.log 4096 ENABLE

    set logging filelocation = %windir%\pfirewall.

    log maxfilesize = 4096

    set logging filelocation = %windir%\pfirewall.

    log maxfilesize = 4096

        droppedpackets = ENABLE

set opmode

Used to specify the operating mode of Windows Firewall either globally or for a specific connection (interface).

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set opmode

    [ mode = ] ENABLE|DISABLE

    [ [ exceptions = ] ENABLE|DISABLE

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Sets firewall operational configuration.

 Parameters:

 mode - Operational mode.

    ENABLE  - Enable firewall.

    DISABLE - Disable firewall.

 exceptions - Exception mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not be

           specified together.

          'exceptions' and 'interface'

           may not be specified together.

 Examples:

    set opmode ENABLE

    set opmode ENABLE DISABLE

    set opmode mode = ENABLE

    set opmode mode = ENABLE exceptions = DISABLE

add portopening

Used to create a port-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

add portopening

    [ protocol = ] TCP|UDP|ALL

    [ port = ] 1-65535

    [ name = ] name

    [ [ mode = ] ENABLE|DISABLE

      [ scope = ] ALL|SUBNET|CUSTOM

      [ addresses = ] addresses

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Adds firewall port configuration.

 Parameters:

 protocol - Port protocol.

    TCP - Transmission Control Protocol (TCP).

    UDP - User Datagram Protocol (UDP).

    ALL - All protocols.

 port - Port number.

 name - Port name.

 mode - Port mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Port scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet)

    traffic through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not

            be specified together.

           'scope' and 'interface' may

            not be specified together.

           'scope' must be 'CUSTOM' to

            specify 'addresses'.

 Examples:

    add portopening TCP 80 MyWebPort

    add portopening UDP 500 IKE ENABLE ALL

    add portopening ALL 53 DNS ENABLE CUSTOM

        157.60.0.1,172.16.0.0/16,10.0.0.0/255.

        0.0.0,LocalSubnet

    add portopening protocol = TCP port = 80 name =

    MyWebPort

    add portopening protocol = UDP port = 500 name =

    IKE mode = ENABLE scope =  ALL

    add portopening protocol = ALL port = 53 name =

    DNS mode = ENABLE

      scope = CUSTOM addresses = 157.60.0.1,172.16.

      0.0/16,10.0.0.0/255.0.0.0,LocalSubnet

set portopening

Used to modify the settings of an existing port-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set portopening

    [ protocol = ] TCP|UDP|ALL

    [ port = ] 1-65535

    [ [ name = ] name

      [ mode = ] ENABLE|DISABLE

      [ scope = ] ALL|SUBNET|CUSTOM

      [ addresses = ] addresses

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Sets firewall port configuration.

 Parameters:

 protocol - Port protocol.

    TCP - Transmission Control Protocol (TCP).

    UDP - User Datagram Protocol (UDP).

    ALL - All protocols.

 port - Port number.

 name - Port name (optional).

 mode - Port mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Port scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet)

    traffic through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not

 be specified together.

        'scope' and 'interface' may not

         be specified together.

        'scope' must be 'CUSTOM' to specify

         'addresses'.

 Examples:

    set portopening TCP 80 MyWebPort

    set portopening UDP 500 IKE ENABLE ALL

    set portopening ALL 53 DNS ENABLE CUSTOM

      157.60.0.1,172.16.0.0/16,10.0.0.0/255.

      0.0.0,LocalSubnet

    set portopening protocol = TCP port = 80

    name = MyWebPort

    set portopening protocol = UDP port = 500

    name = IKE mode = ENABLE scope = ALL

    set portopening protocol = ALL port = 53

    name = DNS mode = ENABLE

      scope = CUSTOM addresses = 157.60.0.1,

      172.16.0.0/16,10.0.0.0/255.0.0.0,LocalSubnet

delete portopening

Used to delete an existing port-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

delete portopening

    [ protocol = ] TCP|UDP|ALL

    [ port = ] 1-65535

    [ [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Deletes firewall port configuration.

 Parameters:

 protocol - Port protocol.

    TCP - Transmission Control Protocol (TCP).

    UDP - User Datagram Protocol (UDP).

    ALL - All protocols.

 port - Port number.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not

 be specified together.

 Examples:

    delete portopening TCP 80

    delete portopening UDP 500

    delete portopening protocol = TCP port = 80

    delete portopening protocol = UDP port = 500

set service

Used to enable or disable the pre-defined file and printer sharing, remote administration, remote desktop, and UPnP exceptions.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set service

    [ type = ] FILEANDPRINT|REMOTEADMIN|

    REMOTEDESKTOP|UPNP|ALL

    [ [ mode = ] ENABLE|DISABLE

      [ scope = ] ALL|SUBNET|CUSTOM

      [ addresses = ] addresses

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Sets firewall service configuration.

 Parameters:

 type - Service type.

    FILEANDPRINT  - File and printer sharing.

    REMOTEADMIN   - Remote administration.

    REMOTEDESKTOP - Remote assistance and remote

    desktop.

    UPNP          - UPnP framework.

    ALL           - All types.

 mode - Service mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Service scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet) traffic

    through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Remarks: 'scope' ignored if 'mode' is DISABLE.

         'scope' must be 'CUSTOM' to specify

        'addresses'.

 Examples:

    set service FILEANDPRINT

    set service REMOTEADMIN ENABLE SUBNET

    set service REMOTEDESKTOP ENABLE CUSTOM

        157.60.0.1,172.16.0.0/16,10.0.0.0/255.

