11 out of 19 rated this helpful - Rate this topic
Published: December 17, 2004

The following Netsh commands can be used in scripts or at the command line to configure Windows Firewall for IPv4 and IPv6 traffic when executed from the netsh firewall context:

  • add allowedprogram

  • set allowedprogram

  • delete allowedprogram

  • set icmpsetting

  • set multicastbroadcastresponse

  • set notifications

  • set logging

  • set opmode

  • add portopening

  • set portopening

  • delete portopening

  • set service

  • show commands

  • reset

The following sections describe each command and its syntax.

On This Page

add allowedprogram

set allowedprogram

delete allowedprogram

set icmpsetting

set multicastbroadcastresponse

set notifications

set logging

set opmode

add portopening

set portopening

delete portopening

set service

show commands

reset

add allowedprogram

Used to add a program-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

add allowedprogram

    [ program = ] path

    [ name = ] name

    [ [ mode = ] ENABLE|DISABLE

      [ scope = ] ALL|SUBNET|CUSTOM

      [ addresses = ] addresses

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Adds firewall allowed program configuration.

 Parameters:

 program - Program path and file name.

 name - Program name.

 mode - Program mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Program scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet)

    traffic through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Remarks: 'scope' must be 'CUSTOM' to specify

 'addresses'.

 Examples:

    add allowedprogram C:\MyApp\MyApp.exe MyApp

    ENABLE

    add allowedprogram C:\MyApp\MyApp.exe MyApp

    DISABLE

    add allowedprogram C:\MyApp\MyApp.exe MyApp

    ENABLE CUSTOM

        157.60.0.1,172.16.0.0/16,10.0.0.0/255.

        0.0.0,LocalSubnet

    add allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = ENABLE

    add allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = DISABLE

    add allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = ENABLE

        scope = CUSTOM 157.60.0.1,172.16.0.

        0/16,10.0.0.0/255.0.0.0,LocalSubnet

set allowedprogram

Used to modify the settings of an existing program-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set allowedprogram

   [ program = ] path

   [ [ name = ] name

     [ mode = ] ENABLE|DISABLE

     [ scope = ] ALL|SUBNET|CUSTOM

     [ addresses = ] addresses

     [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Sets firewall allowed program configuration.

 Parameters:

 program - Program path and file name.

 name - Program name (optional).

 mode - Program mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Program scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet)

    traffic through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Remarks: 'scope' must be 'CUSTOM' to specify

 'addresses'.

 Examples:

    set allowedprogram C:\MyApp\MyApp.exe MyApp

    ENABLE

    set allowedprogram C:\MyApp\MyApp.exe MyApp

    DISABLE

    set allowedprogram C:\MyApp\MyApp.exe MyApp

    ENABLE CUSTOM

        157.60.0.1,172.16.0.0/16,10.0.0.0

        /255.0.0.0,LocalSubnet

    set allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = ENABLE

    set allowedprogram program = C:\MyApp

    \MyApp.exe name = MyApp mode = DISABLE

    set allowedprogram program = C:\MyApp

     \MyApp.exe name = MyApp mode = ENABLE

        scope = CUSTOM 157.60.0.1,172.16.

        0.0/16,10.0.0.0/255.0.0.0,LocalSubnet

delete allowedprogram

Used to delete an existing program-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

delete allowedprogram

    [ program = ] path

    [ [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

  Deletes firewall allowed program configuration.

  Parameters:

  program - Program path and file name.

  profile - Configuration profile (optional).

     CURRENT  - Current profile (default).

     DOMAIN   - Domain profile.

     STANDARD - Standard profile.

     ALL      - All profiles.

  Examples:

     delete allowedprogram C:\MyApp\MyApp.exe

     delete allowedprogram program = C:\MyApp

     \MyApp.exe

set icmpsetting

Used to specify excepted ICMP traffic.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set icmpsetting

    [ type = ] 2-5|8-9|11-13|17|ALL

    [ [ mode = ] ENABLE|DISABLE

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Sets firewall ICMP configuration.

 Parameters:

 type - ICMP type.

    2   - Allow outbound packet too big.

    3   - Allow outbound destination unreachable.

    4   - Allow outbound source quench.

    5   - Allow redirect.

    8   - Allow inbound echo request.

    9   - Allow inbound router request.

    11  - Allow outbound time exceeded.

    12  - Allow outbound parameter problem.

    13  - Allow inbound timestamp request.

    17  - Allow inbound mask request.

    ALL - All types.

 mode - ICMP mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not be

           specified together.

          'type' 2 and 'interface' may not

           be specified together.

