From e46beb9ef08fb5d28e20e8808a928190c624cbeb Mon Sep 17 00:00:00 2001
From: umamah <omermuneer.11@gmail.com>
Date: Thu, 15 Oct 2026 20:49:08 +0500
Subject: [PATCH 1/4] Feature: Option to show all Windows Firewall rules

---
 .../Resources/Strings.Designer.cs             |  9 ++++
 .../Resources/Strings.resx                    |  3 ++
 .../Firewall/Firewall.cs                      | 49 +++++++++++++++++--
 .../GlobalStaticConfiguration.cs              |  3 +-
 .../NETworkManager.Settings/SettingsInfo.cs   | 13 +++++
 .../ViewModels/FirewallViewModel.cs           | 19 ++++++-
 Source/NETworkManager/Views/FirewallView.xaml |  4 ++
 7 files changed, 94 insertions(+), 6 deletions(-)

diff --git a/Source/NETworkManager.Localization/Resources/Strings.Designer.cs b/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
index de4abb87d1..0a9bc2957f 100644
--- a/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
+++ b/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
@@ -4996,6 +4996,15 @@ public static string FirewallRules {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Show all rules.
+        /// </summary>
+        public static string ShowAllRules {
+            get {
+                return ResourceManager.GetString("ShowAllRules", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to First usable IP address.
         /// </summary>
diff --git a/Source/NETworkManager.Localization/Resources/Strings.resx b/Source/NETworkManager.Localization/Resources/Strings.resx
index b9a01cc5ef..4145f45e94 100644
--- a/Source/NETworkManager.Localization/Resources/Strings.resx
+++ b/Source/NETworkManager.Localization/Resources/Strings.resx
@@ -4313,6 +4313,9 @@ You can copy your profile files from “{0}” to “{1}” to migrate your exis
   <data name="FirewallRules" xml:space="preserve">
     <value>Firewall rules</value>
   </data>
+  <data name="ShowAllRules" xml:space="preserve">
+    <value>Show all rules</value>
+  </data>
   <data name="WindowsFirewallSettings" xml:space="preserve">
     <value>Windows Firewall settings</value>
   </data>
diff --git a/Source/NETworkManager.Models/Firewall/Firewall.cs b/Source/NETworkManager.Models/Firewall/Firewall.cs
index 915692d24c..ad67cbd0ec 100644
--- a/Source/NETworkManager.Models/Firewall/Firewall.cs
+++ b/Source/NETworkManager.Models/Firewall/Firewall.cs
@@ -67,15 +67,19 @@ public class Firewall
     #region Methods
 
     /// <summary>
-    /// Retrieves all Windows Firewall rules whose display name starts with <see cref="RuleIdentifier"/>
-    /// and maps each one to a <see cref="FirewallRule"/> object.
+    /// Retrieves Windows Firewall rules and maps each one to a <see cref="FirewallRule"/> object.
+    /// When <paramref name="onlyManagedRules"/> is <see langword="true"/>, only rules whose display name
+    /// starts with <see cref="RuleIdentifier"/> are returned; otherwise all rules on the system are returned.
     /// PowerShell errors during the query are logged as warnings; errors for individual
     /// rules are caught so a single malformed rule does not abort the entire load.
     /// </summary>
+    /// <param name="onlyManagedRules">
+    /// <see langword="true"/> to query only rules managed by NETworkManager; <see langword="false"/> to query all system firewall rules.
+    /// </param>
     /// <returns>
     /// A list of <see cref="FirewallRule"/> objects representing the matching rules.
     /// </returns>
-    public static async Task<List<FirewallRule>> GetRulesAsync()
+    public static async Task<List<FirewallRule>> GetRulesAsync(bool onlyManagedRules = true)
     {
         await RunspaceLock.WaitAsync();
         try
@@ -87,7 +91,9 @@ public static async Task<List<FirewallRule>> GetRulesAsync()
                 using var ps = SMA.PowerShell.Create();
                 ps.Runspace = SharedRunspace;
 
-                ps.AddScript($@"
+                if (onlyManagedRules)
+                {
+                    ps.AddScript($@"
 Get-NetFirewallRule -DisplayName '{RuleIdentifier}*' | ForEach-Object {{
     $rule              = $_
     $portFilter        = $rule | Get-NetFirewallPortFilter
@@ -111,6 +117,41 @@ public static async Task<List<FirewallRule>> GetRulesAsync()
         Program       = $appFilter.Program
     }}
 }}");
+                }
+                else
+                {
+                    ps.AddScript($@"
+$rules = Get-NetFirewallRule
+$pf = @{{}}; Get-NetFirewallPortFilter | ForEach-Object {{ $pf[$_.InstanceID] = $_ }}
+$af = @{{}}; Get-NetFirewallAddressFilter | ForEach-Object {{ $af[$_.InstanceID] = $_ }}
+$app = @{{}}; Get-NetFirewallApplicationFilter | ForEach-Object {{ $app[$_.InstanceID] = $_ }}
+$if = @{{}}; Get-NetFirewallInterfaceTypeFilter | ForEach-Object {{ $if[$_.InstanceID] = $_ }}
+$list = [System.Collections.Generic.List[PSCustomObject]]::new($rules.Count)
+foreach ($rule in $rules) {{
+    $id = $rule.InstanceID
+    $portFilter    = $pf[$id]
+    $addressFilter = $af[$id]
+    $appFilter     = $app[$id]
+    $ifTypeFilter  = $if[$id]
+    $list.Add([PSCustomObject]@{{
+        Id            = $rule.ID
+        DisplayName   = $rule.DisplayName
+        Enabled       = ($rule.Enabled -eq 'True')
+        Description   = $rule.Description
+        Direction     = [string]$rule.Direction
+        Action        = [string]$rule.Action
+        Protocol      = $portFilter.Protocol
+        LocalPort     = ($portFilter.LocalPort   -join ',')
+        RemotePort    = ($portFilter.RemotePort  -join ',')
+        LocalAddress  = ($addressFilter.LocalAddress  -join ',')
+        RemoteAddress = ($addressFilter.RemoteAddress -join ',')
+        Profile       = [string]$rule.Profile
+        InterfaceType = [string]$ifTypeFilter.InterfaceType
+        Program       = $appFilter.Program
+    }})
+}}
+$list");
+                }
 
                 var results = ps.Invoke();
 
diff --git a/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs b/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs
index 8b50e98f0a..1d151f8852 100644
--- a/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs
+++ b/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs
@@ -1,4 +1,4 @@
-using DnsClient;
+using DnsClient;
 using Lextm.SharpSnmpLib.Messaging;
 using NETworkManager.Models;
 using NETworkManager.Models.Export;
@@ -267,6 +267,7 @@ public static class GlobalStaticConfiguration
 
     // Application: Firewall
     public static ExportFileType Firewall_ExportFileType => ExportFileType.Csv;
+    public static bool Firewall_ShowAllRules => false;
 
     // Application: Discovery Protocol
     public static DiscoveryProtocol DiscoveryProtocol_Protocol => DiscoveryProtocol.LldpCdp;
diff --git a/Source/NETworkManager.Settings/SettingsInfo.cs b/Source/NETworkManager.Settings/SettingsInfo.cs
index e5067acfe0..2338dddb2e 100644
--- a/Source/NETworkManager.Settings/SettingsInfo.cs
+++ b/Source/NETworkManager.Settings/SettingsInfo.cs
@@ -3312,6 +3312,19 @@ public ExportFileType Firewall_ExportFileType
         }
     } = GlobalStaticConfiguration.Firewall_ExportFileType;
 
+    public bool Firewall_ShowAllRules
+    {
+        get;
+        set
+        {
+            if (value == field)
+                return;
+
+            field = value;
+            OnPropertyChanged();
+        }
+    } = GlobalStaticConfiguration.Firewall_ShowAllRules;
+
     #endregion
 
     #region Discovery Protocol
diff --git a/Source/NETworkManager/ViewModels/FirewallViewModel.cs b/Source/NETworkManager/ViewModels/FirewallViewModel.cs
index 9e05b03eca..b4d71917d6 100644
--- a/Source/NETworkManager/ViewModels/FirewallViewModel.cs
+++ b/Source/NETworkManager/ViewModels/FirewallViewModel.cs
@@ -93,6 +93,23 @@ public string RulesSearch
         }
     }
 
+    /// <summary>
+    /// Gets or sets whether to show all system firewall rules or only rules managed by NETworkManager.
+    /// </summary>
+    public bool ShowAllRules
+    {
+        get => SettingsManager.Current.Firewall_ShowAllRules;
+        set
+        {
+            if (value == SettingsManager.Current.Firewall_ShowAllRules)
+                return;
+
+            SettingsManager.Current.Firewall_ShowAllRules = value;
+            OnPropertyChanged();
+            _ = Refresh();
+        }
+    }
+
     /// <summary>
     /// Gets or sets whether a refresh is currently running.
     /// </summary>
@@ -549,7 +566,7 @@ private async Task Refresh(bool init = false)
 
         try
         {
-            var rules = await Firewall.GetRulesAsync();
+            var rules = await Firewall.GetRulesAsync(onlyManagedRules: !ShowAllRules);
 
             Application.Current.Dispatcher.Invoke(() =>
             {
diff --git a/Source/NETworkManager/Views/FirewallView.xaml b/Source/NETworkManager/Views/FirewallView.xaml
index dd6e198fb2..af5b8fe951 100644
--- a/Source/NETworkManager/Views/FirewallView.xaml
+++ b/Source/NETworkManager/Views/FirewallView.xaml
@@ -55,6 +55,10 @@
                                     Orientation="Horizontal"
                                     VerticalAlignment="Center"
                                     HorizontalAlignment="Right">
+                            <CheckBox Content="{x:Static localization:Strings.ShowAllRules}"
+                                      IsChecked="{Binding ShowAllRules}"
+                                      VerticalAlignment="Center"
+                                      Margin="0,0,10,0" />
                             <Button Command="{Binding Path=RefreshCommand}"
                                     Style="{StaticResource CleanButton}"
                                     ToolTip="{x:Static localization:Strings.Refresh}"

From 944848ed9be6792e6432e20b9a95efc95b530289 Mon Sep 17 00:00:00 2001
From: BornToBeRoot <16019165+BornToBeRoot@users.noreply.github.com>
Date: Tue, 20 Oct 2026 23:19:12 +0200
Subject: [PATCH 2/4] Feature: Improve network manager rule handling

