2022-05-07
□ Summary
○ Windows 防火牆規則沒有執行項目優先順序, 且封鎖等級大於開放, 因此碰到封鎖的規則就完全封鎖了!
○ 自訂的輸入規則, 可在欄位[名稱](或是欄位[描述]), 加入字首辨識符號, 例如 #.
□ 允許遠端連線的IP清單
開啟防火牆
1. 輸入規則.新增規則.規則類型=自訂.動作=僅允許安全連線.其餘皆選預設.名稱=#IPSec.
2. 連線安全規則.新增規則.規則類型=豁免驗證.排除電腦=(允許遠端連線的IP清單).其餘皆選預設.名稱=#IPSec排除電腦.
ref: https://kheresy.wordpress.com/2019/01/10/windows-firewall-setting-only-aloow-some-ip-connect/
□ 封鎖對外連線Port清單.
完全不開放遠端連線的Port, 可以用這個方法封鎖.
開啟防火牆
○ 輸入規則.新增規則.規則類型=連接埠.TCP或UDP.特定本機連接埠=(Port清單).動作=封鎖連線.其餘皆選預設.名稱=#BlockPort.
(Port清單)如下, 請依實際安裝或需求設定.
△ 1433, SqlServer.
△ 3306, MySql.
△ 3389, 遠端桌面.
△ 4433, SvnServer 自訂 Port, 原為443.
△ 5389, TeamViewer.
□ 限制遠端IP可連線的(Port, 服務, 或程式)
若要限制遠端IP可連線的(Port, 服務, 或程式), 可使用這個方法.
開啟防火牆
1. 在原有輸入規則: (選擇規則).領域.遠端IP位址=(允許對外連線的IP清單)
2. 新增輸入規則: 新增規則.規則類型=連接埠.TCP或UDP.特定本機連接埠=(Port清單).允許連線.其餘皆選預設.名稱=#Port說明.確認新增後, 再執行步驟1.
(允許對外連線的IP清單)通為: 1. 本機子網路, 2. 內部網路, 3. 允許對外連線的IP清單.
(選擇規則)清單如下, 請依實際安裝或需求設定.
△ 檔案及印表機共用 (回應要求 - ICMPv4-In), 開啟或關閉遠端 ping 功能. (注意不是核心網路診斷 - ICMPv4-In)
△ 遠端桌面
△ VisualSVN Server
△ Teamviewer Remote Control Service
△ 1433, SqlServer.
△ 3306, MySql.
以下均為防火牆相關
□ 常用Port:
80, Http
1433, TCP, SQL Server
3306, TCP, MySql
3389, 遠端桌面
5800, VNC
5938, TCP/UDP TeamViewer (OUT 80)
... ref to: Windows-FireWall.txt
啟動防火牆程式
control firewall.cpl
control /name Microsoft.WindowsFirewall
□ 限制(Port, 程式, 或服務)領域, 只允許可以連線的遠端IP位址, *常用.
新增防火牆輸入規則(例如: # 3389 tcp 遠端桌面)後, 在領域頁籤中, 新增遠端IP位址: 例如 192.168.0.2 - 192.168.0.253, 以及其他預定開放的 IP位址.
----限制外部 IP
A. 先新增(連線安全規則)
1. 選取左邊的「連線安全規則」，然後點選右邊的「新增規則」.
2. 規則類型=豁免驗證.
3. 電腦列表中新增允許連線的IP(那些連線電腦不需要驗證?).例如: 192.168.0.1-192.168.0.254
B. 再新增輸入規則BlockAll.
1. 選取左邊的「輸入規則」，然後點選右邊的「新增規則」.
2. 規則類型=自訂.
3. 規則動作=僅允許安全連線.
4. 規則名稱=BlockAll.
若為遠端設定, 則須注意依照以上輸入順序設定, 否則會斷線!
----
指定(程式與外部IP)可通過防火牆.
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=private
----
新增服務通過防火牆
New command: netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
開啟服務通過防火牆
New command: netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
對所有的設定檔, 開啟服務通過防火牆
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=domain
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=private
----
開啟連接埠
輸入規則:
新增規則:
規則類型=連接埠 (例如 TCP, 80),
動作=允許連線,
選擇套用的設定檔(網域 或 私人 或 公用 或全選),
名稱及描述.
指令: netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80
----
ref:
https://support.microsoft.com/en-us/help/947709/how-to-use-the-netsh-advfirewall-firewall-context-instead-of-the-netsh
舊版指令為: netsh firewall... (適用 windows 2008 或 vista 以前的電腦)
新版指令為: netsh advfirewall...
The netsh advfirewall firewall command-line context is available in Windows Server 2008 and in Windows Vista. This context provides the functionality for controlling Windows Firewall behavior that was provided by the netsh firewall context in earlier Windows operating systems.
This context also provides functionality for more precise control of firewall rules. These rules include the following per-profile settings:
Domain
Private
Public
The netsh firewall command-line context might be deprecated in a future version of the Windows operating system. We recommend that you use the netsh advfirewall firewall context to control firewall behavior.
Note The netsh firewall command line is not recommended for use in Windows Vista.
This article describes how to use the netsh advfirewall firewall context instead of the netsh firewall context to control Windows Firewall behavior in Windows Server 2008 and in Windows Vista.