 Examples:

    set icmpsetting 8

    set icmpsetting 8 ENABLE

    set icmpsetting ALL DISABLE

    set icmpsetting type = 8

    set icmpsetting type = 8 mode = ENABLE

    set icmpsetting type = ALL mode = DISABLE

set multicastbroadcastresponse

Used to specify the unicast response to a multicast or broadcast request behavior.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set multicastbroadcastresponse

    [ mode = ] ENABLE|DISABLE

    [ [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Sets firewall multicast/broadcast response

 configuration.

 Parameters:

 mode - Multicast/broadcast response mode.

    ENABLE  - Allow responses to multicast/broadcast

              traffic through the firewall.

    DISABLE - Do not allow responses to multicast

              /broadcast traffic through the firewall.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Examples:

    set multicastbroadcastresponse ENABLE

    set multicastbroadcastresponse DISABLE

    set multicastbroadcastresponse mode = ENABLE

    set multicastbroadcastresponse mode = DISABLE

set notifications

Used to specify the notification behavior.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set notifications

    [ mode = ] ENABLE|DISABLE

    [ [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Sets firewall notification configuration.

 Parameters:

 mode - Notification mode.

    ENABLE  - Allow pop-up notifications from

    firewall.

    DISABLE - Do not allow pop-up notifications

    from firewall.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Examples:

    set notifications ENABLE

    set notifications DISABLE

    set notifications mode = ENABLE

    set notifications mode = DISABLE

set logging

Used to specify logging options.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set logging

    [ [ filelocation = ] path

      [ maxfilesize = ] 1-32767

      [ droppedpackets = ] ENABLE|DISABLE

      [ connections = ] ENABLE|DISABLE ]

 Sets firewall logging configuration.

 Parameters:

 filelocation - Log path and file name (optional).

 maxfilesize - Maximum log file size in kilobytes

 (optional).

 droppedpackets - Dropped packet log mode (optional).

    ENABLE  - Log in firewall.

    DISABLE - Do not log in firewall.

 connections - Successful connection log mode

 (optional).

    ENABLE  - Log in firewall.

    DISABLE - Do not log in firewall.

 Remarks: At least one parameter must be specified.

 Examples:

    set logging %windir%\pfirewall.log 4096

    set logging %windir%\pfirewall.log 4096 ENABLE

    set logging filelocation = %windir%\pfirewall.

    log maxfilesize = 4096

    set logging filelocation = %windir%\pfirewall.

    log maxfilesize = 4096

        droppedpackets = ENABLE

set opmode

Used to specify the operating mode of Windows Firewall either globally or for a specific connection (interface).

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set opmode

    [ mode = ] ENABLE|DISABLE

    [ [ exceptions = ] ENABLE|DISABLE

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Sets firewall operational configuration.

 Parameters:

 mode - Operational mode.

    ENABLE  - Enable firewall.

    DISABLE - Disable firewall.

 exceptions - Exception mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not be

           specified together.

          'exceptions' and 'interface'

           may not be specified together.

 Examples:

    set opmode ENABLE

    set opmode ENABLE DISABLE

    set opmode mode = ENABLE

    set opmode mode = ENABLE exceptions = DISABLE

add portopening

Used to create a port-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

add portopening

    [ protocol = ] TCP|UDP|ALL

    [ port = ] 1-65535

    [ name = ] name

    [ [ mode = ] ENABLE|DISABLE

      [ scope = ] ALL|SUBNET|CUSTOM

      [ addresses = ] addresses

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Adds firewall port configuration.

 Parameters:

 protocol - Port protocol.

    TCP - Transmission Control Protocol (TCP).

    UDP - User Datagram Protocol (UDP).

    ALL - All protocols.

 port - Port number.

 name - Port name.

 mode - Port mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Port scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet)

    traffic through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not

            be specified together.

           'scope' and 'interface' may

            not be specified together.

           'scope' must be 'CUSTOM' to

            specify 'addresses'.

 Examples:

    add portopening TCP 80 MyWebPort

    add portopening UDP 500 IKE ENABLE ALL

    add portopening ALL 53 DNS ENABLE CUSTOM

        157.60.0.1,172.16.0.0/16,10.0.0.0/255.

        0.0.0,LocalSubnet

    add portopening protocol = TCP port = 80 name =

    MyWebPort

    add portopening protocol = UDP port = 500 name =

    IKE mode = ENABLE scope =  ALL

    add portopening protocol = ALL port = 53 name =

    DNS mode = ENABLE

      scope = CUSTOM addresses = 157.60.0.1,172.16.

      0.0/16,10.0.0.0/255.0.0.0,LocalSubnet

set portopening

Used to modify the settings of an existing port-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set portopening

    [ protocol = ] TCP|UDP|ALL

    [ port = ] 1-65535

    [ [ name = ] name

      [ mode = ] ENABLE|DISABLE

      [ scope = ] ALL|SUBNET|CUSTOM

      [ addresses = ] addresses

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Sets firewall port configuration.