---
 .../ObservableRangeCollection.cs              |  35 ++
 .../DocumentationManager.cs                   |   1 +
 .../Resources/Strings.Designer.cs             | 168 +++++++
 .../Resources/Strings.resx                    |  60 +++
 .../Export/ExportManager.FirewallRule.cs      |   6 +-
 .../Firewall/Firewall.cs                      | 417 ++++++++++++++----
 .../Firewall/FirewallRule.cs                  | 123 +++++-
 .../Firewall/FirewallRuleHiddenProperties.cs  |  32 ++
 .../Firewall/FirewallRuleNotFoundException.cs |  17 +
 .../Firewall/FirewallRuleProgram.cs           |  14 +-
 .../Firewall/FirewallRuleSource.cs            |  28 ++
 .../GlobalStaticConfiguration.cs              |   2 +-
 .../SettingsViewManager.cs                    |   2 +
 .../EmptyOrFileExistsValidator.cs             |  15 +-
 Source/NETworkManager/DialogHelper.cs         |   8 +-
 .../ViewModels/FirewallRuleViewModel.cs       |  11 +-
 .../ViewModels/FirewallSettingsViewModel.cs   |  58 +++
 .../ViewModels/FirewallViewModel.cs           | 244 ++++++++--
 .../ViewModels/HostsFileEditorViewModel.cs    |   3 +-
 .../ViewModels/SettingsViewModel.cs           |   6 +
 .../Views/FirewallRuleChildWindow.xaml        |   4 +-
 .../Views/FirewallSettingsView.xaml           |  24 +
 .../Views/FirewallSettingsView.xaml.cs        |  23 +
 Source/NETworkManager/Views/FirewallView.xaml | 202 ++++++++-
 .../NETworkManager/Views/FirewallView.xaml.cs |  20 +
 Website/docs/application/firewall.md          |  54 ++-
 Website/docs/changelog/next-release.md        |  13 +
 27 files changed, 1439 insertions(+), 151 deletions(-)
 create mode 100644 Source/NETworkManager.Controls/ObservableRangeCollection.cs
 create mode 100644 Source/NETworkManager.Models/Firewall/FirewallRuleHiddenProperties.cs
 create mode 100644 Source/NETworkManager.Models/Firewall/FirewallRuleNotFoundException.cs
 create mode 100644 Source/NETworkManager.Models/Firewall/FirewallRuleSource.cs
 create mode 100644 Source/NETworkManager/ViewModels/FirewallSettingsViewModel.cs
 create mode 100644 Source/NETworkManager/Views/FirewallSettingsView.xaml
 create mode 100644 Source/NETworkManager/Views/FirewallSettingsView.xaml.cs

diff --git a/Source/NETworkManager.Controls/ObservableRangeCollection.cs b/Source/NETworkManager.Controls/ObservableRangeCollection.cs
new file mode 100644
index 0000000000..f222a46263
--- /dev/null
+++ b/Source/NETworkManager.Controls/ObservableRangeCollection.cs
@@ -0,0 +1,35 @@
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
+using System.Collections.Specialized;
+using System.ComponentModel;
+
+namespace NETworkManager.Controls;
+
+/// <summary>
+/// <see cref="ObservableCollection{T}"/> that can replace all items at once with a single
+/// <see cref="NotifyCollectionChangedAction.Reset"/> notification (instead of one notification per item).
+/// Bound views (e.g. a filtered / sorted <see cref="System.ComponentModel.ICollectionView"/>) are refreshed only once,
+/// which is much faster for large lists.
+/// </summary>
+/// <typeparam name="T">The type of the items.</typeparam>
+public class ObservableRangeCollection<T> : ObservableCollection<T>
+{
+    /// <summary>
+    /// Replaces all items with the given items and raises a single
+    /// <see cref="NotifyCollectionChangedAction.Reset"/> notification.
+    /// </summary>
+    /// <param name="items">The new items.</param>
+    public void ReplaceAll(IEnumerable<T> items)
+    {
+        CheckReentrancy();
+
+        Items.Clear();
+
+        foreach (var item in items)
+            Items.Add(item);
+
+        OnPropertyChanged(new PropertyChangedEventArgs(nameof(Count)));
+        OnPropertyChanged(new PropertyChangedEventArgs("Item[]"));
+        OnCollectionChanged(new NotifyCollectionChangedEventArgs(NotifyCollectionChangedAction.Reset));
+    }
+}
\ No newline at end of file
diff --git a/Source/NETworkManager.Documentation/DocumentationManager.cs b/Source/NETworkManager.Documentation/DocumentationManager.cs
index 8ef97fb873..4a436cf7dc 100644
--- a/Source/NETworkManager.Documentation/DocumentationManager.cs
+++ b/Source/NETworkManager.Documentation/DocumentationManager.cs
@@ -272,6 +272,7 @@ public static DocumentationIdentifier GetIdentifierBySettingsName(SettingsName n
             SettingsName.WebConsole => GetIdentifierByApplicationName(ApplicationName.WebConsole),
             SettingsName.SNMP => GetIdentifierByApplicationName(ApplicationName.SNMP),
             SettingsName.SNTPLookup => GetIdentifierByApplicationName(ApplicationName.SNTPLookup),
+            SettingsName.Firewall => GetIdentifierByApplicationName(ApplicationName.Firewall),
             SettingsName.WakeOnLAN => GetIdentifierByApplicationName(ApplicationName.WakeOnLAN),
             SettingsName.RDAP => GetIdentifierByApplicationName(ApplicationName.RDAP),
             SettingsName.BitCalculator => GetIdentifierByApplicationName(ApplicationName.BitCalculator),
diff --git a/Source/NETworkManager.Localization/Resources/Strings.Designer.cs b/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
index ae38d39159..e5c4483dcc 100644
--- a/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
+++ b/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
@@ -5034,6 +5034,174 @@ public static string ShowAllRules {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to ICMP types.
+        /// </summary>
+        public static string IcmpTypes {
+            get {
+                return ResourceManager.GetString("IcmpTypes", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to App package.
+        /// </summary>
+        public static string AppPackage {
+            get {
+                return ResourceManager.GetString("AppPackage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to The rule "{0}" uses the following properties, which are not supported by NETworkManager and are not copied:
+        ///
+        ///{1}
+        ///
+        ///The new rule may apply to more traffic than the original rule (e.g. to all services of a program instead of a single one). Please review the new rule carefully before saving it..
+        /// </summary>
+        public static string CopyFirewallRuleHiddenPropertiesMessage {
+            get {
+                return ResourceManager.GetString("CopyFirewallRuleHiddenPropertiesMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Loading firewall rules....
+        /// </summary>
+        public static string LoadingFirewallRulesDots {
+            get {
+                return ResourceManager.GetString("LoadingFirewallRulesDots", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to No firewall rules found. Use "Add rule..." to create a rule or enable "Show all rules" in the settings to show all Windows Firewall rules..
+        /// </summary>
+        public static string NoFirewallRulesFoundMessage {
+            get {
+                return ResourceManager.GetString("NoFirewallRulesFoundMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to One or more of the selected firewall rules no longer exist (e.g. deleted in the Windows Firewall management console). Nothing was changed..
+        /// </summary>
+        public static string FirewallRulesNoLongerExistMessage {
+            get {
+                return ResourceManager.GetString("FirewallRulesNoLongerExistMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Managed by Group Policy. The rule can't be changed locally, but it can be copied..
+        /// </summary>
+        public static string FirewallRuleManagedByGroupPolicyMessage {
+            get {
+                return ResourceManager.GetString("FirewallRuleManagedByGroupPolicyMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Managed by Mobile Device Management (MDM), e.g. Microsoft Intune. The rule can't be changed locally, but it can be copied..
+        /// </summary>
+        public static string FirewallRuleManagedByMDMMessage {
+            get {
+                return ResourceManager.GetString("FirewallRuleManagedByMDMMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Created by Windows at runtime (e.g. dynamic or hardcoded rule). The rule can't be changed locally, but it can be copied..
+        /// </summary>
+        public static string FirewallRuleManagedByOtherMessage {
+            get {
+                return ResourceManager.GetString("FirewallRuleManagedByOtherMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to At least one of the selected rules is managed by a policy (e.g. Group Policy or MDM) or created by Windows at runtime and can't be changed locally..
+        /// </summary>
+        public static string FirewallRulesManagedByPolicyMessage {
+            get {
+                return ResourceManager.GetString("FirewallRulesManagedByPolicyMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to This rule uses values that are not supported by NETworkManager (e.g. port keywords like RPC, a combination of interface types, a protocol like IGMP or the program System). Editing or copying the rule is not supported (yet), because these values would be lost and the new rule could apply to more traffic (e.g. to all ports)..
+        /// </summary>
+        public static string FirewallRuleUnsupportedValuesMessage {
+            get {
+                return ResourceManager.GetString("FirewallRuleUnsupportedValuesMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Show all active Windows Firewall rules (e.g. Windows built-in rules, rules created by other applications or from Group Policy) instead of only the rules managed by NETworkManager. Rules not managed by NETworkManager can be enabled, disabled, deleted or copied, but not edited. Rules from a policy (e.g. Group Policy or MDM) can only be copied..
+        /// </summary>
+        public static string HelpMessage_FirewallShowAllRules {
+            get {
+                return ResourceManager.GetString("HelpMessage_FirewallShowAllRules", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Managed by NETworkManager..
+        /// </summary>
+        public static string FirewallRuleManagedMessage {
+            get {
+                return ResourceManager.GetString("FirewallRuleManagedMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Not managed by NETworkManager (e.g. a Windows built-in rule or a rule created by another application). The rule can be enabled, disabled, deleted or copied, but editing is not supported (yet)..
+        /// </summary>
+        public static string FirewallRuleNotManagedMessage {
+            get {
+                return ResourceManager.GetString("FirewallRuleNotManagedMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Enable rules ({0}).
+        /// </summary>
+        public static string EnableRulesX {
+            get {
+                return ResourceManager.GetString("EnableRulesX", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Disable rules ({0}).
+        /// </summary>
+        public static string DisableRulesX {
+            get {
+                return ResourceManager.GetString("DisableRulesX", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to The following rules are not managed by NETworkManager (e.g. Windows built-in rules or rules created by other applications). Changing them may affect the network functionality of Windows or other applications:
+        ///
+        ///{0}.
+        /// </summary>
+        public static string FirewallRulesNotManagedWarningMessage {
+            get {
+                return ResourceManager.GetString("FirewallRulesNotManagedWarningMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to Editing rules that are not managed by NETworkManager is not supported (yet), because they may use properties that can't be shown in the dialog (e.g. rule group, service or ICMP types). Use "Copy as..." to create a managed copy of the rule..
+        /// </summary>
+        public static string EditFirewallRuleNotManagedMessage {
+            get {
+                return ResourceManager.GetString("EditFirewallRuleNotManagedMessage", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to First usable IP address.
         /// </summary>
diff --git a/Source/NETworkManager.Localization/Resources/Strings.resx b/Source/NETworkManager.Localization/Resources/Strings.resx
index 60d81fa7e9..7c452cce81 100644
--- a/Source/NETworkManager.Localization/Resources/Strings.resx
+++ b/Source/NETworkManager.Localization/Resources/Strings.resx
@@ -4313,9 +4313,69 @@ You can copy your profile files from “{0}” to “{1}” to migrate your exis
   <data name="FirewallRules" xml:space="preserve">
     <value>Firewall rules</value>
   </data>
+  <data name="HelpMessage_FirewallShowAllRules" xml:space="preserve">
+    <value>Show all active Windows Firewall rules (e.g. Windows built-in rules, rules created by other applications or from Group Policy) instead of only the rules managed by NETworkManager. Rules not managed by NETworkManager can be enabled, disabled, deleted or copied, but not edited. Rules from a policy (e.g. Group Policy or MDM) can only be copied.</value>
+  </data>
+  <data name="FirewallRuleUnsupportedValuesMessage" xml:space="preserve">
+    <value>This rule uses values that are not supported by NETworkManager (e.g. port keywords like RPC, a combination of interface types, a protocol like IGMP or the program System). Editing or copying the rule is not supported (yet), because these values would be lost and the new rule could apply to more traffic (e.g. to all ports).</value>
+  </data>
+  <data name="FirewallRuleManagedByGroupPolicyMessage" xml:space="preserve">
+    <value>Managed by Group Policy. The rule can't be changed locally, but it can be copied.</value>
+  </data>
+  <data name="FirewallRuleManagedByMDMMessage" xml:space="preserve">
+    <value>Managed by Mobile Device Management (MDM), e.g. Microsoft Intune. The rule can't be changed locally, but it can be copied.</value>
+  </data>
+  <data name="FirewallRuleManagedByOtherMessage" xml:space="preserve">
+    <value>Created by Windows at runtime (e.g. dynamic or hardcoded rule). The rule can't be changed locally, but it can be copied.</value>
+  </data>
+  <data name="FirewallRulesManagedByPolicyMessage" xml:space="preserve">
+    <value>At least one of the selected rules is managed by a policy (e.g. Group Policy or MDM) or created by Windows at runtime and can't be changed locally.</value>
+  </data>
+  <data name="FirewallRulesNoLongerExistMessage" xml:space="preserve">
+    <value>One or more of the selected firewall rules no longer exist (e.g. deleted in the Windows Firewall management console). Nothing was changed.</value>
+  </data>
+  <data name="LoadingFirewallRulesDots" xml:space="preserve">
+    <value>Loading firewall rules...</value>
+  </data>
+  <data name="NoFirewallRulesFoundMessage" xml:space="preserve">
+    <value>No firewall rules found. Use "Add rule..." to create a rule or enable "Show all rules" in the settings to show all Windows Firewall rules.</value>
+  </data>
+  <data name="IcmpTypes" xml:space="preserve">
+    <value>ICMP types</value>
+  </data>
+  <data name="AppPackage" xml:space="preserve">
+    <value>App package</value>
+  </data>
+  <data name="CopyFirewallRuleHiddenPropertiesMessage" xml:space="preserve">
+    <value>The rule "{0}" uses the following properties, which are not supported by NETworkManager and are not copied:
+
+{1}
+
+The new rule may apply to more traffic than the original rule (e.g. to all services of a program instead of a single one). Please review the new rule carefully before saving it.</value>
+  </data>
   <data name="ShowAllRules" xml:space="preserve">
     <value>Show all rules</value>
   </data>
+  <data name="FirewallRuleManagedMessage" xml:space="preserve">
+    <value>Managed by NETworkManager.</value>
+  </data>
+  <data name="FirewallRuleNotManagedMessage" xml:space="preserve">
+    <value>Not managed by NETworkManager (e.g. a Windows built-in rule or a rule created by another application). The rule can be enabled, disabled, deleted or copied, but editing is not supported (yet).</value>
+  </data>
+  <data name="EnableRulesX" xml:space="preserve">
+    <value>Enable rules ({0})</value>
+  </data>
+  <data name="DisableRulesX" xml:space="preserve">
+    <value>Disable rules ({0})</value>
+  </data>
+  <data name="FirewallRulesNotManagedWarningMessage" xml:space="preserve">
+    <value>The following rules are not managed by NETworkManager (e.g. Windows built-in rules or rules created by other applications). Changing them may affect the network functionality of Windows or other applications:
+
+{0}</value>
+  </data>
+  <data name="EditFirewallRuleNotManagedMessage" xml:space="preserve">
+    <value>Editing rules that are not managed by NETworkManager is not supported (yet), because they may use properties that can't be shown in the dialog (e.g. rule group, service or ICMP types). Use "Copy as..." to create a managed copy of the rule.</value>
+  </data>
   <data name="WindowsFirewallSettings" xml:space="preserve">
     <value>Windows Firewall settings</value>
   </data>
diff --git a/Source/NETworkManager.Models/Export/ExportManager.FirewallRule.cs b/Source/NETworkManager.Models/Export/ExportManager.FirewallRule.cs
index ec8cb81f8f..589c32cac7 100644
--- a/Source/NETworkManager.Models/Export/ExportManager.FirewallRule.cs
+++ b/Source/NETworkManager.Models/Export/ExportManager.FirewallRule.cs
@@ -71,7 +71,7 @@ private static void CreateCsv(IEnumerable<FirewallRule> collection, string fileP
                 $"{CsvHelper.QuoteString(rule.LocalAddressesDisplay)}," +
                 $"{CsvHelper.QuoteString(rule.RemoteAddressesDisplay)}," +
                 $"{CsvHelper.QuoteString(rule.NetworkProfilesDisplay)}," +
-                $"{rule.InterfaceType}," +
+                $"{CsvHelper.QuoteString(rule.InterfaceTypeDisplay)}," +
                 $"{CsvHelper.QuoteString(rule.ProgramDisplay)}," +
                 $"{CsvHelper.QuoteString(rule.Description)}");
 
