Are there WFP apis that can disable / delete Firewall rules ?

Sinha Prokash 46

When a service ( .exe ) add firewall rules, it can have the Id's cached, and delete those rules as needed...

Now, client machine by default comes with quite a few rules ( that can be deleted or disabled using the defender firewall ). Is there equivalent APIs. May be enumeration based !!

Thanks,
Prokash

1 answer

Junjie Zhu - MSFT 19,651 Reputation points Microsoft Vendor

2022-03-14T07:20:54.607+00:00

Hello, @Sinha Prokash
Welcome to Microsoft Q&A!

I can't find any relevant functionality in the WFP API.
Hope this article can help you. It describes the operation of the firewall rule with Netsh and Powershell.
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell#delete-a-firewall-rule

Thank you.

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Sinha Prokash 46 Reputation points

2022-03-14T16:27:53.517+00:00

Thanks for the Reply --

I'm trying to find if there is a way to either disable or delete any rules ( like what I think we could do using the Application ).

What I know ---

I can enumerate

I can remove by Id, whatever is / are added by my app ( need to double verify )

Now when I enumerate I get like this
name= TermServiceLOM

desc - , filterId=68515

from
printf("\n%d. name= %ws", i + 1, (filters[i])->displayData.name);
printf("\n%d. desc - %ws, filterId=%d", i + 1, (filters[i])->displayData.description, filters[i]->filterId);

Admin console ( on both tests ) --
C:\WINDOWS\system32>netsh advfirewall firewall delete rule name="TermServiceLOM"

No rules match the specified criteria.

PS C:\WINDOWS\system32> Remove-NetFirewallRule -DisplayName TermServiceLOM
Remove-NetFirewallRule : No MSFT_NetFirewallRule objects found with property 'DisplayName' equal to 'TermServiceLOM'.
Verify the value of the property and retry.
At line:1 char:1

Remove-NetFirewallRule –DisplayName TermServiceLOM

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

CategoryInfo : ObjectNotFound: (TermServiceLOM:String) [Remove-NetFirewallRule], CimJobException

FullyQualifiedErrorId : CmdletizationQuery_NotFound_DisplayName,Remove-NetFirewallRule

PS C:\WINDOWS\system32>

Sinha Prokash 46 Reputation points

2022-03-14T20:26:13.037+00:00

O I was enumerating over the filter[i]->displayData.name, which is not Rules Name.

But Windows Defender Firewall app showing Rules Name.

Using PS command as you mentioned , it DOES INDEED delete the Rules I passed in the command arguments....

Now the question is how I can enumerate over Rules names ???

TIA,
prokash

Junjie Zhu - MSFT 19,651 Reputation points Microsoft Vendor

2022-03-16T03:10:46.83+00:00

You can refer to this code sample **Enumerating Firewall Rules **

There is a bug in the documentation, you need to use [ find and replace ] to remove all ' amps; '

Sinha Prokash 46 Reputation points

2022-03-16T12:29:16.9+00:00

Thanks,

I fixed it before. But this is Adv Firewall ( COM interface based ). Looking for an equivalent WFP Api based example. And this should be for all the rules ( and / or Filters) that are provided by any Vendors.

This is for snapshot and remove all Rules.

Prokash

Junjie Zhu - MSFT 19,651 Reputation points Microsoft Vendor

2022-03-18T10:01:12.283+00:00

There doesn't seem to be a direct solution to this question in the WFP API. It seems that the only solution is to remove the filter

Prokash Sinha 81 Reputation points

2022-03-30T15:44:28.127+00:00

Also AdvFw ( COM interface ) does not enumerate WFP API based filter rules. So we can not remove them. If the provider is us, we cache the filter ids, and can remove. But not any other provider. Looks like there is no link between COM based API and WFP API
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Are there WFP apis that can disable / delete Firewall rules ?

1 answer

Your answer