Windows firewall открыть пинг - Windowsa.top - ваш верный помощник с OS Windows

Встроенный брандмауэр Windows в целях безопасности по умолчанию блокирует входящий ICMP трафик как в десктопных Windows 10/11, так и в Windows Server. Это означает, что вы не сможете удаленно проверить доступность компьютера с помощью стандартной команды
ping
, т.к. она будет отвечать о превышении интервала ожидания запроса (
Request timed out
) для ICMP Echo-Reply. Если вы хотите сделать возможной проверку доступности хостов Windows по протоколу ICMP из системы мониторинга или вручную из командной строки, можно разрешить ответы на ICMP эхо-запросы.

Чтобы разрешить отправку ответов на запросы по протоколу ICMP, нужно включить предустановленные правила в брандмауэре Windows.

Откройте оснастку управления Windows Defender Firewall with Advanced Security, выполнив команду
wf.msc
Перейдите в раздел Inbound Rules
Найдите правило Core Network Diagnostics – ICMP Echo Request (ICMPv4-In) и включите его.
В моем случае есть два правила с этим именем. Одно для частного и общедоступного сетевого профиля Windows, и второе для доменного. Я включил их оба. Можно также включить правило, разрешающее ICMP ответы для IPv6 протокола (если используется).

Картинка с сайта: winitpro.ru

Есть также другое правило File and Printer Sharing (Echo Request – ICMPv4-In), которое также разрешает компьютеру отвечать на эхо-запросы
ping
.

Попробуйте пропиговать ваш компьютер и убедитесь, что теперь он отвечает на ICMP запросы.

Можно включить правила Windows Firewall, разрешающие ответы на эхо-запросы ICMP с помощью такой команды PowerShell:

Set-NetFirewallRule -Name CoreNet-Diag-ICMP4-EchoRequest-In -enabled True

Если нужно ограничить список IP подсетей или хостов, которым разрешено отправлять ответы на ICMP запросы, выполните команду:

Set-NetFirewallRule -Name CoreNet-Diag-ICMP4-EchoRequest-In -enabled True -RemoteAddress 192.168.12.0,192.168.31.94

Откройте свойства правила в Windows Firewall и проверьте, что теперь правило разрешающие ICMP ответы будет работать только для указанных IP/подсетей.

Ограничить список IP в правиле ICMPv4 echo request

Если в файрволе отсутствует (удалено) правило для входящих ICMP запросов, можно создать его из командной строки:

netsh advfirewall firewall add rule name="Allow_ICMPv4_Echo" protocol=icmpv4:8,any dir=in action=allow

Другой пример PowerShell команды, которое создаст правило файервола, разрешающего ping для всех хостов в локальной сети:

New-NetFirewallRule -DisplayName "Allow_ICMPv4_Echo" -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress localsubnet -Action Allow

Если нужно заблокировать ответы на ICMP эхо-запрос независимо от того, какие правила включены, создайте запрещающее правило, которое будет иметь более высокий приоритет:

New-NetFirewallRule -DisplayName "Block_ICMPv4_Echo" -Direction Inbound -Protocol ICMPv4 -IcmpType 8 -RemoteAddress localsubnet -Action Block

Чтобы разрешить ответы на ICMP ping на всех компьютерах в сети, можно включить правило Windows Firewall с помощью доменной групповой политики .

Откройте редактор доменных GPO (
gpmc.msc
), создайте или отредактируйте имеющуюся GPO и назначьте ее на целевую OU или корень домена.
Перейдите в раздел Computer Configuration -> Windows Settings -> Security Settings -> Windows Firewall with Advanced Security -> Inbound rules
Создайте новое правило, выберите Predefined rule типа Core Networking Diagnostics

Картинка с сайта: winitpro.ru
Укажите какие правила ICMP Echo request нужно включить.

Картинка с сайта: winitpro.ru
На следующем шаге вы берите Allow the connection.

Источник

В этом руководстве рассмотрим, как включить правило, чтобы сервер стал отвечать на ping используя графический интерфейс Windows Server 2019, а также включим разрешающее правило через PowerShell и netsh.

Обычно просто отключают Windows Firewall полностью, однако это не рекомендуется делать в производственной среде, так как брандмауэр Windows хорошо справляется с обеспечением базового уровня защиты системы. Разрешим только конкретное правило, необходимое для успешного выполнения команды ping.

Разрешить проверку связи через брандмауэр Windows

Сначала нам нужно открыть брандмауэр Windows, это можно сделать несколькими способами. Один из методов — просто нажать клавишу Windows, чтобы открыть меню «Start«, а затем начать вводить слово Firewall. Как показано ниже, брандмауэр Windows с расширенной безопасностью должен отображаться, выберите этот пункт.

