使用 netsh advfirewall 防火墙而不是 netsh 防火墙来控制Windows防火墙行为

本文介绍如何使用防火墙上下文而不是 netsh advfirewall 上下文来控制防火墙Windows netsh firewall 行为。

适用于:  Windows Server 2012R2
原始 KB 编号:   947709

摘要

防火墙 netsh advfirewall 命令行上下文在 Windows Server 2012 R2 中可用。 此上下文提供用于控制Windows上下文提供的防火墙行为 netsh firewall 的功能。

此上下文还提供用于更精确地控制防火墙规则的功能。 这些规则包括以下每个配置文件的设置:

  • 私人
  • 公共

在操作系统的未来版本中,命令行上下文 netsh firewall Windows弃用。 建议您使用防火墙 netsh advfirewall 上下文来控制防火墙行为。

重要

如果您是该命令行管理管理员组并且在计算机上启用了用户帐户控制,则使用提升的权限从命令提示符运行命令。 若要使用提升的权限启动命令提示符,请找到用于启动命令提示符会话的图标或 "开始"菜单 条目,右键单击它,然后单击"以管理员角色 运行"。

下表中提供了常用命令的一些示例。 可以使用这些示例帮助你从旧上下文迁移到 netsh firewall 新的 netsh advfirewall 防火墙上下文。

此外, netsh advfirewall 还提供了可用于获取详细内联帮助的命令。

命令示例 1:启用程序

旧命令 新建命令
netsh firewall add allowedprogram C:\MyApp\MyApp.exe "My Application" ENABLE netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes
netsh firewall add allowedprogram program=C:\MyApp\MyApp.exe name="My Application" mode=ENABLE scope=CUSTOM addresses=157.60.0.1,172.16.0.0/16,LocalSubnet profile=Domain netsh advfirewall firewall add rule name="My Application" dir=in action=allow program= "C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh firewall add allowedprogram program=C:\MyApp\MyApp.exe name="My Application" mode=ENABLE scope=CUSTOM addresses=157.60.0.1,172.16.0.0/16,LocalSubnet profile=ALL 运行以下命令:
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program= "C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=domain
netsh advfirewall firewall add rule name="My Application" dir=in action=allow program="C:\MyApp\MyApp.exe" enable=yes remoteip=157.60.0.1,172.16.0.0/16,LocalSubnet profile=private

若要详细了解如何添加防火墙规则,请运行以下命令:

netsh advfirewall firewall add rule ?

命令示例 2:启用端口

旧命令 新建命令
netsh firewall add portopening TCP 80 "Open Port 80" netsh advfirewall firewall add rule name= "Open Port 80" dir=in action=allow protocol=TCP localport=80

若要详细了解如何添加防火墙规则,请运行以下命令:

netsh advfirewall firewall add rule ?

命令示例 3:删除已启用的程序或端口

旧命令 新建命令
netsh firewall delete allowedprogram C:\MyApp\MyApp.exe netsh advfirewall firewall delete rule name= rule name program="C:\MyApp\MyApp.exe"
delete portopening protocol=UDP port=500 netsh advfirewall firewall delete rule name= rule name protocol=udp localport=500

若要详细了解如何删除防火墙规则,请运行以下命令:

netsh advfirewall firewall delete rule ?

命令示例 4:配置 ICMP 设置

旧命令 新建命令
netsh firewall set icmpsetting 8 netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow
netsh firewall set icmpsetting type=ALL mode=enable netsh advfirewall firewall add rule name= "All ICMP V4" protocol=icmpv4:any,any dir=in action=allow
netsh firewall set icmpsetting 13 disable all netsh advfirewall firewall add rule name="Block Type 13 ICMP V4" protocol=icmpv4:13,any dir=in action=block

若要详细了解如何配置 ICMP 设置,请运行以下命令:

netsh advfirewall firewall add rule ?

命令示例 5:设置日志记录

旧命令 新建命令
netsh firewall set logging %systemroot%\system32\LogFiles\Firewall\pfirewall.log 4096 ENABLE ENABLE 运行以下命令:
netsh advfirewall set currentprofile logging filename %systemroot%\system32\LogFiles\Firewall\pfirewall.log
netsh advfirewall set currentprofile logging maxfilesize 4096
netsh advfirewall set currentprofile logging droppedconnections enable
netsh advfirewall set currentprofile logging allowedconnections enable

有关详细信息,请运行以下命令:

netsh advfirewall set currentprofile ?

如果要为特定配置文件设置日志记录,请使用以下选项之一,而不是 currentprofile 选项:

  • Domainprofile
  • Privateprofile
  • Publicprofile

命令示例 6:启用Windows防火墙

旧命令 新建命令
netsh firewall set opmode ENABLE netsh advfirewall set currentprofile state on
netsh firewall set opmode mode=ENABLE exceptions=enable 运行以下命令:
Netsh advfirewall set currentprofile state on
netsh advfirewall set currentprofile firewallpolicy blockinboundalways,allowoutbound
netsh firewall set opmode mode=enable exceptions=disable profile=domain 运行以下命令:
Netsh advfirewall set domainprofile state on
netsh advfirewall set domainprofile firewallpolicy blockinbound,allowoutbound
netsh firewall set opmode mode=enable profile=ALL 运行以下命令:
netsh advfirewall set domainprofile state on
netsh advfirewall set privateprofile state on

有关详细信息,请运行以下命令:

netsh advfirewall set currentprofile ?

如果要为特定配置文件设置防火墙状态,请使用以下选项之一,而不是 currentprofile 选项:

  • Domainprofile
  • Privateprofile
  • Publicprofile

命令示例 7:还原策略默认值

旧命令 新建命令
netsh firewall reset netsh advfirewall reset

有关详细信息,请运行以下命令:

netsh advfirewall reset ?

命令示例 8:启用特定服务

旧命令 新建命令
netsh firewall set service FileAndPrint netsh advfirewall firewall set rule group="File and Printer Sharing" new enable=Yes
netsh firewall set service RemoteDesktop enable netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
netsh firewall set service RemoteDesktop enable profile=ALL 运行以下命令:

netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=domain

netsh advfirewall firewall set rule group="remote desktop" new enable=Yes profile=private