How To: Modify Windows Firewall policy in Group Policy using PowerShell

I recently had to add 130 IP addresses to a Windows Firewall policy that was configured in Group Policy in order to allow traffic for a cloud-hosted application. I could have spent over an hour tediously adding IP addresses manually to a rule using the Group Policy Management Console (and likely making typos and omitting a few along the way), or I could use PowerShell to accomplish the same task in minutes.

Prerequisites

For this blog post, I’ll assume you have the following:

• Basic PowerShell knowledge
• Permissions to modify Group Policy
• A Group Policy Object (GPO) that contains a Windows Firewall policy

Step 1: Open the GPO

First, we must open the GPO using the Open-NetGPO command. If you look at the Help documentation for this command, you’ll see it creates a cached copy of a GPO to modify locally which is exactly what we want to do. We will save the changes back to Group Policy later in Step 3. We specify the GPO using the -PolicyStore parameter. In my example, my domain is “contoso.com”, and I have a GPO called “Windows Firewall Policy”.

# Specify the domain
$Domain = 'contoso.com'

# Specify the GPO name
$GpoName = 'Windows Firewall Policy'

# Combine the domain and GPO name to create the $PolicyStore variable
$PolicyStore = "$Domain\$GpoName"

# Create a GPO session to open the GPO
$GpoSession = Open-NetGPO -PolicyStore $PolicyStore

In the code above, I used variables to specify the details of the GPO and then opened and stored the GPO in a variable called $GpoSession.

Step 2: Modify the Windows Firewall policy

With the GPO open, you can use PowerShell commands such as Get-NetFirewallRule, New-NetFirewallRule, Set-NetFirewallRule, and Remove-NetFirewallRule to make changes to the Windows Firewall rules.

# Create a rule to block outbound traffic on TCP port 80
New-NetFirewallRule -GPOSession $GpoSession -DisplayName "Block Outbound Port 80" -Direction Outbound -LocalPort 80 -Protocol TCP -Action Block

# Rename the previously created rule's name and change the Action to Allow
Set-NetFirewallRule -GPOSession $GpoSession -DisplayName "Block Outbound Port 80" -NewDisplayName "Allow Outbound Port 80" -Action Allow

# Get the rule and its details
Get-NetFirewallRule -GPOSession $GpoSession -DisplayName "Allow Outbound Port 80"

# Delete the rule
Remove-NetFirewallRule -GPOSession $GpoSession -DisplayName "Allow Outbound Port 80"

The code above shows four basic examples of how you can modify the Windows Firewall rules.

Step 3: Save the GPO

Once you’ve made your changes, the last step is simply to save the GPO.

# Save the GPO
Save-NetGPO -GPOSession $GpoSession

That’s it! You’re finished!