Меню Start Windows Server 2019 - открыть брандмауэр Windows

Еще один быстрый способ: в PowerShell можно просто ввести «firewall» и нажать Enter. Откроется базовый интерфейс брандмауэра, а затем нажать кнопку «Advanced settings» в левой части. Откроется тот же интерфейс, что и через меню «Start«.

Следующий способ открыть Firewall — ввести в CMD такой текст: «firewall.cpl«

В Брандмауэре в расширенном режиме перейдите в Inboud Rules (Правила для входящих подключений).

В перечне правил в Inboud Rules, найдите «File and Printer Sharing (Echo Request — ICMPv4-In)» и активируйте его.

Еще один вариант. Активируем разрешающее правило командлетом Powershell

Set-NetFirewallRule -DisplayName "File and Printer Sharing (Echo Request - ICMPv4-In)" -enabled True

Полную справку со всеми параметрами можно получить, набрав команду в PowerShell

help New-NetFirewallRule

Вариант создания правила через netsh

netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

Примечание: Включение правила позволит получать ответы только на IPv4 запросы, если нужно получать ответы по IPv6, нужно разблокировать правило такое же правило, только с Echo Request — ICMPv6-In, перечисленное ниже. К тому же имеется несколько профилей: доменный, публичный, частный. Ненужные профили можно отключить в правиле, во вкладке Advanced.

После разблокировки правила сервер должен начать отвечать на запросы ping. С хоста виртуализации или другого пк в локальной сети протестируем ping’ом Windows Server 2019 по адресу 192.168.1.11 перед включением правила, а затем снова после его включения. Ниже видно, что время ожидания первых запросов истекло, так как входящие запросы ICMP были отключены по умолчанию в Windows Server 2019. После включения правила ICMP запросы ping успешно выполняются, что подтверждает ожидаемую работу.

Пример проверки связи:

Скачать видео.

Резюме

Стандартное правило брандмауэра — блокировать ICMP запросы, в итоге сервер не отвечает на ping. Включив это правило брандмауэра, мы включили команду ping в Windows Server 2019, которая поможет нам устранить неполадки в сети.

Источник

Are you unable to test network connectivity because the firewall blocks the ping? Know how to allow ICMP echo request through Windows 11 firewall.

The ping command is a popular method to troubleshoot network connectivity issues and check the stability of the internet connection. However, with the built-in Windows Firewall enabled on your Windows 11 computer, the ping requests will get blocked by default.

To remove this impediment, you need to enable ping in the Windows firewall. Check out how to allow ICMP echo request with top methods. But first, let’s have a basic understanding of the ping request and its safety to fix network problems more effectively and efficiently.

Contents

1 What Is Ping Request, and Should You Allow It in Firewall?
2 How to Allow Ping Through Win 11 Firewall With Best Approaches
- 2.1 Method 1: Allow Ping From Windows Security Settings
- 2.2 Method 2: Enable ICMP Echo Request Using Command Prompt
- 2.3 Method 3: Allow Ping Through Firewall Using Advanced Settings
- 2.4 Method 4: Allow ICMP Echo Request Using PowerShell
- 2.5 Method 5: Allow Ping Using Local Group Policy
3 Conclusion

What Is Ping Request, and Should You Allow It in Firewall?

A ping request, or Internet Control Message Protocol (ICMP) echo request, is a kind of network packet. It is transferred between devices to test the connectivity between those devices.

Ping requests are often used to diagnose network problems, network responsiveness, and packet loss, while for an ordinary user, the common use of ICMP request is to determine network latency. This command-line utility is available on most operating systems, including Windows, Linux, and macOS.

Now comes the burning question of whether to allow ping through the Windows 11 firewall or not. Computers that allow ICMP echo request are comparatively more vulnerable to cyber attacks if it has a poorly configured firewall or it got other security vulnerabilities. But allowing ping requests through the Windows Firewall can help you test network connectivity or troubleshoot network issues.

For this reason, you can allow ping requests on computers belonging to a secure environment and with a properly configured firewall. Otherwise, it’s better to block ping requests if you’re using public WiFi.

How to Allow Ping Through Win 11 Firewall With Best Approaches

There are different methods to allow ICMP echo request through the firewall of your Windows 11 PC. You can choose any of these depending on your choice and convenience.

Method 1: Allow Ping From Windows Security Settings

The most commonly used approach to allow ping in Windows 11 firewall is to change settings for apps that are allowed to go through the firewall.