 Parameters:

 protocol - Port protocol.

    TCP - Transmission Control Protocol (TCP).

    UDP - User Datagram Protocol (UDP).

    ALL - All protocols.

 port - Port number.

 name - Port name (optional).

 mode - Port mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Port scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet)

    traffic through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not

 be specified together.

        'scope' and 'interface' may not

         be specified together.

        'scope' must be 'CUSTOM' to specify

         'addresses'.

 Examples:

    set portopening TCP 80 MyWebPort

    set portopening UDP 500 IKE ENABLE ALL

    set portopening ALL 53 DNS ENABLE CUSTOM

      157.60.0.1,172.16.0.0/16,10.0.0.0/255.

      0.0.0,LocalSubnet

    set portopening protocol = TCP port = 80

    name = MyWebPort

    set portopening protocol = UDP port = 500

    name = IKE mode = ENABLE scope = ALL

    set portopening protocol = ALL port = 53

    name = DNS mode = ENABLE

      scope = CUSTOM addresses = 157.60.0.1,

      172.16.0.0/16,10.0.0.0/255.0.0.0,LocalSubnet

delete portopening

Used to delete an existing port-based exception.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

delete portopening

    [ protocol = ] TCP|UDP|ALL

    [ port = ] 1-65535

    [ [ profile = ] CURRENT|DOMAIN|STANDARD|ALL

      [ interface = ] name ]

 Deletes firewall port configuration.

 Parameters:

 protocol - Port protocol.

    TCP - Transmission Control Protocol (TCP).

    UDP - User Datagram Protocol (UDP).

    ALL - All protocols.

 port - Port number.

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 interface - Interface name (optional).

 Remarks: 'profile' and 'interface' may not

 be specified together.

 Examples:

    delete portopening TCP 80

    delete portopening UDP 500

    delete portopening protocol = TCP port = 80

    delete portopening protocol = UDP port = 500

set service

Used to enable or disable the pre-defined file and printer sharing, remote administration, remote desktop, and UPnP exceptions.

Syntax:

Note Some parts of the following code snippet
have been displayed in multiple lines only for better readability.
These should be entered in a single line.

set service

    [ type = ] FILEANDPRINT|REMOTEADMIN|

    REMOTEDESKTOP|UPNP|ALL

    [ [ mode = ] ENABLE|DISABLE

      [ scope = ] ALL|SUBNET|CUSTOM

      [ addresses = ] addresses

      [ profile = ] CURRENT|DOMAIN|STANDARD|ALL ]

 Sets firewall service configuration.

 Parameters:

 type - Service type.

    FILEANDPRINT  - File and printer sharing.

    REMOTEADMIN   - Remote administration.

    REMOTEDESKTOP - Remote assistance and remote

    desktop.

    UPNP          - UPnP framework.

    ALL           - All types.

 mode - Service mode (optional).

    ENABLE  - Allow through firewall (default).

    DISABLE - Do not allow through firewall.

 scope - Service scope (optional).

    ALL    - Allow all traffic through firewall

    (default).

    SUBNET - Allow only local network (subnet) traffic

    through firewall.

    CUSTOM - Allow only specified traffic through

    firewall.

 addresses - Custom scope addresses (optional).

 profile - Configuration profile (optional).

    CURRENT  - Current profile (default).

    DOMAIN   - Domain profile.

    STANDARD - Standard profile.

    ALL      - All profiles.

 Remarks: 'scope' ignored if 'mode' is DISABLE.

         'scope' must be 'CUSTOM' to specify

        'addresses'.

 Examples:

    set service FILEANDPRINT

    set service REMOTEADMIN ENABLE SUBNET

    set service REMOTEDESKTOP ENABLE CUSTOM

        157.60.0.1,172.16.0.0/16,10.0.0.0/255.

        0.0.0,LocalSubnet

    set service type = FILEANDPRINT

    set service type = REMOTEADMIN mode = ENABLE

    scope = SUBNET

    set service type = REMOTEDESKTOP mode = ENABLE

    scope = CUSTOM

        addresses = 157.60.0.1,172.16.0.0/16,10.

        0.0.0/255.0.0.0,LocalSubnet

show commands

The following show commands are used to display the current configuration:

  • show allowedprogram  Displays the excepted programs.

  • show config   Displays the local configuration information.

  • show currentprofile  Displays the current profile.

  • show icmpsetting  Displays the ICMP settings.

  • show logging   Displays the logging settings.

  • show multicastbroadcastresponse  Displays multicast/broadcast response settings.

  • show notifications Displays the current settings for notifications.

  • show opmode  Displays the operational mode.

  • show portopening  Displays the excepted ports.

  • show service  Displays the services.

  • show state  Displays the current state information.

