适用于 PowerShell 5.1 及以上版本（Windows 内置模块）
Windows 防火墙是服务器和终端安全的第一道防线。无论是部署新服务、排查网络故障还是进行安全加固，都离不开防火墙规则的配置与管理。传统的图形界面操作虽然直观，但在批量管理和自动化场景下效率低下，且容易遗漏。
PowerShell 内置的 NetSecurity 模块提供了完整的防火墙管理能力，支持查看、创建、修改和删除规则，所有操作都可以脚本化、可重复执行。对于运维工程师来说，掌握这套命令不仅能提高日常工作效率，更是实现基础设施即代码（IaC）的重要基础。
查看防火墙规则
日常运维中最常见的操作就是查看当前生效的防火墙规则。Get-NetFirewallRule 是核心命令，结合 Get-NetFirewallPortFilter 和 Get-NetFirewallAddressFilter 可以获取完整的规则详情。
以下函数封装了常用的查询逻辑，支持按名称、方向、启用状态等条件过滤，并输出格式化的规则摘要：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
| function Get-FirewallRuleSummary {
param(
[string]$Name = "*",
[ValidateSet("Inbound", "Outbound", "Both")]
[string]$Direction = "Both",
[switch]$EnabledOnly
)
$filter = @{ DisplayName = $Name }
if ($Direction -ne "Both") {
$filter["Direction"] = $Direction
}
if ($EnabledOnly) {
$filter["Enabled"] = "True"
}
$rules = Get-NetFirewallRule @filter
$results = foreach ($rule in $rules) {
$portFilter = $rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
$addrFilter = $rule | Get-NetFirewallAddressFilter -ErrorAction SilentlyContinue
[PSCustomObject]@{
Name = $rule.DisplayName
Direction = $rule.Direction
Action = $rule.Action
Enabled = $rule.Enabled
Protocol = if ($portFilter) { $portFilter.Protocol } else { "Any" }
LocalPort = if ($portFilter) { $portFilter.LocalPort } else { "Any" }
RemoteAddr = if ($addrFilter) { $addrFilter.RemoteAddress } else { "Any" }
Profile = $rule.Profile
}
}
return $results | Sort-Object Enabled, Direction, Action
}
|
执行结果示例：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
| PS> Get-FirewallRuleSummary -Name "*SSH*" -EnabledOnly
Name : OpenSSH Server (sshd)
Direction : Inbound
Action : Allow
Enabled : True
Protocol : TCP
LocalPort : 22
RemoteAddr : Any
Profile : Any
Name : OpenSSH Client
Direction : Outbound
Action : Allow
Enabled : True
Protocol : TCP
LocalPort : Any
RemoteAddr : Any
Profile : Any
|
创建防火墙规则
创建规则是防火墙管理中最关键的操作。New-NetFirewallRule 命令支持丰富的参数，可以精确控制协议、端口、地址范围和配置文件。
以下函数将常见的规则创建流程封装为可复用的命令，内置了参数校验和冲突检测逻辑，避免重复创建同名规则：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
| function New-FirewallAllowRule {
param(
[Parameter(Mandatory)]
[string]$Name,
[Parameter(Mandatory)]
[int]$Port,
[ValidateSet("TCP", "UDP")]
[string]$Protocol = "TCP",
[ValidateSet("Inbound", "Outbound")]
[string]$Direction = "Inbound",
[string[]]$RemoteAddress = "Any",
[ValidateSet("Domain", "Private", "Public", "Any")]
[string]$Profile = "Any"
)
$existing = Get-NetFirewallRule -DisplayName $Name -ErrorAction SilentlyContinue
if ($existing) {
Write-Warning "规则 '$Name' 已存在，跳过创建"
return $existing
}
$params = @{
DisplayName = $Name
Direction = $Direction
Action = "Allow"
Protocol = $Protocol
LocalPort = $Port
RemoteAddress = $RemoteAddress
Profile = $Profile
Enabled = "True"
}
$rule = New-NetFirewallRule @params
Write-Host "已创建规则: $Name ($Protocol/$Port, $Direction)"
return $rule
}
|
执行结果示例：
1
2
3
4
5
| PS> New-FirewallAllowRule -Name "Web Server HTTP" -Port 80 -Protocol TCP
已创建规则: Web Server HTTP (TCP/80, Inbound)
PS> New-FirewallAllowRule -Name "Web Server HTTP" -Port 80
WARNING: 规则 'Web Server HTTP' 已存在，跳过创建
|
批量管理规则
在服务器初始化或安全加固场景中，往往需要一次性配置大量规则。手动逐条创建既繁琐又容易出错，批量管理脚本能显著提升效率和一致性。
以下函数接收规则定义数组，自动创建并输出执行报告，支持回滚操作：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
| function Import-FirewallRuleSet {
param(
[Parameter(Mandatory)]
[string]$RuleSetName,
[Parameter(Mandatory)]
[array]$Rules
)
$report = @()
$created = @()
foreach ($rule in $Rules) {
$qualifiedName = "$RuleSetName - $($rule.Name)"
try {
$result = New-FirewallAllowRule `