Type Windows Security on the Windows 11 search bar and hit Enter.
Windows Security app will open. Select Firewall & network protection from the left panel.
Click on Allow an app through firewall hyperlink.
Allowed apps window will appear on your screen.
Click on the Change settings button.

Check the boxes beside File and Printer Sharing to enable ping through firewall

Scroll through the list to find the File and Printer Sharing option.
Now, make sure to tick the boxes next to this option.
Click on the OK button to save the changes and allow ping through the firewall.

Method 2: Enable ICMP Echo Request Using Command Prompt

It’s also feasible to enable the ping with the help of a command prompt on a Windows 11 computer or laptop.

Press Windows + R keys to open the Run box and type cmd there.
Now, press Ctrl + Shift + Enter keys to open the command prompt with Admin access.
Type the following command and hit Enter:

netsh advfirewall firewall add rule name="ICMPv4 Allow Ping Requests" protocol=icmpv4:8,any dir=in action=allow

Use Command Prompt to allow ICMP Echo Request on Windows 11

Next, type this command and press the Enter key to allow another type of ICMP request:

netsh advfirewall firewall add rule name="ICMPv6 Allow Ping Requests" protocol=icmpv6:8,any dir=in action=allow

Once the commands are executed successfully on the command prompt, you can easily enable ping through the Windows 11 firewall.

Method 3: Allow Ping Through Firewall Using Advanced Settings

There is another technique that allows ping to go through the firewall by running the advanced security settings for Windows Defender Firewall. For that, you need to follow these steps:

First, you need to open the Run box by pressing Windows + R keys.
Type wf.msc and press Enter.
Windows Defender Firewall with Advanced Security window will appear on your screen.
On the right panel, under the actions section, click on New Rule.

Click on New Rule to add new rule regarding ping through firewall

Click on New Rule… to add a new rule regarding ping through firewall

New Inbound Rule Wizard will pop up on the screen.
Select the Custom button and click on Next.
Choose All programs button and click on Next.
Click on the Protocol type to open the drop-down list.
From there, select ICMPv4 or ICMPv6, depending on which one you want to allow.

Choose ICMPV4 or ICMPV6 from the Protocol type drop-down menu

Click on the Customize… button on the same screen.
On the Customize ICMP Settings wizard, select the Specific ICMP types button.
Check the Echo Request option and click OK.
This wizard will close you’ll be taken to the Inbound Rule Wizard. Click Next.
With Any IP address option being selected for both options, click on Next.
Select Allow the connection option before clicking on Next.
Under the Profile section, select Domain, Private, and Public before clicking Next.
Add a name for this new rule and click on the Finish button.

Method 4: Allow ICMP Echo Request Using PowerShell

If you’re more comfortable with using PowerShell, you can use that to allow ICMP echo request.

Type PowerShell in your search bar.
On the right panel, click on Run as Administrator.
Once the PowerShell window opens, type the following code before hitting Enter:

netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

It’ll create a new firewall rule for allowing incoming ICMPv4 echo requests.

Use commands on PowerShell to allows ICMP echo request or ping through firewall

Use commands on PowerShell to allow ICMP echo request or ping through the firewall

Now, you can type another code to allow ping over IPv6.

netsh advfirewall firewall add rule name="ICMP Allow incoming V6 echo request" protocol=icmpv6:128,any dir=in action=allow

Press Enter and let the command get executed.
Close the PowerShell window.

Method 5: Allow Ping Using Local Group Policy

You can also allow ping through the firewall using the local group policy editor.

Open the Run box by pressing Windows + R keys.
Type gpedit.msc and hit Enter to open the Local Group Policy Editor.
On the left panel, select Computer Configuration.
Double-click on Windows Settings to expand that.
Choose Security Settings and double-click to expand Windows Firewall with Advanced Security.

Find out how to navigate to the inbound rules section on Local GPE tool

Select the Inbound Rules and right-click on it.
Click on New Rule…
In the new wizard, select the Custom button and click on Next.
Select All Programs and click on Next.

An example of the new inbound rule wizard All programs

Open the Protocol type drop-down menu and choose ICMPv4 or ICMPv6, depending on which one you want to allow.
Click on Customize button from the same screen.
Select the Specific ICMP types button and tick the box for Echo Request. Click on Next.

How to select Echo Request in Specific ICMP types

Select Any IP address for both options and click on Next again.
Click on the radio button for Allow the connection button and click Next.
Tick the boxes for all the options: Domain, Private, Public.
Finally, add a name for the new rule and click on Finish to complete the process for allowing ping.

Conclusion

Allowing ping request may not be the safest choice in all situations, but you must allow it to some extent for network troubleshooting. It also helps you understand if there is some network latency issue. Now that you know how to allow ping through Windows 11 firewall, you shouldn’t have any trouble enabling ICMP echo request.