---------
Example 1: Enable a program 允許程式通過防火牆
Old command: netsh firewall add allowedprogram C:\MyApp\MyApp.exe "My Application" ENABLE
New command: netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes
允許程式通過防火牆, 並限制外部可使用的IP, 及設定檔=網域
Old command: netsh firewall add allowedprogram program=C:\MyApp\MyApp.exe name="My Application" mode=ENABLE scope=CUSTOM addresses=157.60.0.1,172.16.0.0/16,LocalSubnet profile=Domain
New command: netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
允許程式通過防火牆, 並限制外部可使用的IP, 及設定檔=全部
Old command: netsh firewall add allowedprogram program=C:\MyApp\MyApp.exe name="My Application" mode=ENABLE scope=CUSTOM addresses=157.60.0.1,172.16.0.0/16,LocalSubnet profile=ALL
New command:
Run the following commands:
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=private
---------
Example 2: Enable a port 開啟連接埠
Old command: netsh firewall add portopening TCP 80 "Open Port 80"
New command: netsh advfirewall firewall add rule name="Open Port 80" dir=in action=allow protocol=TCP localport=80
---------
Example 3: Delete enabled programs or ports 刪除(可通過防火牆)的程式
Old command: netsh firewall delete allowedprogram C:\MyApp\MyApp.exe
New command: netsh advfirewall firewall delete rule name=rule name program="C:\MyApp\MyApp.exe"
刪除(可通過防火牆)的連接埠
Old command: delete portopening protocol=UDP port=500
New command: netsh advfirewall firewall delete rule name=rule name protocol=udp localport=500
---------
Example 4: Configure ICMP settings 設定 ICMP (ping)
Old command: netsh firewall set icmpsetting 8
New command: netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow
開啟 ICMP (ping)
Old command: netsh firewall set icmpsetting type=ALL mode=enable
New command: netsh advfirewall firewall add rule name="All ICMP V4" protocol=icmpv4:any,any dir=in action=allow
關閉 ICMP (ping)
Old command: netsh firewall set icmpsetting 13 disable all
New command: netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block
---------
Example 5: Set logging 設定紀錄
Old command: netsh firewall set logging %systemroot%\system32\LogFiles\Firewall\pfirewall.log 4096 ENABLE ENABLE
New command: Run the following commands:
netsh advfirewall set currentprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set currentprofile logging maxfilesize 4096
netsh advfirewall set currentprofile logging droppedconnections enable
netsh advfirewall set currentprofile logging allowedconnections enable
If you want to set logging for a particular profile, use one of the following options instead of the "currentprofile" option:
Domainprofile
Privateprofile
Publicprofile
---------
Example 6: Enable Windows Firewall 開啟關閉防火牆
Old command: netsh firewall set opmode ENABLE
New command: netsh advfirewall set currentprofile state on
開啟關閉防火牆 並 開啟例外.
Old command: netsh firewall set opmode mode=ENABLE exceptions=enable
New command: Run the following commands:
Netsh advfirewall set currentprofile state on
netsh advfirewall set currentprofile firewallpolicy blockinboundalways,allowoutbound
僅對(domain)設定檔, 開啟關閉防火牆 並 開啟例外.
Old command: netsh firewall set opmode mode=enable exceptions=disable profile=domain
New command: Run the following commands:
Netsh advfirewall set domainprofile state on
netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
對(全部)設定檔, 開啟關閉防火牆 並 開啟例外.
Old command: netsh firewall set opmode mode=enable profile=ALL
New command: Run the following commands:
netsh advfirewall set domainprofile state on
netsh advfirewall set privateprofile state on
If you want to set the firewall state for a particular profile, use one of the following options instead of the "currentprofile" option:
Domainprofile
Privateprofile
Publicprofile
---------
Example 7: Restore policy defaults 重設恢復防火牆原狀
Old command: netsh firewall reset
New command: netsh advfirewall reset
---------
Example 8: Enable specific services 新增服務通過防火牆
Old command: netsh firewall set service FileAndPrint
New command: netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
開啟服務通過防火牆
Old command: netsh firewall set service RemoteDesktop enable
New command: netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
對所有的設定檔, 開啟服務通過防火牆
Old command: netsh firewall set service RemoteDesktop enable profile=ALL
New command: Run the following commands:
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=domain
netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=private
---------
參考:
開啟防火牆:
netsh advfirewall set currentprofile state on
關閉防火牆:
netsh advfirewall set currentprofile state off
以MySQL資料庫為例:
介面阜:3306
放行指定界面阜(大陸叫端口):
netsh advfirewall firewall add rule name=“mysql” dir=in action=allow protocol=tcp localport=3306
關閉指定界面阜:
netsh advfirewall firewall delete rule name=“mysql” protocol=tcp localport=3306
禁止ping :
netsh advfirewall firewall add rule name=”echo-request” protocol=icmpv4:8,any dir=in action=allow
開啟ping:
netsh advfirewall firewall del rule name=”echo-request” protocol=icmpv4:any,any dir=in action=allow
匯出防火牆設定:
netsh advfirewall export “x:路徑/advfirewall.pol”
導入防火牆設定:
netsh advfirewall import “x:路徑/advfirewall.pol”