-Name $qualifiedName `
-Port $rule.Port `
-Protocol $rule.Protocol `
-Direction $rule.Direction `
-RemoteAddress $rule.RemoteAddress `
-Profile $rule.Profile
if ($result) {
$created += $qualifiedName
$status = "Created"
}
else {
$status = "Skipped"
}
}
catch {
$status = "Error: $($_.Exception.Message)"
}
$report += [PSCustomObject]@{
Rule = $qualifiedName
Port = "$($rule.Protocol)/$($rule.Port)"
Status = $status
}
}
Write-Host "`n规则集 '$RuleSetName' 导入完成: $($created.Count)/$($Rules.Count) 条已创建"
return $report | Format-Table -AutoSize
}
|
使用示例——批量导入 Web 服务器所需规则：
1
2
3
4
5
6
7
| $webRules = @(
@{ Name = "HTTP"; Port = 80; Protocol = "TCP"; Direction = "Inbound"; RemoteAddress = "Any"; Profile = "Any" }
@{ Name = "HTTPS"; Port = 443; Protocol = "TCP"; Direction = "Inbound"; RemoteAddress = "Any"; Profile = "Any" }
@{ Name = "SSH"; Port = 22; Protocol = "TCP"; Direction = "Inbound"; RemoteAddress = "10.0.0.0/8"; Profile = "Domain" }
)
Import-FirewallRuleSet -RuleSetName "Web Server" -Rules $webRules
|
执行结果示例：
1
2
3
4
5
6
7
8
9
10
11
| 已创建规则: Web Server - HTTP (TCP/80, Inbound)
已创建规则: Web Server - HTTPS (TCP/443, Inbound)
已创建规则: Web Server - SSH (TCP/22, Inbound)
规则集 'Web Server' 导入完成: 3/3 条已创建
Rule Port Status
---- ---- ------
Web Server - HTTP TCP/80 Created
Web Server - HTTPS TCP/443 Created
Web Server - SSH TCP/22 Created
|
导出与导入规则配置
在多台服务器之间同步防火墙配置，或者在变更前做备份，都需要导出导入功能。以下函数将规则集导出为 JSON 文件，便于版本控制和跨机器部署。
注意这里使用数组拼接 -join 来构建多行文本，避免在代码块中嵌入三反引号导致 Markdown 解析错误：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
| function Export-FirewallRules {
param(
[Parameter(Mandatory)]
[string]$NamePattern,
[Parameter(Mandatory)]
[string]$OutputPath
)
$rules = Get-NetFirewallRule -DisplayName $NamePattern -ErrorAction SilentlyContinue
$export = foreach ($rule in $rules) {
$portFilter = $rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
$addrFilter = $rule | Get-NetFirewallAddressFilter -ErrorAction SilentlyContinue
@{
Name = $rule.DisplayName
Direction = [string]$rule.Direction
Action = [string]$rule.Action
Enabled = [string]$rule.Enabled
Protocol = if ($portFilter) { [string]$portFilter.Protocol } else { "" }
LocalPort = if ($portFilter) { [string]$portFilter.LocalPort } else { "" }
RemoteAddress = if ($addrFilter) { [string]$addrFilter.RemoteAddress } else { "" }
Profile = [string]$rule.Profile
}
}
$jsonLines = @(
"{"
' "ExportDate": "' + (Get-Date -Format "yyyy-MM-dd HH:mm:ss") + '",'
' "RuleCount": ' + $export.Count + ','
' "Rules": ['
)
for ($i = 0; $i -lt $export.Count; $i++) {
$comma = if ($i -lt $export.Count - 1) { "," } else { "" }
$ruleJson = $export[$i] | ConvertTo-Json -Compress
$jsonLines += " $ruleJson$comma"
}
$jsonLines += @(
" ]"
"}"
)
($jsonLines -join "`n") | Out-File -FilePath $OutputPath -Encoding UTF8
Write-Host "已导出 $($export.Count) 条规则到: $OutputPath"
}
|
执行结果示例：
1
2
| PS> Export-FirewallRules -NamePattern "Web Server*" -OutputPath "C:\Backup\firewall-web.json"
已导出 3 条规则到: C:\Backup\firewall-web.json
|
对应的导入函数从 JSON 文件读取规则定义并批量创建：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
| function Import-FirewallRulesFromFile {
param(
[Parameter(Mandatory)]
[string]$FilePath
)
$content = Get-Content -Path $FilePath -Raw | ConvertFrom-Json
Write-Host "文件包含 $($content.RuleCount) 条规则，导出时间: $($content.ExportDate)"
$results = @()
foreach ($r in $content.Rules) {
try {
$existing = Get-NetFirewallRule -DisplayName $r.Name -ErrorAction SilentlyContinue
if ($existing) {
$results += [PSCustomObject]@{ Name = $r.Name; Status = "AlreadyExists" }
continue
}