Which method did you find to be the most useful? Tell us in the comment section. Don’t forget to share this article with your friends and colleagues. Up next, how to fix Windows Online Troubleshooting Service is disabled.

Источник

By default, the built-in Windows Defender Firewall blocks all inbound ICMP traffic. As a result, if you try to ping the Windows host from a different device, the computer will not respond to the ICMP echo request (with the Request timed out description). In this article, we’ll look at how to enable or disable host network connectivity checks (ICMP echo requests) using the ping command on Windows 10/11 and Windows Server 2022/2019/2016.

You can use the graphical MMC snap-in, the command line, and the PowerShell console to manage the rules of the Windows Firewall. Let’s look at all three ways of enabling and disabling ICMP rules in the firewall.

How to Allow Ping in Windows Firewall

Search for Firewall in the quick search bar and open the Windows Defender Firewall with Advanced Security snap-in (or press Win+R and run the wf.msc command).

Select Inbound Rules in the left pane and find the File and Printer Sharing (Echo Request – ICMPv4-In) rule. As you can see, the rules for both ICMPv4 and ICMPv6 are available here for both the Domain and the Private network profiles. All of these rules are disabled by default.

You can turn on a firewall rule by right-clicking on it and selecting Enable Rule.

You can remotely check the availability of this computer using the ping command. Now Windows Firewall is not blocking ICMP requests and you can see that the remote host is accessible over the network.

By default, this rule allows ICMP echo requests from any source on the local network. If you want to restrict the list of computers that are allowed to send ICMP requests, or allow ICMP ping for external IP addresses, you can edit the existing rules.

Open the properties of the firewall rule and go to the ‘Scopes’ tab;
As you can see, the rule allows ICMP replies for all hosts on the Local subnet;
You can edit the list of accepted IP addresses in Remote IP Address;
This is where you can add specific IP addresses, ranges of IP addresses, or subnets.

Картинка с сайта: theitbros.com

You can enable and disable the Windows Defender firewall rule from the command line.. Open the elevated cmd prompt or PowerShell console. To allow ICMPv4 ping for all network profiles, run the command:

netsh advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv4-In)" new enable=yes

You should see the following message:

Updated 2 rule(s).

Ok.

You must also enable the ICMP rule for the IPv6 protocol if it is used in your network communications:

netsh advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv6-In)" new enable=yes

Separate cmdlets for managing Windows Firewall rules are available in the built-in NetSecurity PowerShell module. To allow ICMP ping for all profiles, run the following commands:

Enable-NetFirewallRule -displayName "File and Printer Sharing (Echo Request - ICMPv4-In)"

Enable-NetFirewallRule -displayName "File and Printer Sharing (Echo Request - ICMPv6-In)"

Disable ICMP Ping in Windows Firewall

You can disable ICMP echo request rules from the Windows Defender Firewall graphical console. Select all the rules in the list (by holding down the CTLR key), right click and select Disable Rule.

It is also possible to disable the ICMP ping rules from the command prompt:

netsh advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv4-In)" new enable=no

netsh advfirewall firewall set rule name="File and Printer Sharing (Echo Request - ICMPv6-In)" new enable=no

Or with PowerShell:

Disable-NetFirewallRule -displayName "File and Printer Sharing (Echo Request - ICMPv4-In)"

Disable-NetFirewallRule -displayName "File and Printer Sharing (Echo Request - ICMPv6-In)"

Cyril Kardashevsky

I enjoy technology and developing websites. Since 2012 I’m running a few of my own websites, and share useful content on gadgets, PC administration and website promotion.

Источник

By default, the Windows Firewall with Advanced Security blocks ICMP Echo Requests (Pings) from the network. In this post, we will show you how to allow Pings (ICMP Echo requests) through your Windows Firewall using Command Prompt or via the Windows Firewall with Advanced Security UI.

Should I enable ICMP?

For many network administrators, they consider the Internet Control Message Protocol (ICMP) a security risk, and therefore as a security measure, should have ICMP always be blocked at the firewall. In as much as ICMP is widely known to have some security issues associated with it, and for just that reason, ICMP should be blocked; it’s still no reason to block all ICMP traffic!

What ICMP types should I allow?

Apart from Type 3 and Type 4 – the only essential ICMP traffic you need to allow in and out of your firewall on your Windows 10/11 PC, everything else is either optional or should be blocked. Bear in mind that to send ping requests, you need to allow type 8 OUT and type 0 IN.

