Presentation slides explores various options of windows firewall and Netsh command line utility. It explains about enabling logging feature for allowed/blocked logs, understanding different options for inbound and outbound connection and interpretation of logs for detecting anomalies in Windows O.S.

1. A walk through Windows
Firewall & Netsh commands
Rhydham Joshi
M.S. in Software Engineering, San Jose State University
Phone : (+1) 408-987-1991 | Email : rhydham.joshi@yahoo.com
Blog : malwareforensics1.blogspot.com | Linkedin : www.linkedin.com/in/rhydhamjoshi

2. Contents:
 Navigation to firewall settings
 Firewall Tabs:
• Allow an app or feature through firewall
• Change notification settings
• Turn Windows Firewall on/off
• Restore defaults
• Advanced settings
 Windows Firewall with Advanced Security Tabs:
 Activate logging for allowed/denied traffic
 Inbound and outbound rules in brief
 Monitoring Tab: The things we need to take care about
• Firewall
• Logs Exploration
 Netsh commands
 References

3. Navigation to Firewall settings
• Control Panel -> System and Security -> Windows Firewall
• Run command : firewall.cpl
• Type : Windows Firewall in Windows search box.

4. Allow an app or feature through windows firewall
• Allow/Deny any
app/services in
Private/Public network

5. Allow an app or feature through windows firewall

6. Change Notification Settings &
Turn Windows Firewall on or off

7. Advanced Settings:

8. Tabs: Windows Firewall with Advanced
Security

9. Activate Logging for allowed/denied traffic

10. • In Domain Profile Tab 
Logging  Customize 
See the dialog box for
“Customize Logging Settings
for the Domain Profile”
• Click YES for “Log Dropped Packets”
& “Log Successful Connections”
• Repeat steps for “Private Profile”
& “Public Profile”
Activate Logging for allowed/denied traffic

11. Inbound Rules and Outbound Rules

12. Inbound & Outbound Rules

13. Inbound & Outbound Rules

14. Inbound & Outbound Rules

15. Inbound & Outbound Rules

16. Inbound & Outbound Rules

17. Inbound & Outbound Rules

18. Inbound & Outbound Rules

19. Inbound & Outbound Rules

20. Monitoring: The thing “WE” need to care about

21. Monitoring  Firewall

22. Explore the logs

23. Network shell commands
• Import/Export Firewall Settings
• Enable Remote Desktop
Connection
• Enable a program
• Enable/disable a port
• Enable Remote Management
• Allow/Disallow Ping
• Change Logging path
• Restore Defaults
• Enable/disable Windows Firewall
• Query Firewall logs

24. Netsh Commands Reference Links:
Netsh Commands reference link:
https://technet.microsoft.com/en-us/library/cc732279(v=ws.10).aspx
Netsh Commands for Windows Firewall:
https://technet.microsoft.com/en-us/library/cc771046(v=ws.10).aspx
Netsh Commands for Windows Firewall and Advanced Security:
https://technet.microsoft.com/en-us/library/cc771920(v=ws.10).aspx
Top 10 Netsh firewall commands:
http://windowsitpro.com/windows-server/top-10-windows-firewall-
netsh-commands

25. Thank you.!