有时您可能需要编写脚本或远程连接到 PC 并运行命令来启用或禁用Windows防火墙。对于大多数 IT 环境，使用组策略^{(Group Policy)}是在客户端计算机上配置Windows 防火墙的最简单方法。^{(Windows Firewall)}

这也是为HTTP、文件共享、软件应用程序等服务添加端口例外的最简单方法。但是，最好知道如何从命令提示符配置Windows 防火墙^{(Windows Firewall)}，以防万一您的计算机和服务器不在Active Directory中。

从命令提示符^{(Command Prompt)}管理 Windows防火墙^(Firewall)

首先，要查看服务器或计算机上是否启用了Windows 防火墙，请在命令提示符处键入以下命令：^{(Windows Firewall)}

netsh advfirewall show allprofiles

确保^(Make)打开管理员命令提示符（单击Start，输入CMD，然后右键单击Command Prompt并选择Run as Administrator）。您应该得到类似于下图所示的内容：

默认情况下，您应该在此处看到三个单独的列表：域^(Domain)配置文件设置、私人配置文件设置和公共配置文件设置。这三个对应于您可以将计算机上的每个网络连接置于其中的三种状态。如果您连接到您的家庭网络并选择了家庭网络^{(Home Network)}选项，则将 应用私人^(Private)配置文件设置。

状态^(State)表示防火墙是打开还是关闭。防火墙策略^{(Firewall Policy)}告诉您哪些入站和出站策略应用于每个配置文件。

要禁用特定配置文件的防火墙，您将使用以下命令：

netsh advfirewall set privateprofile state off

其他选项是currentprofile、publicprofile、domainprofile和allprofiles。因此，如果您想完全禁用防火墙，您将使用allprofiles而不是 privateprofile。要再次启用，只需放在最后^(on)而不是off。

使用命令行在^{(Command Line)}防火墙中^(Firewall)打开端口^(Port)

现在，如果您想使用命令行在防火墙中打开一个端口怎么办？这也很简单！

假设您要打开端口 3389，该端口用于Windows中的远程桌面。您只需运行以下命令：

netsh advfirewall firewall add rule name="Open Remote Desktop" protocol=TCP dir=in localport=3389 action=allow

该命令很长，但很容易分解。您添加一条规则，为其命名，选择协议（TCP或UDP），选择方向（In 或Out），为其指定端口号并选择操作（Allow或Deny）。

如果您要运行此命令，然后在Windows 防火墙^{(Windows Firewall)}中查看允许的应用程序，您会看到远程桌面^{(Remote Desktop)}项目现在被选中：

如果您需要打开一系列端口，只需使用简单的破折号。例如，这里我为UDP出站流量打开 600o 到 7000 端口：

netsh advfirewall firewall add rule name="UDP ports" protocol=UDP dir=out localport=6000-7000 action=allow

您可以使用许多更高级的命令来管理Windows 防火墙^{(Windows Firewall)}的各个方面，因此请务必使用/?任何命令末尾的字符以查看所有选项和示例。

Enable or Disable Windows Firewall from Command Prompt

There may come a time when you nеed to write a script or remоtely connect to a PC and run a command to enаble or disable the Windows firewall. For most IT environments, using Group Policy is the easiest way to configure the Windows Firewall on client computers.

It’s also the easiest way to add port exceptions for services such as HTTP, file sharing, software applications, and more. However, it’s also good to know how to configure the Windows Firewall from the command prompt just in case you have computers and servers that are not in Active Directory.

Manage Windows Firewall from Command Prompt

First, to see whether the Windows Firewall is enabled on a server or computer, type this command at the command prompt:

netsh advfirewall show allprofiles

Make sure you open an administrator command prompt (click on Start, type in CMD and then right-click on Command Prompt and choose Run as Administrator). You should get something similar to what is shown below:

By default, you should see three separate listings here: Domain profile settings, private profile settings and public profile settings. These three correspond to the three states you can place each network connection on your computer into. If you are connected to your home network and you chose the Home Network option, the Private profile settings will be applied.

State means if the firewall is turned on or off. The Firewall Policy tells you what inbound and outbound policies are being applied to each profile.

To disable the firewall for a specific profile, you would use the following command:

netsh advfirewall set privateprofile state off

The other options are currentprofile, publicprofile, domainprofile, and allprofiles. So if you wanted to disable the firewall completely, you would use allprofiles instead of privateprofile. To enable again, just put on at the end instead of off.

Open Port in Firewall using Command Line

Now what if you want to open a port in the firewall using the command line? That’s simple too!

Let’s say you want to open port 3389, which is for remote desktop in Windows. You would simply run this command:

netsh advfirewall firewall add rule name="Open Remote Desktop" protocol=TCP dir=in localport=3389 action=allow

The command is quite long, but it’s fairly easy to break down. You add a rule, give it a name, choose the protocol (TCP or UDP), choose the direction (In or Out), give it the port number and choose the action (Allow or Deny).

If you were to run this command, then go view the allowed apps in Windows Firewall, you would see that the Remote Desktop item is now checked:

If you need to open up a range of ports, just use a simple dash. For example, here I am opening ports 600o to 7000 for UDP outbound traffic:

netsh advfirewall firewall add rule name="UDP ports" protocol=UDP dir=out localport=6000-7000 action=allow

There are many more advanced commands you can use to manage all aspects of the Windows Firewall, so make sure to use the /? characters at the end of any command to see all the options and examples.

Related posts

• 使用命令提示符更改 IP 地址和 DNS 服务器

• 如何在Windows 11/10中使用Command Prompt恢复Registry

• 如何在Windows 10中使用Command Prompt卸载程序

• Check Windows 10 OS architecture使用PowerShell or Command Prompt

• Create System Restore Point使用Command Prompt or PowerShell

• 如何在Windows Terminal中CMD and PowerShell之间切换

• 如何从Command Prompt运行Java program

• 如何从Command Prompt开设Microsoft Store apps

• 如何使用Command Prompt比较两个Files进行更改

• Windows 10 Perform Arithmetic Command Prompt中的操作

• 如何在Windows 10中使用Command Prompt修复Microsoft 365

• 如何在Windows 10中的文件夹中打开Command Prompt

• 如何在Windows 10中使用Command Prompt更新驱动程序

• USB Flash Drive Remove virus采用Command Prompt or Batch File

• 如何打开Command Prompt（14种方式）

• 如何改变DNS server使用Command Prompt and PowerShell

• 使用Command Prompt管理文件和文件夹的有用命令

• 如何立即创建多个文件夹

• 使用Command Prompt从Credential Manager管理凭证

• 如何在Windows 11/10中运行Command Prompt作为Administrator