@@ -98,7 +98,7 @@ from rule in collection
                         new XElement(nameof(FirewallRule.LocalAddresses), rule.LocalAddressesDisplay),
                         new XElement(nameof(FirewallRule.RemoteAddresses), rule.RemoteAddressesDisplay),
                         new XElement(nameof(FirewallRule.NetworkProfiles), rule.NetworkProfilesDisplay),
-                        new XElement(nameof(FirewallRule.InterfaceType), rule.InterfaceType),
+                        new XElement(nameof(FirewallRule.InterfaceType), rule.InterfaceTypeDisplay),
                         new XElement(nameof(FirewallRule.Program), rule.ProgramDisplay),
                         new XElement(nameof(FirewallRule.Description), rule.Description)))));
 
@@ -127,7 +127,7 @@ private static void CreateJson(IReadOnlyList<FirewallRule> collection, string fi
                 LocalAddresses = rule.LocalAddressesDisplay,
                 RemoteAddresses = rule.RemoteAddressesDisplay,
                 NetworkProfiles = rule.NetworkProfilesDisplay,
-                InterfaceType = rule.InterfaceType.ToString(),
+                InterfaceType = rule.InterfaceTypeDisplay,
                 Program = rule.ProgramDisplay,
                 rule.Description
             };
diff --git a/Source/NETworkManager.Models/Firewall/Firewall.cs b/Source/NETworkManager.Models/Firewall/Firewall.cs
index 7d24c722a6..0aa86d065f 100644
--- a/Source/NETworkManager.Models/Firewall/Firewall.cs
+++ b/Source/NETworkManager.Models/Firewall/Firewall.cs
@@ -64,12 +64,39 @@ public class Firewall
 
     #endregion
 
+    /// <summary>
+    /// PowerShell expression that maps a rule (<c>$rule</c>) and its filters (<c>$portFilter</c>,
+    /// <c>$addressFilter</c>, <c>$appFilter</c>, <c>$ifTypeFilter</c>, <c>$svcFilter</c>) to the object parsed by <see cref="GetRulesAsync"/>.
+    /// Shared by the query for rules managed by NETworkManager and the query for all rules.
+    /// </summary>
+    private const string RuleProjectionScript = @"[PSCustomObject]@{
+        Id            = $rule.ID
+        DisplayName   = $rule.DisplayName
+        Enabled       = ($rule.Enabled -eq 'True')
+        Description   = $rule.Description
+        Direction     = [string]$rule.Direction
+        Action        = [string]$rule.Action
+        Protocol      = $portFilter.Protocol
+        LocalPort     = ($portFilter.LocalPort   -join ',')
+        RemotePort    = ($portFilter.RemotePort  -join ',')
+        LocalAddress  = ($addressFilter.LocalAddress  -join ',')
+        RemoteAddress = ($addressFilter.RemoteAddress -join ',')
+        Profile       = [string]$rule.Profile
+        InterfaceType = [string]$ifTypeFilter.InterfaceType
+        Program       = [string]$appFilter.Program
+        SourceType    = [string]$rule.PolicyStoreSourceType
+        IcmpType      = ($portFilter.IcmpType -join ',')
+        Service       = [string]$svcFilter.Service
+        Package       = [string]$appFilter.Package
+    }";
+
     #region Methods
 