Generally, the way the ping command works amongst other network tools, is simply by sending special packets known as Internet Control Message Protocol (ICMP) Echo Requests to a target device, and then wait for that receiving device to respond and send back an ICMP Echo Reply packet. This action of pinging, apart from testing whether a network-connected device is active, it also measures the response time and outputs the result for you to review.

We can allow Pings (ICMP Echo requests) through your Firewall on Windows 10 or Windows 11 PC in either of two ways. We’ll explore this topic under the methods outlined below as follows.

Note: If you have a third-party security software with its own firewall installed on your system or just another type of dedicated third-party firewall program installed, you’ll need to open ports in that firewall instead of the in-built Windows Firewall.

1] Allow Pings (ICMP Echo requests) through Firewall on Windows PC via Windows Firewall with Advanced Security UI

Allow Pings through Windows Firewall-Windows Defender Firewall user interface

To allow Pings (ICMP Echo requests) through Firewall on Windows PC via Windows Firewall with Advanced Security user interface, do the following:

Click Start or press the Windows key on the keyboard.
Type windows firewall, and then select Windows Defender Firewall from the top of the search result.
Click the Advanced settings link on the left side of the Control Panel window that opens.
In the left pane, right-click Inbound Rules and choose New Rule.
In the New Inbound Rule window, select Custom.
Click Next.
On the Does this rule apply to all programs or specific programs? page, make sure the radio button is selected for All programs.
Click Next.
On the To which ports and protocol does this rule apply? page, click the Protocol type drop-down, and select ICMPv4.
Click the Customize button.
In the Customize ICMP Settings window, select the Specific ICMP types option.
In the list of ICMP types, enable Echo Request.
Click OK.
Back on the To which ports and protocol does this rule apply? page, click Next.
On the page that appears, select the radio button for Any IP address option for under the Which local IP addresses does this rule apply to? and Which remote IP addresses does this rule apply to? sections.

If you want, you can configure specific IP addresses to which your PC will respond to a ping request. Other ping requests are ignored.

On the What action should be taken when a connection matches the specified conditions? page, make sure the radio button is selected for Allow the connection option.
Click Next.
On the When does this rule apply page, check/uncheck the available options per your requirement.
Click Next.
At the final screen, you need to give your new rule a name, and optionally provide a description. It’s recommended to add ICMPv4 to the rule name to differentiate from the ICMPv6 rule that you will create also.
Click the Finish button.

Now, you can go ahead and create the ICMPv6 rule by repeating the steps above, but this time at the To which ports and protocol does this rule apply? page, click the Protocol type drop-down, and select ICMPv6 instead.

Exit Windows Defender Firewall when done.

If at anytime you want to disable the rule, open Windows Firewall with Advanced Security Control Panel, select Inbound Rules on the left, and locate the rules you created in the middle pane, right-click the rule and choose Disable. These rules can also be deleted – but it’s best just disabling the rules instead, so you can easily and quickly re-enable them without recreating them.

2] Allow Pings (ICMP Echo requests) through Firewall on Windows PC using Command Prompt

Allow Pings (ICMP Echo requests) through Firewall-Command Prompt

This is the fastest way to create an exception for ping requests on Windows 11/10.

To allow Pings (ICMP Echo requests) through Firewall on Windows PC using Command Prompt, do the following:

Press Windows key + R to invoke the Run dialog.
In the Run dialog box, type cmd and then press CTRL + SHIFT + ENTER to open Command Prompt in admin/elevated mode.
In the command prompt window, type or copy and paste the command below and hit Enter to create the ICMPv4 exception.

netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=allow

To create the ICMPv6 exception, run the command below:

netsh advfirewall firewall add rule name="ICMP Allow incoming V6 echo request" protocol=icmpv6:8,any dir=in action=allow

Changes takes effect immediately without system reboot.

To disable ping requests for the ICMPv4 exception, run the command below:

netsh advfirewall firewall add rule name="ICMP Allow incoming V4 echo request" protocol=icmpv4:8,any dir=in action=block

To disable ping requests for the ICMPv6 exception, run the command below:

netsh advfirewall firewall add rule name="ICMP Allow incoming V6 echo request" protocol=icmpv6:8,any dir=in action=block

If at anytime you want to disable a rule but have forgotten the name of the rule, you can run the command below to see a list of all rules:

netsh advfirewall firewall show rule name=all

That’s it on how to allow Pings (ICMP Echo requests) through Windows Firewall!

Read: Unable to Ping IP on Windows 11

What is ICMP attack?

An ICMP attack (also referred to as a Ping flood attack), is a common Denial-of-Service (DoS) attack in which a threat actor maliciously attempts to overwhelm a targeted device with ICMP echo-requests (pings).

Источник