Public/New-LocalInPolicy.ps1

<#
    .Description
    The purpose of this function is to write a configuration script. The purpose of that configuration script will be to implement a localin restriction policy. A use case being to allow managing the firewall from a public interface, but only from permitted IP addresses. If you fully understand the config output you can leverage this for additional purposes related to localin policies.
 
    .Parameter Administrators
    Provide and array administrators that should be able to access the firewall by the services to be specified in another parameter.
 
    .Parameter Interfaces
    An interface or interfaces that the localin policy will apply for.
 
    .Parameter PolicyName
    This is a string that will be used in parts of the config to avoid overwriting existing configurations. This must be unique.
 
    .Parameter Services
    Specify the Service or services that the local-in policy applies to.
 
    ex: "RDP/3389/TCP", "piov/5060-5061/UDP"
 
    .Parameter TrustedHosts
    Provide an array of CIDR addresses that should be able to acccess the firewall management interfaces using the services to be provided later.
 
    .Example
    $params = @{
        Administrators = "AdminAccount01", "AdminAccount02"
        Interfaces = "wan1", "DMZ"
        PolicyName = "RemoteAccess"
        Services = "HTTPS/443/TCP", "SSH/22/TCP"
        TrustedHosts = "192.168.0.0/16", "172.16.0.0/12", "10.0.0.0/8"
    }
    New-LocalinPolicy @params
 
    .Link
    https://github.com/TheTaylorLee/AdminToolbox/tree/master/docs
#>


function New-LocalinPolicy {
    [CmdletBinding()]
    Param (
        [Parameter(Mandatory = $true, HelpMessage = "Provide an array administrators that should be able to login.")]
        [string[]]$administrators,
        [Parameter(Mandatory = $true, HelpMessage = "Provide an array of interfaces that this policy will apply to.")]
        [string[]]$interfaces,
        [Parameter(Mandatory = $true, HelpMessage = "This PolicyName will be used to avoid overwriting existing address objects")]
        [string]$policyname,
        [Parameter(Mandatory = $false, HelpMessage = "Specify services in the following format. ex: ""RDP/3389/TCP"", ""piov/5060-5061/UDP""")]
        [string[]]$Services,
        [Parameter(Mandatory = $true, HelpMessage = "Provide an array of CIDR addresses that should be able to acccess the firewall management interfaces.")]
        [ValidateScript( {
                if ($_ -match '^[0-9]{1,3}[.]{1}[0-9]{1,3}[.]{1}[0-9]{1,3}[.]{1}[0-9]{1,3}[/]{1}[0-9]{1,2}$') {
                    $true
                }
                else {
                    throw "$_ is an invalid pattern. You must provide a proper CIDR format. ex: 192.168.0.0/24"
                }
            })]
        [string[]]$trustedhosts
    )

    begin {
    }

    process {
        #configure Trusted hosts
        New-LocalInPolicyTrustHosts -administrators $administrators -trustedhosts $trustedhosts

        #Create Address Objects for the Policy
        [int]$max = $trustedhosts.Count
        $addresses = for ($i = 0; $i -lt $max; $i++) {
            [PSCustomObject]@{
                Name = "LocalIn" + "_" + $PolicyName + "_" + $trustedhosts[$i]
                CIDR = $trustedhosts[$i]
            }
        }

        Foreach ($Address in $Addresses) {
            New-LocalInAddressObject -AddressName $Address.Name -CIDR $Address.CIDR
        }

        #Create Address Objects for the policy
        $LocNames = ($Addresses).name -join " "
        $LocalGroupName = "LocalIn_$policyname"
        New-AddressGroup -AddressNames $LocNames -GroupName $LocalGroupName

        #Create Services
        foreach ($service in $services) {
            $split = $service -split "/"

            if ($split[2] -eq 'TCP') {
                $Params = @{
                    ServiceName  = "LocalIn_" + $PolicyName + "_" + $split[0]
                    TCPPortRange = $split[1]
                }
            }

            if ($split[2] -eq 'UDP') {
                $Params = @{
                    ServiceName  = "LocalIn_" + $PolicyName + "_" + $split[0]
                    UDPPortRange = $split[1]
                }
            }
            New-ServiceObject @Params
        }

        #Create Service Groups
        $proc = $services -split "/"
        [int]$count = $proc.count
        $svcs = for ($i = 0; $i -lt $count) {
            "LocalIn_" + $PolicyName + "_" + $proc[$i]
            $i = $i + [int]3
        }
        $svcresult = $svcs -join " "
        $svcgroupname = "LocalIn_" + $PolicyName
        New-ServiceGroup -ServiceGroupName $svcgroupname -Members $svcresult

        # Create local-in allow policy
        Write-Output "
config firewall local-in-policy
    edit 0
        set intf any
        set srcaddr $LocalGroupName
        set dstaddr all
        set action accept
        set service $svcgroupname
        set schedule always
    next
end
"


        #Create local-in block policy
        foreach ($int in $interfaces) {
            Write-Output "
config firewall local-in-policy
    edit 0
        set intf $int
        set srcaddr all
        set dstaddr all
        set action deny
        set service $svcgroupname
        set schedule always
    next
end
"

        }
    }

    end {
    }
}