     /// <summary>
     /// Retrieves Windows Firewall rules and maps each one to a <see cref="FirewallRule"/> object.
-    /// When <paramref name="onlyManagedRules"/> is <see langword="true"/>, only rules whose display name
-    /// starts with <see cref="RuleIdentifier"/> are returned; otherwise all rules on the system are returned.
+    /// When <paramref name="onlyManagedRules"/> is <see langword="true"/>, only rules from the local store whose display name
+    /// starts with <see cref="RuleIdentifier"/> are returned; otherwise all active rules on the system are returned
+    /// (including rules from Group Policy, MDM or created by Windows at runtime, see <see cref="FirewallRule.Source"/>).
     /// PowerShell errors during the query are logged as warnings; errors for individual
     /// rules are caught so a single malformed rule does not abort the entire load.
     /// </summary>
@@ -100,55 +127,39 @@ public static async Task<List<FirewallRule>> GetRulesAsync(bool onlyManagedRules
     $addressFilter     = $rule | Get-NetFirewallAddressFilter
     $appFilter         = $rule | Get-NetFirewallApplicationFilter
     $ifTypeFilter      = $rule | Get-NetFirewallInterfaceTypeFilter
-    [PSCustomObject]@{{
-        Id            = $rule.ID
-        DisplayName   = $rule.DisplayName
-        Enabled       = ($rule.Enabled -eq 'True')
-        Description   = $rule.Description
-        Direction     = [string]$rule.Direction
-        Action        = [string]$rule.Action
-        Protocol      = $portFilter.Protocol
-        LocalPort     = ($portFilter.LocalPort   -join ',')
-        RemotePort    = ($portFilter.RemotePort  -join ',')
-        LocalAddress  = ($addressFilter.LocalAddress  -join ',')
-        RemoteAddress = ($addressFilter.RemoteAddress -join ',')
-        Profile       = [string]$rule.Profile
-        InterfaceType = [string]$ifTypeFilter.InterfaceType
-        Program       = $appFilter.Program
-    }}
+    $svcFilter         = $rule | Get-NetFirewallServiceFilter
+    {RuleProjectionScript}
 }}");
                 }
                 else
                 {
                     ps.AddScript($@"
-$rules = Get-NetFirewallRule
-$pf = @{{}}; Get-NetFirewallPortFilter | ForEach-Object {{ $pf[$_.InstanceID] = $_ }}
-$af = @{{}}; Get-NetFirewallAddressFilter | ForEach-Object {{ $af[$_.InstanceID] = $_ }}
-$app = @{{}}; Get-NetFirewallApplicationFilter | ForEach-Object {{ $app[$_.InstanceID] = $_ }}
-$if = @{{}}; Get-NetFirewallInterfaceTypeFilter | ForEach-Object {{ $if[$_.InstanceID] = $_ }}
+$rules = Get-NetFirewallRule -PolicyStore ActiveStore
+$pf = @{{}}; Get-NetFirewallPortFilter -PolicyStore ActiveStore | ForEach-Object {{ $pf[$_.InstanceID] = $_ }}
+$af = @{{}}; Get-NetFirewallAddressFilter -PolicyStore ActiveStore | ForEach-Object {{ $af[$_.InstanceID] = $_ }}
+$app = @{{}}; Get-NetFirewallApplicationFilter -PolicyStore ActiveStore | ForEach-Object {{ $app[$_.InstanceID] = $_ }}
+$if = @{{}}; Get-NetFirewallInterfaceTypeFilter -PolicyStore ActiveStore | ForEach-Object {{ $if[$_.InstanceID] = $_ }}
+$sf = @{{}}; Get-NetFirewallServiceFilter -PolicyStore ActiveStore | ForEach-Object {{ $sf[$_.InstanceID] = $_ }}
+# The filters are matched by InstanceID. If an ID occurs more than once (e.g. a local and a Group Policy rule
+# with the same ID), the filters of these rules are queried per rule, so they are not mixed up.
+$count = @{{}}; foreach ($rule in $rules) {{ $count[$rule.InstanceID]++ }}
 $list = [System.Collections.Generic.List[PSCustomObject]]::new($rules.Count)
 foreach ($rule in $rules) {{
     $id = $rule.InstanceID
-    $portFilter    = $pf[$id]
-    $addressFilter = $af[$id]
-    $appFilter     = $app[$id]
-    $ifTypeFilter  = $if[$id]
-    $list.Add([PSCustomObject]@{{
-        Id            = $rule.ID
-        DisplayName   = $rule.DisplayName
-        Enabled       = ($rule.Enabled -eq 'True')
-        Description   = $rule.Description
-        Direction     = [string]$rule.Direction
-        Action        = [string]$rule.Action
-        Protocol      = $portFilter.Protocol
-        LocalPort     = ($portFilter.LocalPort   -join ',')
-        RemotePort    = ($portFilter.RemotePort  -join ',')
-        LocalAddress  = ($addressFilter.LocalAddress  -join ',')
-        RemoteAddress = ($addressFilter.RemoteAddress -join ',')
-        Profile       = [string]$rule.Profile
-        InterfaceType = [string]$ifTypeFilter.InterfaceType
-        Program       = $appFilter.Program
-    }})
+    if ($count[$id] -gt 1) {{
+        $portFilter    = $rule | Get-NetFirewallPortFilter
+        $addressFilter = $rule | Get-NetFirewallAddressFilter
+        $appFilter     = $rule | Get-NetFirewallApplicationFilter
+        $ifTypeFilter  = $rule | Get-NetFirewallInterfaceTypeFilter
+        $svcFilter     = $rule | Get-NetFirewallServiceFilter
+    }} else {{
+        $portFilter    = $pf[$id]
+        $addressFilter = $af[$id]
+        $appFilter     = $app[$id]
+        $ifTypeFilter  = $if[$id]
+        $svcFilter     = $sf[$id]
+    }}
+    $list.Add({RuleProjectionScript})
 }}
 $list");
                 }
@@ -166,27 +177,40 @@ public static async Task<List<FirewallRule>> GetRulesAsync(bool onlyManagedRules
                     try
                     {
                         var displayName = result.Properties["DisplayName"]?.Value?.ToString() ?? string.Empty;
+                        var source = ParseSource(result.Properties["SourceType"]?.Value?.ToString());
+
+                        // Rules from a policy can't be changed locally, even if they have the NETworkManager prefix
+                        var isManaged = source == FirewallRuleSource.Local &&
+                                        displayName.StartsWith(RuleIdentifier, StringComparison.Ordinal);
 
                         var rule = new FirewallRule
                         {
                             Id = result.Properties["Id"]?.Value?.ToString() ?? string.Empty,
                             IsEnabled = result.Properties["Enabled"]?.Value as bool? == true,
-                            Name = displayName.StartsWith(RuleIdentifier, StringComparison.Ordinal)
-                                                  ? displayName[RuleIdentifier.Length..]
-                                                  : displayName,
+                            IsManaged = isManaged,
+                            Source = source,
+                            Name = isManaged ? displayName[RuleIdentifier.Length..] : displayName,
                             Description = result.Properties["Description"]?.Value?.ToString() ?? string.Empty,
                             Direction = ParseDirection(result.Properties["Direction"]?.Value?.ToString()),
                             Action = ParseAction(result.Properties["Action"]?.Value?.ToString()),
                             Protocol = ParseProtocol(result.Properties["Protocol"]?.Value?.ToString()),
-                            LocalPorts = ParsePorts(result.Properties["LocalPort"]?.Value?.ToString()),
-                            RemotePorts = ParsePorts(result.Properties["RemotePort"]?.Value?.ToString()),
+                            LocalPorts = ParsePorts(result.Properties["LocalPort"]?.Value?.ToString(), out var localPortKeywords),
+                            LocalPortKeywords = localPortKeywords,
+                            RemotePorts = ParsePorts(result.Properties["RemotePort"]?.Value?.ToString(), out var remotePortKeywords),
+                            RemotePortKeywords = remotePortKeywords,
                             LocalAddresses = ParseAddresses(result.Properties["LocalAddress"]?.Value?.ToString()),
                             RemoteAddresses = ParseAddresses(result.Properties["RemoteAddress"]?.Value?.ToString()),
                             NetworkProfiles = ParseProfile(result.Properties["Profile"]?.Value?.ToString()),
-                            InterfaceType = ParseInterfaceType(result.Properties["InterfaceType"]?.Value?.ToString()),
+                            InterfaceType = ParseInterfaceType(result.Properties["InterfaceType"]?.Value?.ToString(), out var interfaceTypeRaw),
+                            InterfaceTypeRaw = interfaceTypeRaw,
+                            HiddenProperties = ParseHiddenProperties(
+                                result.Properties["IcmpType"]?.Value?.ToString(),
+                                result.Properties["Service"]?.Value?.ToString(),
+                                result.Properties["Package"]?.Value?.ToString()),
                         };
 
-                        var program = result.Properties["Program"]?.Value as string;
+                        // Use ToString() (not "as string"), because the value can be wrapped in a PSObject
+                        var program = result.Properties["Program"]?.Value?.ToString();
 
                         if (!string.IsNullOrWhiteSpace(program) && !program.Equals("Any", StringComparison.OrdinalIgnoreCase))
                             rule.Program = new FirewallRuleProgram(program);
@@ -230,20 +254,6 @@ public static Task SetRulesEnabledAsync(IEnumerable<FirewallRule> rules, bool en
             rules.Select(rule => rule.Id).ToList());
     }
 
-    /// <summary>
-    /// Permanently removes the given <paramref name="rule"/>.
-    /// </summary>
-    /// <param name="rule">
-    /// The firewall rule to delete.
-    /// </param>
-    /// <exception cref="Exception">
-    /// Thrown when the rule no longer exists or the PowerShell pipeline reports one or more errors.
-    /// </exception>
-    public static Task DeleteRuleAsync(FirewallRule rule)
-    {
-        return DeleteRulesAsync([rule]);
-    }
-
     /// <summary>
     /// Permanently removes the given <paramref name="rules"/> by running
     /// <c>Remove-NetFirewallRule</c> against the rules' internal <see cref="FirewallRule.Id"/>.
@@ -267,13 +277,16 @@ public static Task DeleteRulesAsync(IEnumerable<FirewallRule> rules)
     /// rules may already be changed.
     /// </summary>
     /// <param name="command">
-    /// The cmdlet to run. Must accept the rule IDs via <c>-Name</c>.
+    /// The cmdlet to run. Must accept the rules via the pipeline.
     /// </param>
     /// <param name="ids">
     /// The internal IDs of the rules. Nothing is done if the list is empty.
     /// </param>
+    /// <exception cref="FirewallRuleNotFoundException">
+    /// Thrown when a rule no longer exists.
+    /// </exception>
     /// <exception cref="Exception">
-    /// Thrown when a rule no longer exists or the PowerShell pipeline reports one or more errors.
+    /// Thrown when the PowerShell pipeline reports one or more errors.
     /// </exception>
     private static async Task InvokeRuleCommandAsync(string command, IReadOnlyCollection<string> ids)
     {
@@ -288,12 +301,101 @@ await Task.Run(() =>
                 using var ps = SMA.PowerShell.Create();
                 ps.Runspace = SharedRunspace;
 