        0.0.0,LocalSubnet

    set service type = FILEANDPRINT

    set service type = REMOTEADMIN mode = ENABLE

    scope = SUBNET

    set service type = REMOTEDESKTOP mode = ENABLE

    scope = CUSTOM

        addresses = 157.60.0.1,172.16.0.0/16,10.

        0.0.0/255.0.0.0,LocalSubnet

show commands

The following show commands are used to display the current configuration:

  • show allowedprogram  Displays the excepted programs.

  • show config   Displays the local configuration information.

  • show currentprofile  Displays the current profile.

  • show icmpsetting  Displays the ICMP settings.

  • show logging   Displays the logging settings.

  • show multicastbroadcastresponse  Displays multicast/broadcast response settings.

  • show notifications Displays the current settings for notifications.

  • show opmode  Displays the operational mode.

  • show portopening  Displays the excepted ports.

  • show service  Displays the services.

  • show state  Displays the current state information.

For additional information about the show config and show state commands, see Troubleshooting Windows Firewall in Microsoft Windows XP Service Pack 2.

https://technet.microsoft.com/en-us/library/bb490617.aspx

Appendix B: Netsh Command Syntax for the Netsh Firewall Context的更多相关文章

  1. 在Win10中手动添加/修改本地IP

    1 前言 好久没动Win10了... 今天需要用Win10做一下实验,手动修改IP,于是写下了这篇文章作为过程记录. 2 概述 Win10里面修改本地IP不是一件特别困难的事,简单来说可以分为两种方式 ...

  2. netsh

    NetSH (Network Shell) 是windows系统本身提供的功能强大的网络配置命令行工具. 导出配置脚本:netsh -c interface ip dump > c:\inter ...

  3. windows 7 netsh wlan命令连接wifi

    显示本机保存的profiles,配置文件是以wifi的ssid命名的. netsh wlan show profiles 用netsh wlan connect name=00_1111 连接其中一个 ...

  4. Delphi 调用netsh命令修改IP地址

    Delphi 调用netsh命令修改IP地址 先介绍一下Netsh命令的使用方法: 在这里跟大家介绍几个简单的指令 1.Show IP 1.1Cmd Mode 直接在cmd下面输入 netsh int ...

  5. NETSH WINSOCK RESET这条命令的含义和作用？

    简单来说netsh winsock reset命令含义是重置 Winsock 文件夹.假设一台机器上的Winsock协议配置有问题的话将会导致网络连接等问题,就须要用netsh winsock res ...

  6. NETSH WINSOCK RESET这个命令的意义和效果？

    简要地netsh winsock reset命令含义复位 Winsock 文件夹.一机多用的假设Winsock协议配置问题,那么问题会导致网络连接,我们需要使用netsh winsock reset命 ...

  7. Netsh 命令详解

    1. help帮助指南 2. 常用命令介绍netsh interface ip show addressnetsh interface ip dumpnetsh interface ip dump & ...

  8. windows下端口转发 netsh

    添加映射表: netsh interface portproxy add v4tov4 listenport=(监听端口) connectaddress=(虚机IP) connectport=(虚机端 ...

  9. cmd 与 网卡（netsh 命令）

    1. 通过命令提示符(cmd)命令连接 Wi-Fi 1.1 连接曾经连接过的 Wi-Fi :: 查看配置的列表(::表示注释) netsh wlan show profile :: 连接 netsh ...

随机推荐

  1. [RK3288][Android6.0] U-boot 启动流程小结【转】

    本文转载自:http://blog.csdn.net/kris_fei/article/details/52536093 Platform: RK3288OS: Android 6.0Version: ...

  2. media type

    https://www.sitepoint.com/mime-types-complete-list/ application/base64 https://github.com/dotnet/doc ...

  3. Python 38 注册和修改密码

    一:注册系统服务 1.添加环境变量:桌面点击我的电脑------>右键属性------>双击高级系统设置------>点击环境变量------>找到在系统变量中的Path后双击 ...

  4. [Swift]实现优先队列PriorityQueue

    ★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★★➤微信公众号:山青咏芝(shanqingyongzhi)➤博客园地址:山青咏芝(https://www.cnblogs. ...

  5. C#,Java,MD5加密对等实现

    1.c#实现 /* *加密生成MD5 */ public static String MD5(string s) { ', 'a', 'b', 'c', 'd', 'e', 'f' }; MD5 md ...

  6. Win10切换JDK版本

    开发项目由于使用JDK版本不同,来回配置环境变量有点繁琐,用了一天百度得到的方法 1:安装不同版本的JDK,这个应该都可以完成 2:配置环境变量 CLASSPATH.;%JAVA_HOME%\lib\ ...

  7. sql 添加列并设置默认值

    ALTER TABLE tablsename ADD fieldname BIT NULL DEFAULT

  8. Spring Boot (6) Spring Data JPA

    JPA 全称Java Persistence API,JPA通过JDK 5.0注解或xml描述对象-关系表的映射关系,并将运行期的实体对象持久化到数据库中 JPA是sun官方提出的java持久化规范, ...

  9. 5.30获取openid和createTime--mybatis自动生成接口和映射【这里需要自定义】

    自定义sql获取数据:        dao:            前提是反向成了代码:                A : 接口PhoneModelMapper extends IBaseMap ...

  10. javascript中计算点击多少次

    点击事件:onclick <!DOCTYPE html> <html lang="en"> <head> <meta charset=&q ...