The firewall is the part of a rebuild nobody remembers until a game server or a dev tool stops working. One file holds every rule, and one command puts them all back.
Export the whole policy with **netsh advfirewall export**, keep a readable copy of the rules from **Get-NetFirewallRule**, and restore with **netsh advfirewall import** — which replaces every rule in the store.
The rules mean nothing without the **profile** settings they run under. Capture which profile is active and how it treats inbound traffic by default.
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction,NotifyOnListen**netsh advfirewall export** writes one file containing every rule and every profile setting. This is the file to restore after a reinstall.
New-Item -ItemType Directory C:\FwBackup -Force | Out-Null
netsh advfirewall export "C:\FwBackup\rules.wfw"
Get-ChildItem C:\FwBackup | Select-Object Name,LengthA .wfw file is binary and cannot be diffed. The CSV export shows what each rule does, which is what you need when two machines disagree.
Get-NetFirewallRule |
Select-Object DisplayName,Direction,Action,Enabled,Profile |
Export-Csv C:\FwBackup\rules.csv -NoTypeInformation -Encoding UTF8
netsh advfirewall firewall show rule name=all > C:\FwBackup\rules.txt**import** replaces the entire rule store with the content of the file. Rules created after the export are gone, including the ones setup added for new applications.
netsh advfirewall import "C:\FwBackup\rules.wfw"
Get-NetFirewallProfile | Select-Object Name,EnabledFor one missing rule the export is overkill. Rebuild it explicitly so its scope and profile are visible in the command you ran.
New-NetFirewallRule -DisplayName 'Dev Server 8080' -Direction Inbound -Protocol TCP -LocalPort 8080 -Action Allow -Profile Private
Get-NetFirewallRule -DisplayName 'Dev Server 8080' | Select-Object DisplayName,Enabled,Direction,Action,ProfileCount the rules and test a port that should be reachable. A rule can exist and still be disabled, blocked by a policy or bound to the wrong profile.
(Get-NetFirewallRule).Count
Get-NetFirewallRule -Enabled True | Where-Object Direction -eq 'Inbound' | Measure-Object | Select-Object Count
Test-NetConnection -ComputerName 127.0.0.1 -Port 8080 -InformationLevel QuietThe active network profile changed. Rules scoped to Private do not apply when Windows classifies the network as Public — check Get-NetConnectionProfile.
The firewall service or a policy is blocking it. Run the prompt elevated, and check whether a domain policy owns the store.
Its own ruleset is in charge. The Windows rules stay dormant until that product is removed, which is why the import appears to do nothing.
A security tool or a policy cleans them. Compare the CSV against the current list hourly to find the pattern.
Yes, the format is machine-neutral. Interface-specific and program-path-specific rules need review because the paths differ.
**netsh advfirewall reset** gives you a clean default state. Restoring is for keeping a curated set of rules, not for fixing a broken one.
Restore the previous .wfw file with netsh advfirewall import, or reset the store with netsh advfirewall reset and recreate the rules you still need from the CSV.
Free · no account needed · tracks your progress