-                // Check that all rules still exist before changing anything
                 ps.AddScript($@"
+{BuildGetRulesByIdScript(ids)}
+$rules | {command}");
+                var results = ps.Invoke();
+
+                ThrowIfRuleNotFound(results);
+
+                if (ps.Streams.Error.Count > 0)
+                    throw new Exception(string.Join("; ", ps.Streams.Error));
+            });
+        }
+        finally
+        {
+            RunspaceLock.Release();
+        }
+    }
+
+    /// <summary>
+    /// Builds a PowerShell script that gets the rules with the given IDs and stores them in <c>$rules</c>.
+    /// If one of the rules no longer exists, <see cref="RuleNotFoundMarker"/> is returned and the script is stopped,
+    /// so nothing is changed in this case (see <see cref="ThrowIfRuleNotFound"/>).
+    /// The IDs of rules not created by NETworkManager can contain wildcard characters (e.g. <c>"[x64]"</c> in
+    /// rules created by Windows for a program). Since <c>-Name</c> supports wildcards (including the backtick as
+    /// escape character), these rules are found by comparing the names instead, otherwise a different or no rule could be changed.
+    /// </summary>
+    /// <param name="ids">
+    /// The internal IDs of the rules.
+    /// </param>
+    private static string BuildGetRulesByIdScript(IReadOnlyCollection<string> ids) => $@"
 $ids = {ToPsArray(ids)}
-Get-NetFirewallRule -Name $ids -ErrorAction Stop | Out-Null
-{command} -Name $ids");
-                ps.Invoke();
+if ($ids | Where-Object {{ $_ -match '[\[\]\*\?`]' }}) {{
+    $rules = @(Get-NetFirewallRule | Where-Object {{ $ids -contains $_.Name }})
+}} else {{
+    $rules = @(Get-NetFirewallRule -Name $ids -ErrorAction SilentlyContinue)
+}}
+if ($rules.Count -ne $ids.Count) {{
+    return '{RuleNotFoundMarker}'
+}}";
+
+    /// <summary>
+    /// Value returned by the script of <see cref="BuildGetRulesByIdScript"/> if a rule no longer exists.
+    /// </summary>
+    private const string RuleNotFoundMarker = "NETworkManager_FirewallRuleNotFound";
+
+    /// <summary>
+    /// Throws a <see cref="FirewallRuleNotFoundException"/> if the script of <see cref="BuildGetRulesByIdScript"/>
+    /// returned <see cref="RuleNotFoundMarker"/>.
+    /// </summary>
+    /// <param name="results">The results of the PowerShell invocation.</param>
+    private static void ThrowIfRuleNotFound(IEnumerable<SMA.PSObject> results)
+    {
+        if (results.Any(result => result?.BaseObject is string value && value == RuleNotFoundMarker))
+            throw new FirewallRuleNotFoundException();
+    }
+
+    /// <summary>
+    /// Updates the existing rule <paramref name="original"/> with the properties of <paramref name="updated"/>
+    /// using <c>Set-NetFirewallRule</c>. Only changed properties are set, so properties that are not
+    /// supported by NETworkManager (e.g. rule group, service or ICMP types) and the internal ID are kept.
+    /// Nothing is done if no property was changed.
+    /// </summary>
+    /// <param name="original">
+    /// The rule as it was loaded (used to identify the rule and to detect the changes).
+    /// </param>
+    /// <param name="updated">
+    /// The rule with the new properties.
+    /// </param>
+    /// <exception cref="FirewallRuleNotFoundException">
+    /// Thrown when the rule no longer exists.
+    /// </exception>
+    /// <exception cref="Exception">
+    /// Thrown when the PowerShell pipeline reports one or more errors.
+    /// </exception>
+    public static async Task UpdateRuleAsync(FirewallRule original, FirewallRule updated)
+    {
+        var paramsScript = BuildUpdateParamsScript(original, updated);
+
+        if (paramsScript == null)
+            return;
+
+        await RunspaceLock.WaitAsync();
+        try
+        {
+            await Task.Run(() =>
+            {
+                using var ps = SMA.PowerShell.Create();
+                ps.Runspace = SharedRunspace;
+
+                ps.AddScript($@"
+{BuildGetRulesByIdScript([original.Id])}
+{paramsScript}
+$rules | Set-NetFirewallRule @params");
+                var results = ps.Invoke();
+
+                ThrowIfRuleNotFound(results);
 
                 if (ps.Streams.Error.Count > 0)
                     throw new Exception(string.Join("; ", ps.Streams.Error));
@@ -305,6 +407,96 @@ await Task.Run(() =>
         }
     }
 
+    /// <summary>
+    /// Builds the PowerShell hashtable <c>$params</c> for <c>Set-NetFirewallRule</c> with all properties
+    /// that differ between <paramref name="original"/> and <paramref name="updated"/>.
+    /// </summary>
+    /// <param name="original">The rule as it was loaded.</param>
+    /// <param name="updated">The rule with the new properties.</param>
+    /// <returns>The script, or <see langword="null"/> if no property was changed.</returns>
+    private static string BuildUpdateParamsScript(FirewallRule original, FirewallRule updated)
+    {
+        var sb = new StringBuilder();
+
+        void Add(string key, string value) => sb.AppendLine($"$params['{key}'] = {value}");
+
+        if (!string.Equals(original.Name, updated.Name, StringComparison.Ordinal))
+        {
+            var prefix = original.IsManaged ? RuleIdentifier : string.Empty;
+            Add("NewDisplayName", $"'{prefix}{PowerShellHelper.EscapeSingleQuotes(updated.Name)}'");
+        }
+
+        if (original.IsEnabled != updated.IsEnabled)
+            Add("Enabled", $"'{(updated.IsEnabled ? "True" : "False")}'");
+
+        if (!string.Equals(original.Description ?? string.Empty, updated.Description ?? string.Empty, StringComparison.Ordinal))
+            Add("Description", $"'{PowerShellHelper.EscapeSingleQuotes(updated.Description ?? string.Empty)}'");
+
+        if (original.Direction != updated.Direction)
+            Add("Direction", $"'{updated.Direction}'");
+
+        if (original.Action != updated.Action)
+            Add("Action", $"'{updated.Action}'");
+
+        var protocolChanged = original.Protocol != updated.Protocol;
+
+        if (protocolChanged)
+        {
+            Add("Protocol", $"'{GetProtocolString(updated.Protocol)}'");
+
+            // ICMP types (e.g. set in the Windows Firewall management console) are only valid for the ICMP protocol
+            // they were set for, so they are reset if the protocol is changed (otherwise the change could be rejected)
+            Add("IcmpType", "'Any'");
+        }
+
+        // Ports are only allowed for TCP / UDP, so they are reset to "Any" if the protocol is changed to another one
+        var portsAllowed = updated.Protocol is FirewallProtocol.TCP or FirewallProtocol.UDP;
+
+        if (protocolChanged || PortsChanged(original.LocalPorts, updated.LocalPorts))
+            Add("LocalPort", portsAllowed && updated.LocalPorts.Count > 0
+                ? ToPsArray(updated.LocalPorts.Select(p => p.ToString()))
+                : "'Any'");
+
+        if (protocolChanged || PortsChanged(original.RemotePorts, updated.RemotePorts))
+            Add("RemotePort", portsAllowed && updated.RemotePorts.Count > 0
+                ? ToPsArray(updated.RemotePorts.Select(p => p.ToString()))
+                : "'Any'");
+
+        if (AddressesChanged(original.LocalAddresses, updated.LocalAddresses))
+            Add("LocalAddress", updated.LocalAddresses.Count > 0 ? ToPsArray(updated.LocalAddresses) : "'Any'");
+
+        if (AddressesChanged(original.RemoteAddresses, updated.RemoteAddresses))
+            Add("RemoteAddress", updated.RemoteAddresses.Count > 0 ? ToPsArray(updated.RemoteAddresses) : "'Any'");
+
+        if (!string.Equals(original.Program?.Name, updated.Program?.Name, StringComparison.OrdinalIgnoreCase))
+            Add("Program", updated.Program != null && !string.IsNullOrWhiteSpace(updated.Program.Name)
+                ? $"'{PowerShellHelper.EscapeSingleQuotes(updated.Program.Name)}'"
+                : "'Any'");
+
+        if (original.InterfaceType != updated.InterfaceType)
+            Add("InterfaceType", $"'{GetInterfaceTypeString(updated.InterfaceType)}'");
+
+        if (!original.NetworkProfiles.SequenceEqual(updated.NetworkProfiles))
+            Add("Profile", $"'{GetProfileString(updated.NetworkProfiles)}'");
+
+        if (sb.Length == 0)
+            return null;
+
+        return "$params = @{}" + Environment.NewLine + sb;
+    }
+
+    /// <summary>
+    /// Indicates whether the ports differ (in the given order).
+    /// </summary>
+    private static bool PortsChanged(List<FirewallPortSpecification> original, List<FirewallPortSpecification> updated) =>
+        FirewallRule.PortsToString(original, ',', false) != FirewallRule.PortsToString(updated, ',', false);
+
+    /// <summary>
+    /// Indicates whether the addresses differ (in the given order, case-insensitive).
+    /// </summary>
+    private static bool AddressesChanged(List<string> original, List<string> updated) =>
+        !string.Equals(string.Join(",", original), string.Join(",", updated), StringComparison.OrdinalIgnoreCase);
+
     /// <summary>
     /// Creates a new Windows Firewall rule with the properties specified in <paramref name="rule"/>.
     /// The rule's <see cref="FirewallRule.Name"/> is prefixed with <see cref="RuleIdentifier"/> so
@@ -407,8 +599,9 @@ private static string ToPsArray(IEnumerable<string> values) =>
         FirewallProtocol.UDP => "UDP",
         FirewallProtocol.ICMPv4 => "ICMPv4",
         FirewallProtocol.ICMPv6 => "ICMPv6",
-        FirewallProtocol.GRE => "GRE",
-        FirewallProtocol.L2TP => "L2TP",
+        // Only TCP, UDP, ICMPv4 and ICMPv6 are documented as names, all other protocols are passed by number
+        FirewallProtocol.GRE => "47",
+        FirewallProtocol.L2TP => "115",
         _ => ((int)protocol).ToString()
     };
 
@@ -505,13 +698,19 @@ private static FirewallProtocol ParseProtocol(string value)
     /// Parses a comma-separated port string (e.g. <c>"80,443,8080-8090"</c>) to a list of
     /// <see cref="FirewallPortSpecification"/> objects.
     /// Returns an empty list when the value is blank or <c>"Any"</c>.
+    /// Port keywords (e.g. <c>"RPC"</c>, <c>"RPCEPMap"</c>, <c>"IPHTTPSIn"</c>), which are used by
+    /// Windows built-in rules but are not supported by NETworkManager, are returned in <paramref name="keywords"/>.
     /// </summary>
     /// <param name="value">
     /// The raw comma-separated port string returned by PowerShell.
     /// </param>
-    private static List<FirewallPortSpecification> ParsePorts(string value)
+    /// <param name="keywords">
+    /// The port keywords found in <paramref name="value"/>.
+    /// </param>
+    private static List<FirewallPortSpecification> ParsePorts(string value, out List<string> keywords)
     {
         var list = new List<FirewallPortSpecification>();
+        keywords = [];
 
         if (string.IsNullOrWhiteSpace(value) || value.Equals("Any", StringComparison.OrdinalIgnoreCase))
             return list;
@@ -530,6 +729,10 @@ private static List<FirewallPortSpecification> ParsePorts(string value)
             {
                 list.Add(new FirewallPortSpecification(port));
             }
+            else
+            {
+                keywords.Add(token);
+            }
         }
 
         return list;
@@ -608,15 +811,81 @@ private static List<string> ParseAddresses(string value)
         return addresses;
     }
 