New-NetFirewallRule `
-DisplayName $r.Name `
-Direction $r.Direction `
-Action $r.Action `
-Protocol $r.Protocol `
-LocalPort $r.LocalPort `
-RemoteAddress $r.RemoteAddress `
-Profile $r.Profile `
-Enabled $r.Enabled | Out-Null
$results += [PSCustomObject]@{ Name = $r.Name; Status = "Created" }
}
catch {
$results += [PSCustomObject]@{ Name = $r.Name; Status = "Error: $($_.Exception.Message)" }
}
}
$created = ($results | Where-Object Status -eq "Created").Count
Write-Host "`n导入完成: $created 条新建, $($results.Count - $created) 条跳过"
return $results | Format-Table -AutoSize
}
|
执行结果示例：
1
2
3
4
5
6
7
8
9
10
| PS> Import-FirewallRulesFromFile -FilePath "C:\Backup\firewall-web.json"
文件包含 3 条规则，导出时间: 2025-04-16 10:30:00
导入完成: 3 条新建, 0 条跳过
Name Status
---- ------
Web Server - HTTP Created
Web Server - HTTPS Created
Web Server - SSH Created
|
服务器安全加固
生产服务器的防火墙配置直接决定攻击面大小。以下加固脚本针对常见的风险点实施最小权限原则：禁用所有入站流量后仅开放必要端口，限制管理端口的访问来源，并关闭不必要的出站流量。
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
| function Initialize-ServerFirewallHardening {
param(
[int[]]$AllowedInboundPorts = @(80, 443),
[int]$SshPort = 22,
[string[]]$AdminNetworks = @("10.0.0.0/8", "172.16.0.0/12"),
[switch]$WhatIf
)
$log = @()
$step1 = "Step 1: 设置默认入站策略为阻止"
$log += $step1
Write-Host $step1
if (-not $WhatIf) {
Set-NetFirewallProfile -Profile Domain,Public,Private `
-DefaultInboundAction Block `
-DefaultOutboundAction Allow `
-Enabled True
}
$step2 = "Step 2: 开放业务端口 ($($AllowedInboundPorts -join ', '))"
$log += $step2
Write-Host $step2
foreach ($port in $AllowedInboundPorts) {
$ruleName = "Hardened - HTTP/S Port $port"
if (-not $WhatIf) {
New-FirewallAllowRule -Name $ruleName -Port $port -Protocol TCP | Out-Null
}
$log += " -> 已开放端口: $port/TCP"
}
$step3 = "Step 3: 限制管理端口 ($SshPort) 仅允许管理网段访问"
$log += $step3
Write-Host $step3
foreach ($network in $AdminNetworks) {
$ruleName = "Hardened - SSH from $network"
if (-not $WhatIf) {
New-FirewallAllowRule -Name $ruleName -Port $SshPort `
-Protocol TCP -RemoteAddress $network | Out-Null
}
$log += " -> 已允许: $network -> $SshPort/TCP"
}
$step4 = "Step 4: 禁用非必要预置规则"
$log += $step4
Write-Host $step4
$builtinDisabled = @()
$noisyRules = @(
"File and Printer Sharing (Echo Request - ICMPv4-In)"
"Network Discovery (NB-Datagram-In)"
"Network Discovery (NB-Name-In)"
)
foreach ($ruleName in $noisyRules) {
$rule = Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue
if ($rule -and $rule.Enabled -eq "True") {
if (-not $WhatIf) {
$rule | Disable-NetFirewallRule | Out-Null
}
$builtinDisabled += $ruleName
}
}
$log += " -> 已禁用 $($builtinDisabled.Count) 条预置规则"
$summary = @(
""
"========== 加固报告 =========="
"默认入站策略: Block"
"业务端口: $($AllowedInboundPorts -join ', ')"
"管理端口: $SshPort/TCP (限 $($AdminNetworks -join ', '))"
"禁用预置规则: $($builtinDisabled.Count) 条"
"WhatIf 模式: $WhatIf"
"================================"
)
$summary | ForEach-Object { Write-Host $_ }
return $log
}
|
执行结果示例（预览模式）：
1
2
3
4
5
6
7
8
9
10
11
12
13
| PS> Initialize-ServerFirewallHardening -WhatIf
Step 1: 设置默认入站策略为阻止
Step 2: 开放业务端口 (80, 443)
Step 3: 限制管理端口 (22) 仅允许管理网段访问
Step 4: 禁用非必要预置规则
========== 加固报告 ==========
默认入站策略: Block
业务端口: 80, 443
管理端口: 22/TCP (限 10.0.0.0/8, 172.16.0.0/12)
禁用预置规则: 3 条
WhatIf 模式: True
================================
|
小结
PowerShell 的 NetSecurity 模块让 Windows 防火墙管理变得完全可脚本化。核心命令只有四个——Get-NetFirewallRule、New-NetFirewallRule、Set-NetFirewallRule、Remove-NetFirewallRule，但配合过滤器和管道可以覆盖几乎所有管理场景。实际运维中建议：始终使用 -WhatIf 预览变更、变更前导出备份、管理端口严格限制来源地址。将这些函数纳入 DSC 或 Ansible Playbook 中，就能实现防火墙策略的版本化管理和自动部署。