netsh advfirewall [子上下文] [命令] [參數(shù)]

# 開啟所有配置文件的防火墻
netsh advfirewall set allprofiles state on

# 關(guān)閉所有配置文件的防火墻
netsh advfirewall set allprofiles state off

# 查看防火墻狀態(tài)
netsh advfirewall show allprofiles state

# 重置防火墻策略到默認(rèn)狀態(tài)（謹(jǐn)慎使用）
netsh advfirewall reset

# 導(dǎo)出當(dāng)前防火墻配置
netsh advfirewall export "C:\backup\firewall.pol"

# 從文件導(dǎo)入防火墻配置
netsh advfirewall import "C:\backup\firewall.pol"

# 允許特定程序的所有連接
netsh advfirewall firewall add rule name="允許程序" dir=in action=allow program="C:\Program Files\App\app.exe"

# 為特定程序添加入站和出站規(guī)則
netsh advfirewall firewall add rule name="MyApp In" dir=in action=allow program="$INSTDIR\MyApp.exe"
netsh advfirewall firewall add rule name="MyApp Out" dir=out action=allow program="$INSTDIR\MyApp.exe"

# 允許特定TCP端口入站
netsh advfirewall firewall add rule name="允許TCP 80" dir=in action=allow protocol=TCP localport=80

# 允許UDP端口范圍
netsh advfirewall firewall add rule name="允許UDP端口范圍" dir=out protocol=udp localport=5000-5010 action=allow

# 阻止特定端口
netsh advfirewall firewall add rule name="阻止TCP 445" dir=in action=block protocol=TCP localport=445

# 帶有IP限制的規(guī)則
netsh advfirewall firewall add rule name="限制IP訪問" dir=in action=allow protocol=TCP localport=3389 remoteip=192.168.1.0/24

# 要求身份驗(yàn)證和加密的規(guī)則
netsh advfirewall firewall add rule name="需要加密" dir=in action=allow program="C:\App\app.exe" security=authdynenc

# 禁用服務(wù)器Ping
netsh advfirewall firewall add rule name="NoPing" dir=in action=block protocol=icmpv4

# 顯示所有規(guī)則
netsh advfirewall firewall show rule name=all

# 按名稱顯示特定規(guī)則
netsh advfirewall firewall show rule name="規(guī)則名稱"

# 刪除規(guī)則
netsh advfirewall firewall delete rule name="規(guī)則名稱"

# 禁用規(guī)則但不刪除
netsh advfirewall firewall set rule name="規(guī)則名稱" new enable=no

Function .onInstSuccess
  # 添加入站規(guī)則
  ExecWait 'netsh advfirewall firewall add rule name="MyApp" program="$INSTDIR\MyApp.exe" dir=in action=allow'
  # 添加出站規(guī)則
  ExecWait 'netsh advfirewall firewall add rule name="MyApp" program="$INSTDIR\MyApp.exe" dir=out action=allow'
FunctionEnd

Section Uninstall
  # 卸載時(shí)刪除規(guī)則
  ExecWait 'netsh advfirewall firewall delete rule name="MyApp"'
SectionEnd

' after-install.vbs
Dim shell
Set shell = CreateObject("WScript.Shell")
ruleName = "MyApp"
programPath = WScript.Arguments(0)

command1 = "netsh advfirewall firewall add rule name=""" & ruleName & """ program=""" & programPath & """ action=allow dir=in enable=yes"
command2 = "netsh advfirewall firewall add rule name=""" & ruleName & """ program=""" & programPath & """ action=allow dir=out enable=yes"

shell.Run command1, 0, True
shell.Run command2, 0, True

# 文件共享服務(wù)
netsh advfirewall firewall add rule name="File Sharing 1" dir=in action=allow protocol=TCP localport=139
netsh advfirewall firewall add rule name="File Sharing 2" dir=in action=allow protocol=TCP localport=445
netsh advfirewall firewall add rule name="File Sharing 3" dir=in action=allow protocol=UDP localport=137-138

# Web服務(wù)
netsh advfirewall firewall add rule name="HTTP" dir=in action=allow protocol=TCP localport=80
netsh advfirewall firewall add rule name="HTTPS" dir=in action=allow protocol=TCP localport=443

# 數(shù)據(jù)庫服務(wù)
netsh advfirewall firewall add rule name="SQL Server" dir=in action=allow protocol=TCP localport=1433

# 創(chuàng)建連接安全規(guī)則
netsh advfirewall consec add rule name="Secure Rule" ^
  endpoint1=any endpoint2=any ^
  action=requireinrequireout