+    /// <summary>
+    /// Determines the <see cref="FirewallRuleHiddenProperties"/> of a rule. A property is set if its value
+    /// is not empty and not <c>"Any"</c>.
+    /// </summary>
+    /// <param name="icmpTypes">The ICMP types (comma-separated) returned by PowerShell.</param>
+    /// <param name="service">The service returned by PowerShell.</param>
+    /// <param name="package">The app package returned by PowerShell.</param>
+    private static FirewallRuleHiddenProperties ParseHiddenProperties(string icmpTypes, string service, string package)
+    {
+        static bool IsSet(string value) =>
+            !string.IsNullOrWhiteSpace(value) && !value.Equals("Any", StringComparison.OrdinalIgnoreCase);
+
+        var properties = FirewallRuleHiddenProperties.None;
+
+        if (IsSet(icmpTypes))
+            properties |= FirewallRuleHiddenProperties.IcmpTypes;
+
+        if (IsSet(service))
+            properties |= FirewallRuleHiddenProperties.Service;
+
+        if (IsSet(package))
+            properties |= FirewallRuleHiddenProperties.Package;
+
+        return properties;
+    }
+
+    /// <summary>
+    /// Parses a PowerShell policy store source type string (e.g. <c>"Local"</c>, <c>"GroupPolicy"</c>) to a
+    /// <see cref="FirewallRuleSource"/> value. Defaults to <see cref="FirewallRuleSource.Local"/> if empty
+    /// and to <see cref="FirewallRuleSource.Other"/> for other sources (e.g. <c>"Dynamic"</c>, <c>"Hardcoded"</c>).
+    /// </summary>
+    /// <param name="value">
+    /// The raw string value returned by PowerShell.
+    /// </param>
+    private static FirewallRuleSource ParseSource(string value)
+    {
+        if (string.IsNullOrWhiteSpace(value))
+            return FirewallRuleSource.Local;
+
+        return value switch
+        {
+            "Local" => FirewallRuleSource.Local,
+            "GroupPolicy" => FirewallRuleSource.GroupPolicy,
+            "MDM" => FirewallRuleSource.MDM,
+            _ => FirewallRuleSource.Other,
+        };
+    }
+
     /// <summary>
     /// Parses a PowerShell interface-type string (e.g. <c>"Wired"</c>) to a
     /// <see cref="FirewallInterfaceType"/> value. Defaults to <see cref="FirewallInterfaceType.Any"/>.
+    /// A combination of interface types (e.g. <c>"Wired, Wireless"</c>) is not supported by NETworkManager;
+    /// in this case <see cref="FirewallInterfaceType.Any"/> is returned and the raw value is returned in
+    /// <paramref name="raw"/>. A combination of all interface types is the same as <c>"Any"</c>.
     /// </summary>
     /// <param name="value">
     /// The raw string value returned by PowerShell.
     /// </param>
-    private static FirewallInterfaceType ParseInterfaceType(string value)
+    /// <param name="raw">
+    /// The raw value if it is an unsupported combination of interface types; otherwise, <see langword="null"/>.
+    /// </param>
+    private static FirewallInterfaceType ParseInterfaceType(string value, out string raw)
     {
+        raw = null;
+
+        if (value != null && value.Contains(','))
+        {
+            var types = value.Split(',', StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries);
+
+            if (!(types.Contains("Wired") && types.Contains("Wireless") && types.Contains("RemoteAccess")))
+                raw = value;
+
+            return FirewallInterfaceType.Any;
+        }
+
         return value switch
         {
             "Wired" => FirewallInterfaceType.Wired,
diff --git a/Source/NETworkManager.Models/Firewall/FirewallRule.cs b/Source/NETworkManager.Models/Firewall/FirewallRule.cs
index bb3ea76d36..6fd01c5a90 100644
--- a/Source/NETworkManager.Models/Firewall/FirewallRule.cs
+++ b/Source/NETworkManager.Models/Firewall/FirewallRule.cs
@@ -18,6 +18,24 @@ public class FirewallRule
     /// </summary>
     public string Id { get; set; }
 
+    /// <summary>
+    /// Indicates whether the rule is managed by NETworkManager (i.e. its display name starts with
+    /// the NETworkManager prefix). Rules not managed by NETworkManager (e.g. Windows built-in rules)
+    /// may have properties that are not supported by NETworkManager and can therefore not be edited.
+    /// </summary>
+    public bool IsManaged { get; set; }
+
+    /// <summary>
+    /// Where the rule comes from (e.g. local store or Group Policy).
+    /// </summary>
+    public FirewallRuleSource Source { get; set; } = FirewallRuleSource.Local;
+
+    /// <summary>
+    /// Indicates whether the rule is managed by a policy (e.g. Group Policy or MDM) or created by Windows at runtime,
+    /// i.e. it does not come from the local store. Such rules can't be changed locally (only copied).
+    /// </summary>
+    public bool IsManagedByPolicy => Source != FirewallRuleSource.Local;
+
     /// <summary>
     /// Human-readable display name of the firewall rule. Used for display purposes
     /// or as an identifier in various contexts.
@@ -135,6 +153,70 @@ public bool[] NetworkProfiles
 
     public FirewallInterfaceType InterfaceType { get; set; } = FirewallInterfaceType.Any;
 
+    /// <summary>
+    /// Local port keywords (e.g. "RPC", "RPCEPMap", "IPHTTPSIn") used by Windows built-in rules.
+    /// Not supported by NETworkManager (only shown).
+    /// </summary>
+    public List<string> LocalPortKeywords { get; set; } = [];
+
+    /// <summary>
+    /// Remote port keywords (e.g. "IPHTTPSOut") used by Windows built-in rules.
+    /// Not supported by NETworkManager (only shown).
+    /// </summary>
+    public List<string> RemotePortKeywords { get; set; } = [];
+
+    /// <summary>
+    /// Raw interface type if the rule uses a combination of interface types (e.g. "Wired, Wireless"),
+    /// which is not supported by NETworkManager; otherwise, <c>null</c>. <see cref="InterfaceType"/> is
+    /// <see cref="FirewallInterfaceType.Any"/> in this case.
+    /// </summary>
+    public string InterfaceTypeRaw { get; set; }
+
+    /// <summary>
+    /// Properties that are not supported (and not shown) by NETworkManager, but restrict the traffic the rule
+    /// applies to (e.g. ICMP types or a service, set in the Windows Firewall management console). They are kept
+    /// when the rule is edited, but not when it is copied.
+    /// </summary>
+    public FirewallRuleHiddenProperties HiddenProperties { get; set; }
+
+    /// <summary>
+    /// Indicates whether the rule has <see cref="HiddenProperties"/>. A copy of the rule would apply to more traffic.
+    /// </summary>
+    public bool HasHiddenProperties => HiddenProperties != FirewallRuleHiddenProperties.None;
+
+    /// <summary>
+    /// Protocols supported by NETworkManager (e.g. available in the add / edit rule dialog).
+    /// Other protocols (e.g. IPv6 = 41 or IGMP = 2) are only shown.
+    /// </summary>
+    public static IReadOnlyList<FirewallProtocol> SupportedProtocols { get; } =
+    [
+        FirewallProtocol.Any,
+        FirewallProtocol.TCP,
+        FirewallProtocol.UDP,
+        FirewallProtocol.ICMPv4,
+        FirewallProtocol.ICMPv6,
+        FirewallProtocol.GRE,
+        FirewallProtocol.L2TP
+    ];
+
+    /// <summary>
+    /// Program keyword used by Windows built-in rules for the system process (e.g. File and Printer Sharing).
+    /// Not supported by NETworkManager, because the program must be a path to an existing file.
+    /// </summary>
+    private const string SystemProgramKeyword = "System";
+
+    /// <summary>
+    /// Indicates whether the rule uses values that are not supported by NETworkManager
+    /// (port keywords, a combination of interface types, a protocol that is not in <see cref="SupportedProtocols"/>
+    /// or the program keyword <c>System</c>). Such rules can't be edited or copied, because these values
+    /// would be lost and the new rule could apply to more traffic.
+    /// </summary>
+    public bool HasUnsupportedValues => LocalPortKeywords.Count > 0 ||
+                                        RemotePortKeywords.Count > 0 ||
+                                        InterfaceTypeRaw != null ||
+                                        !SupportedProtocols.Contains(Protocol) ||
+                                        string.Equals(Program?.Name, SystemProgramKeyword, System.StringComparison.OrdinalIgnoreCase);
+
     /// <summary>
     /// Represents the operation to be performed or executed.
     /// </summary>
@@ -160,17 +242,40 @@ public FirewallRule()
     /// <summary>Program path, or <c>null</c> when no program restriction is set.</summary>
     public string ProgramDisplay => Program?.ToString();
 
+    /// <summary>
+    /// File name of the program (e.g. "putty.exe" for "%ProgramFiles%\PuTTY\putty.exe", or the keyword "System"),
+    /// or <c>null</c> when no program restriction is set.
+    /// </summary>
+    public string ProgramFileName
+    {
+        get
+        {
+            var name = Program?.Name;
+
+            if (string.IsNullOrEmpty(name))
+                return null;
+
+            return name[(name.LastIndexOfAny(['\\', '/']) + 1)..];
+        }
+    }
+
     /// <summary>Local addresses as a human-readable string (e.g. "192.168.1.0/24; LocalSubnet"). Returns <c>null</c> when unrestricted.</summary>
     public string LocalAddressesDisplay => LocalAddresses.Count == 0 ? null : string.Join("; ", LocalAddresses);
 
     /// <summary>Local ports as a human-readable string (e.g. "80; 443; 8080-8090"). Returns <c>null</c> when unrestricted.</summary>
-    public string LocalPortsDisplay => LocalPorts.Count == 0 ? null : PortsToString(LocalPorts);
+    public string LocalPortsDisplay => PortsToDisplayString(LocalPorts, LocalPortKeywords);
 
     /// <summary>Remote addresses as a human-readable string (e.g. "10.0.0.0/8"). Returns <c>null</c> when unrestricted.</summary>
     public string RemoteAddressesDisplay => RemoteAddresses.Count == 0 ? null : string.Join("; ", RemoteAddresses);
 
     /// <summary>Remote ports as a human-readable string (e.g. "80; 443"). Returns <c>null</c> when unrestricted.</summary>
-    public string RemotePortsDisplay => RemotePorts.Count == 0 ? null : PortsToString(RemotePorts);
+    public string RemotePortsDisplay => PortsToDisplayString(RemotePorts, RemotePortKeywords);
+
+    /// <summary>
+    /// Interface type as string (e.g. "Wired"). For a combination of interface types, which is not supported by
+    /// NETworkManager, the raw value (e.g. "Wired, Wireless") is returned. Not localized (e.g. used for export).
+    /// </summary>
+    public string InterfaceTypeDisplay => InterfaceTypeRaw ?? InterfaceType.ToString();
 