For additional information about the show config and show state commands, see Troubleshooting Windows Firewall in Microsoft Windows XP Service Pack 2.

https://technet.microsoft.com/en-us/library/bb490617.aspx

Appendix B: Netsh Command Syntax for the Netsh Firewall Context的更多相关文章

  1. 在Win10中手动添加/修改本地IP

    1 前言 好久没动Win10了... 今天需要用Win10做一下实验,手动修改IP,于是写下了这篇文章作为过程记录. 2 概述 Win10里面修改本地IP不是一件特别困难的事,简单来说可以分为两种方式 ...

  2. netsh

    NetSH (Network Shell) 是windows系统本身提供的功能强大的网络配置命令行工具. 导出配置脚本:netsh -c interface ip dump > c:\inter ...

  3. windows 7 netsh wlan命令连接wifi

    显示本机保存的profiles,配置文件是以wifi的ssid命名的. netsh wlan show profiles 用netsh wlan connect name=00_1111 连接其中一个 ...

  4. Delphi 调用netsh命令修改IP地址

    Delphi 调用netsh命令修改IP地址 先介绍一下Netsh命令的使用方法: 在这里跟大家介绍几个简单的指令 1.Show IP 1.1Cmd Mode 直接在cmd下面输入 netsh int ...

  5. NETSH WINSOCK RESET这条命令的含义和作用？

    简单来说netsh winsock reset命令含义是重置 Winsock 文件夹.假设一台机器上的Winsock协议配置有问题的话将会导致网络连接等问题,就须要用netsh winsock res ...

  6. NETSH WINSOCK RESET这个命令的意义和效果？

    简要地netsh winsock reset命令含义复位 Winsock 文件夹.一机多用的假设Winsock协议配置问题,那么问题会导致网络连接,我们需要使用netsh winsock reset命 ...

  7. Netsh 命令详解

    1. help帮助指南 2. 常用命令介绍netsh interface ip show addressnetsh interface ip dumpnetsh interface ip dump & ...

  8. windows下端口转发 netsh

    添加映射表: netsh interface portproxy add v4tov4 listenport=(监听端口) connectaddress=(虚机IP) connectport=(虚机端 ...

  9. cmd 与 网卡（netsh 命令）

    1. 通过命令提示符(cmd)命令连接 Wi-Fi 1.1 连接曾经连接过的 Wi-Fi :: 查看配置的列表(::表示注释) netsh wlan show profile :: 连接 netsh ...

随机推荐

  1. Linux 中的键盘映射【转】

    本文转载自:http://hessian.cn/p/144.html [转]Linux 中的键盘映射 原文地址:http://www.linuxidc.com/Linux/2011-04/35197. ...

  2. java jdk 管理工具

    官网:http://www.jenv.be/ 安装: Linux / OS X $ git clone https://github.com/gcuisinier/jenv.git ~/.jenv M ...

  3. Django 安装步骤

    Django的安装和简单使用 -安装: pip3 install django==1.11.9 pycharm 下安装,选择版本号, -使用: 命令创建项目:django-admin startpro ...

  4. Codeforces 609D 被二分教做人

    传送门:http://codeforces.com/problemset/problem/609/D (如需转载,请注明出处,谢谢O(∩_∩)O) 题意: Nura想买k个小玩意,她手上有 s 个bu ...

  5. ACM_写数字

    写数字 Time Limit: 2000/1000ms (Java/Others) Problem Description: 把由1开始的自然数依次写下来:123456789101112……,重新分组 ...

  6. CentOS6 在线安装PostgreSQL10

    本文主要通过实际案例介绍如何在CentOS6环境中在线安装PostgreSQL10,安装环境需具备能够使用yum在线安装功能.具体安装步骤如下, 1 下载对应版本的PGDG文件 从https://yu ...

  7. MYSQL日期时间字符串互转

    --MYSQL date_format(date,'%Y-%m-%d') -------------->oracle中的to_char(); 日期时间转字符串 --MYSQL str_to_da ...

  8. C#：设置webBrowser框架与系统相对应的IE内核版本

    通常情况下,我们直接调用C#的webBrowser控件,默认的浏览器内核是IE7.  那么如何修改控件调用的默认浏览器版本呢? /// <summary> /// 修改注册表信息来兼容当前 ...

  9. javascript事件绑定1-模拟jquery可爱的东西

    1.给对象添加事件attachEvent(兼容IE,不兼容ff.chrome) <html xmlns="http://www.w3.org/1999/xhtml"> ...

  10. Django学习案例一（blog）：五. 开发主页（博客列表展示）

    主页是一个“博客列表”页.博客要按发布时间的倒序来排列,每个博客都要包含标题.作者.分类.发布时间的显示(年-月-日 时:分)及节选的正文内容(前 100 个字).点击单独的博客可以进入其详情页. 1 ...