     /// <summary>
     /// Network profiles (Domain / Private / Public) as a comma-separated string.
@@ -212,5 +317,19 @@ public string NetworkProfilesDisplay
 
         return string.Join(delimiter, ports.Select(port => port.ToString()));
     }
+
+    /// <summary>
+    /// Converts ports and port keywords (e.g. "RPC") to a human-readable string (e.g. "135; RPC").
+    /// </summary>
+    /// <param name="ports">The ports.</param>
+    /// <param name="keywords">The port keywords.</param>
+    /// <returns>The ports as string, or <c>null</c> when unrestricted.</returns>
+    private static string PortsToDisplayString(List<FirewallPortSpecification> ports, List<string> keywords)
+    {
+        if (ports.Count == 0 && keywords.Count == 0)
+            return null;
+
+        return string.Join("; ", ports.Select(port => port.ToString()).Concat(keywords));
+    }
     #endregion
 }
\ No newline at end of file
diff --git a/Source/NETworkManager.Models/Firewall/FirewallRuleHiddenProperties.cs b/Source/NETworkManager.Models/Firewall/FirewallRuleHiddenProperties.cs
new file mode 100644
index 0000000000..863ae92f16
--- /dev/null
+++ b/Source/NETworkManager.Models/Firewall/FirewallRuleHiddenProperties.cs
@@ -0,0 +1,32 @@
+using System;
+
+namespace NETworkManager.Models.Firewall;
+
+/// <summary>
+/// Properties of a firewall rule that are not supported (and not shown) by NETworkManager, but restrict
+/// the traffic the rule applies to. If they are lost (e.g. when a rule is copied), the new rule applies
+/// to more traffic than the original rule.
+/// </summary>
+[Flags]
+public enum FirewallRuleHiddenProperties
+{
+    /// <summary>
+    /// No hidden properties.
+    /// </summary>
+    None = 0,
+
+    /// <summary>
+    /// ICMP types (e.g. only echo request).
+    /// </summary>
+    IcmpTypes = 1,
+
+    /// <summary>
+    /// Windows service (e.g. only a single service hosted by svchost.exe).
+    /// </summary>
+    Service = 2,
+
+    /// <summary>
+    /// App package (e.g. only a single Microsoft Store app).
+    /// </summary>
+    Package = 4
+}
\ No newline at end of file
diff --git a/Source/NETworkManager.Models/Firewall/FirewallRuleNotFoundException.cs b/Source/NETworkManager.Models/Firewall/FirewallRuleNotFoundException.cs
new file mode 100644
index 0000000000..746274dcb0
--- /dev/null
+++ b/Source/NETworkManager.Models/Firewall/FirewallRuleNotFoundException.cs
@@ -0,0 +1,17 @@
+using System;
+
+namespace NETworkManager.Models.Firewall;
+
+/// <summary>
+/// Exception thrown when one or more firewall rules no longer exist (e.g. deleted in the Windows Firewall
+/// management console). Nothing is changed in this case. Used to show a localized message.
+/// </summary>
+public class FirewallRuleNotFoundException : Exception
+{
+    /// <summary>
+    /// Initializes a new instance of the <see cref="FirewallRuleNotFoundException"/> class.
+    /// </summary>
+    public FirewallRuleNotFoundException() : base("One or more firewall rules no longer exist.")
+    {
+    }
+}
\ No newline at end of file
diff --git a/Source/NETworkManager.Models/Firewall/FirewallRuleProgram.cs b/Source/NETworkManager.Models/Firewall/FirewallRuleProgram.cs
index 46cb44d6c3..8aaf7fa8fc 100644
--- a/Source/NETworkManager.Models/Firewall/FirewallRuleProgram.cs
+++ b/Source/NETworkManager.Models/Firewall/FirewallRuleProgram.cs
@@ -59,6 +59,10 @@ public FirewallRuleProgram()
 
     /// <summary>
     /// Construct program reference for firewall rule.
+    /// The path is converted to a full path, because Windows Firewall matches programs by their full path.
+    /// Paths with environment variables (e.g. <c>%SystemRoot%\System32\svchost.exe</c>) and the keyword
+    /// <c>System</c> (used by Windows built-in rules) are kept as they are, because they would otherwise be
+    /// resolved relative to the current directory.
     /// </summary>
     /// <param name="pathToExe"></param>
     public FirewallRuleProgram(string pathToExe)
@@ -66,18 +70,20 @@ public FirewallRuleProgram(string pathToExe)
         ArgumentNullException.ThrowIfNull(pathToExe);
         var exe = new FileInfo(pathToExe);
         Executable = exe;
-        Name = exe.FullName;
+        Name = pathToExe.Contains('%') || pathToExe.Equals("System", StringComparison.OrdinalIgnoreCase)
+            ? pathToExe
+            : exe.FullName;
     }
     #endregion
 
     #region Methods
     /// <summary>
-    /// Convert the full file path to string.
+    /// Convert the file path (as stored in the rule) to string.
     /// </summary>
     /// <returns></returns>
     public override string ToString()
     {
-        return Executable?.FullName;
+        return Name;
     }
 
     /// <summary>
@@ -88,7 +94,7 @@ public object Clone()
     {
         try
         {
-            return new FirewallRuleProgram(Executable?.FullName);
+            return new FirewallRuleProgram(Name);
         }
         catch (ArgumentNullException)
         {
diff --git a/Source/NETworkManager.Models/Firewall/FirewallRuleSource.cs b/Source/NETworkManager.Models/Firewall/FirewallRuleSource.cs
new file mode 100644
index 0000000000..1d8ecc7d86
--- /dev/null
+++ b/Source/NETworkManager.Models/Firewall/FirewallRuleSource.cs
@@ -0,0 +1,28 @@
+namespace NETworkManager.Models.Firewall;
+
+/// <summary>
+/// Defines where a firewall rule comes from (based on the <c>PolicyStoreSourceType</c> of the rule).
+/// Only <see cref="Local"/> rules can be changed locally.
+/// </summary>
+public enum FirewallRuleSource
+{
+    /// <summary>
+    /// Rule from the local store (e.g. created by NETworkManager, an application or in the Windows Firewall management console).
+    /// </summary>
+    Local,
+
+    /// <summary>
+    /// Rule from a Group Policy (domain or local Group Policy).
+    /// </summary>
+    GroupPolicy,
+
+    /// <summary>
+    /// Rule from a Mobile Device Management (MDM) policy (e.g. Microsoft Intune).
+    /// </summary>
+    MDM,
+
+    /// <summary>
+    /// Rule from another source (e.g. dynamic, generated or hardcoded rules created by Windows at runtime).
+    /// </summary>
+    Other
+}
\ No newline at end of file
diff --git a/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs b/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs
index 1d151f8852..d880a6c7d2 100644
--- a/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs
+++ b/Source/NETworkManager.Settings/GlobalStaticConfiguration.cs
@@ -1,4 +1,4 @@
-using DnsClient;
+using DnsClient;
 using Lextm.SharpSnmpLib.Messaging;
 using NETworkManager.Models;
 using NETworkManager.Models.Export;
diff --git a/Source/NETworkManager.Settings/SettingsViewManager.cs b/Source/NETworkManager.Settings/SettingsViewManager.cs
index 36a02eea09..d5d13ddd1a 100644
--- a/Source/NETworkManager.Settings/SettingsViewManager.cs
+++ b/Source/NETworkManager.Settings/SettingsViewManager.cs
@@ -74,6 +74,8 @@ public static class SettingsViewManager
             SettingsGroup.Application),
         new(SettingsName.SNTPLookup, ApplicationManager.GetIcon(ApplicationName.SNTPLookup),
             SettingsGroup.Application),
+        new(SettingsName.Firewall, ApplicationManager.GetIcon(ApplicationName.Firewall),
+            SettingsGroup.Application),
         new(SettingsName.WakeOnLAN, ApplicationManager.GetIcon(ApplicationName.WakeOnLAN),
             SettingsGroup.Application),
         new(SettingsName.RDAP, ApplicationManager.GetIcon(ApplicationName.RDAP),
diff --git a/Source/NETworkManager.Validators/EmptyOrFileExistsValidator.cs b/Source/NETworkManager.Validators/EmptyOrFileExistsValidator.cs
index d669e71e4d..b1d78c86b3 100644
--- a/Source/NETworkManager.Validators/EmptyOrFileExistsValidator.cs
+++ b/Source/NETworkManager.Validators/EmptyOrFileExistsValidator.cs
@@ -1,4 +1,5 @@
-using System.Globalization;
+using System;
+using System.Globalization;
 using System.IO;
 using System.Windows.Controls;
 using NETworkManager.Localization.Resources;
@@ -7,12 +8,22 @@ namespace NETworkManager.Validators;
 
 public class EmptyOrFileExistsValidator : ValidationRule
 {
+    /// <summary>
+    /// Expand environment variables (e.g. <c>%SystemRoot%</c>) before checking if the file exists.
+    /// Only enable this if the consumer of the path expands them as well (e.g. Windows Firewall).
+    /// </summary>
+    public bool ExpandEnvironmentVariables { get; set; }
+
     public override ValidationResult Validate(object value, CultureInfo cultureInfo)
     {
         if (string.IsNullOrEmpty(value as string))
             return ValidationResult.ValidResult;
 
-        return File.Exists((string)value)
+        var path = ExpandEnvironmentVariables
+            ? Environment.ExpandEnvironmentVariables((string)value)
+            : (string)value;
+
+        return File.Exists(path)
             ? ValidationResult.ValidResult
             : new ValidationResult(false, Strings.FileDoesNotExist);
     }
diff --git a/Source/NETworkManager/DialogHelper.cs b/Source/NETworkManager/DialogHelper.cs
index 036a12e30a..ddf550274e 100644
--- a/Source/NETworkManager/DialogHelper.cs
+++ b/Source/NETworkManager/DialogHelper.cs
@@ -99,9 +99,9 @@ public static async Task<bool> ShowConfirmationMessageAsync(Window parentWindow,
         }
 
         /// <summary>
-        /// Formats the given items as a list (one item per line) to show them in a dialog message,
-        /// e.g. the entries that will be deleted. Only the first <paramref name="maxItems"/> items are
-        /// listed, the remaining items are summarized as "(+X more)".
+        /// Formats the given items as a bulleted list (one item per line, prefixed with "- ") to show them
+        /// in a dialog message, e.g. the entries that will be deleted. Only the first <paramref name="maxItems"/>
+        /// items are listed, the remaining items are summarized as "(+X more)".
         /// </summary>
         /// <param name="items">The items to list.</param>
         /// <param name="maxItems">The maximum number of items to list.</param>
@@ -109,7 +109,7 @@ public static async Task<bool> ShowConfirmationMessageAsync(Window parentWindow,
         public static string FormatItemList(IEnumerable<string> items, int maxItems = 10)
         {
             var itemList = items.ToList();
-            var lines = itemList.Take(maxItems).ToList();
+            var lines = itemList.Take(maxItems).Select(item => $"- {item}").ToList();
 
             if (itemList.Count > maxItems)
                 lines.Add(string.Format(Strings.PlusXMore, itemList.Count - maxItems));
diff --git a/Source/NETworkManager/ViewModels/FirewallRuleViewModel.cs b/Source/NETworkManager/ViewModels/FirewallRuleViewModel.cs
index f21f1c4cbb..1419beaac3 100644
--- a/Source/NETworkManager/ViewModels/FirewallRuleViewModel.cs
+++ b/Source/NETworkManager/ViewModels/FirewallRuleViewModel.cs
@@ -89,16 +89,7 @@ public FirewallRuleViewModel(Action<FirewallRuleViewModel> okCommand,
     /// <summary>
     /// Protocols available in the protocol drop-down.
     /// </summary>
-    public IEnumerable<FirewallProtocol> Protocols { get; } =
-    [
-        FirewallProtocol.Any,
-        FirewallProtocol.TCP,
-        FirewallProtocol.UDP,
-        FirewallProtocol.ICMPv4,
-        FirewallProtocol.ICMPv6,
-        FirewallProtocol.GRE,
-        FirewallProtocol.L2TP
-    ];
+    public IEnumerable<FirewallProtocol> Protocols { get; } = FirewallRule.SupportedProtocols;
 
     /// <summary>
     /// Directions available in the direction drop-down.
diff --git a/Source/NETworkManager/ViewModels/FirewallSettingsViewModel.cs b/Source/NETworkManager/ViewModels/FirewallSettingsViewModel.cs
new file mode 100644
index 0000000000..c3898f4f28
--- /dev/null
+++ b/Source/NETworkManager/ViewModels/FirewallSettingsViewModel.cs
@@ -0,0 +1,58 @@
+using NETworkManager.Settings;
+
+namespace NETworkManager.ViewModels;
+
+/// <summary>
+/// ViewModel for the Firewall settings.
+/// </summary>
+public class FirewallSettingsViewModel : ViewModelBase
+{
+    #region Variables
+
+    private readonly bool _isLoading;
+
+    /// <summary>
+    /// Gets or sets whether to show all system firewall rules or only rules managed by NETworkManager.
+    /// </summary>
+    public bool ShowAllRules
+    {
+        get;
+        set
+        {
+            if (value == field)
+                return;
+
+            if (!_isLoading)
+                SettingsManager.Current.Firewall_ShowAllRules = value;
+
+            field = value;
+            OnPropertyChanged();
+        }
+    }
+
+    #endregion
+
+    #region Constructor, load settings
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="FirewallSettingsViewModel"/> class.
+    /// </summary>
+    public FirewallSettingsViewModel()
+    {
+        _isLoading = true;
+
+        LoadSettings();
+
+        _isLoading = false;
+    }
+
+    /// <summary>
+    /// Loads the settings into the ViewModel.
+    /// </summary>
+    private void LoadSettings()
+    {
+        ShowAllRules = SettingsManager.Current.Firewall_ShowAllRules;
+    }
+
+    #endregion
+}
\ No newline at end of file
diff --git a/Source/NETworkManager/ViewModels/FirewallViewModel.cs b/Source/NETworkManager/ViewModels/FirewallViewModel.cs
index aacd343077..6a5d6fcc9c 100644
--- a/Source/NETworkManager/ViewModels/FirewallViewModel.cs
+++ b/Source/NETworkManager/ViewModels/FirewallViewModel.cs
@@ -1,6 +1,7 @@
 using log4net;
 using MahApps.Metro.Controls;
 using MahApps.Metro.SimpleChildWindow;
+using NETworkManager.Controls;
 using NETworkManager.Localization.Resources;
 using NETworkManager.Models;
 using NETworkManager.Models.Export;
@@ -37,7 +38,7 @@ public class FirewallViewModel : ViewModelBase
     /// <summary>
     /// Gets the loaded firewall rules.
     /// </summary>
-    public ObservableCollection<FirewallRule> Results { get; } = [];
+    public ObservableRangeCollection<FirewallRule> Results { get; } = new();
 
     /// <summary>
     /// Gets the filtered/sorted view over <see cref="Results"/>.
@@ -86,6 +87,20 @@ public IList SelectedResults
     /// </summary>
     public bool IsAnySelectedEntryDisabled => GetSelectedRules().Any(rule => !rule.IsEnabled);
 
+    /// <summary>
+    /// Indicates whether at least one of the selected rules is managed by a policy (e.g. Group Policy or MDM)
+    /// or created by Windows at runtime. Such rules can't be changed locally, so enable, disable and delete
+    /// are blocked for the whole selection (also for mixed selections).
+    /// The selection is only checked if the list contains such rules (see <see cref="_hasRulesManagedByPolicy"/>),
+    /// because this is evaluated often (e.g. <see cref="ICommand.CanExecute"/>).
+    /// </summary>
+    public bool IsAnySelectedRuleManagedByPolicy => _hasRulesManagedByPolicy && GetSelectedRules().Any(rule => rule.IsManagedByPolicy);
+
+    /// <summary>
+    /// Indicates whether the loaded rules contain at least one rule managed by a policy. Updated on refresh.
+    /// </summary>
+    private bool _hasRulesManagedByPolicy;
+
     /// <summary>
     /// Gets or sets the search text for filtering rules.
     /// </summary>
@@ -104,26 +119,44 @@ public string RulesSearch
     }
 
     /// <summary>
-    /// Gets or sets whether to show all system firewall rules or only rules managed by NETworkManager.
+    /// Gets whether all system firewall rules are shown or only rules managed by NETworkManager.
+    /// Configured in the settings (see <see cref="SettingsInfo.Firewall_ShowAllRules"/>).
+    /// </summary>
+    public bool ShowAllRules => SettingsManager.Current.Firewall_ShowAllRules;
+
+    /// <summary>
+    /// Indicates whether the rules must be reloaded (e.g. because <see cref="ShowAllRules"/> was changed
+    /// in the settings). Checked when the view becomes visible and after a running refresh.
     /// </summary>
-    public bool ShowAllRules
+    private bool _refreshPending;
+
+    /// <summary>
+    /// Indicates whether the view is currently visible.
+    /// </summary>
+    private bool _isViewVisible = true;
+
+    /// <summary>
+    /// Gets or sets whether a refresh is currently running.
+    /// </summary>
+    public bool IsRefreshing
     {
-        get => SettingsManager.Current.Firewall_ShowAllRules;
+        get;
         set
         {
-            if (value == SettingsManager.Current.Firewall_ShowAllRules)
+            if (value == field)
                 return;
 
-            SettingsManager.Current.Firewall_ShowAllRules = value;
+            field = value;
             OnPropertyChanged();
-            _ = Refresh();
         }
     }
 
     /// <summary>
-    /// Gets or sets whether a refresh is currently running.
+    /// Gets or sets whether the rules are loaded initially. The rule list is replaced by a loading indicator
+    /// in this case. Other refreshes (e.g. after a rule was modified or the settings were changed) only show
+    /// the status bar indicator (see <see cref="IsRefreshing"/>), so the list stays visible.
     /// </summary>
-    public bool IsRefreshing
+    public bool IsLoading
     {
         get;
         set
@@ -216,6 +249,9 @@ public FirewallViewModel()
         // Load firewall rules
         _ = Refresh(true);
 
+        // Reload the rules when the settings are changed (e.g. show all rules)
+        SettingsManager.Current.PropertyChanged += SettingsManager_PropertyChanged;
+
         _isLoading = false;
     }
 
@@ -275,19 +311,24 @@ private async Task AddRule()
 
     /// <summary>
     /// Gets the command to enable the selected firewall rule(s).
-    /// Only executable when at least one selected rule is disabled and modification is allowed.
+    /// Only executable when at least one selected rule is disabled, no selected rule is managed by a policy
+    /// and modification is allowed.
     /// </summary>
-    public ICommand EnableRuleCommand => new RelayCommand(parameter => { _ = SetRulesEnabled(true); }, _ => ModifyRule_CanExecute() && IsAnySelectedEntryDisabled);
+    public ICommand EnableRuleCommand => new RelayCommand(parameter => { _ = SetRulesEnabled(true); },
+        _ => ModifyRule_CanExecute() && IsAnySelectedEntryDisabled && !IsAnySelectedRuleManagedByPolicy);
 
     /// <summary>
     /// Gets the command to disable the selected firewall rule(s).
-    /// Only executable when at least one selected rule is enabled and modification is allowed.
+    /// Only executable when at least one selected rule is enabled, no selected rule is managed by a policy
+    /// and modification is allowed.
     /// </summary>
-    public ICommand DisableRuleCommand => new RelayCommand(parameter => { _ = SetRulesEnabled(false); }, _ => ModifyRule_CanExecute() && IsAnySelectedEntryEnabled);
+    public ICommand DisableRuleCommand => new RelayCommand(parameter => { _ = SetRulesEnabled(false); },
+        _ => ModifyRule_CanExecute() && IsAnySelectedEntryEnabled && !IsAnySelectedRuleManagedByPolicy);
 
     /// <summary>
     /// Enables or disables the selected rule(s) via PowerShell,
     /// then reloads the rule list to reflect the updated state.
+    /// If at least one rule is not managed by NETworkManager, the user must confirm the change first.
     /// Any PowerShell error is written to the log and shown in the status bar.
     /// </summary>
     /// <param name="enabled">
@@ -300,19 +341,44 @@ private async Task SetRulesEnabled(bool enabled)
         if (rules.Count == 0)
             return;
 
+        var notManagedWarning = GetNotManagedRulesWarning(rules);
+
+        if (notManagedWarning != null)
+        {
+            var title = rules.Count == 1
+                ? enabled ? Strings.EnableRule : Strings.DisableRule
+                : string.Format(enabled ? Strings.EnableRulesX : Strings.DisableRulesX, rules.Count);
+
+            var result = await DialogHelper.ShowConfirmationMessageAsync(
+                Application.Current.MainWindow,
+                title,
+                notManagedWarning,
+                ChildWindowIcon.Warn,
+                enabled ? Strings.Enable : Strings.Disable);
+
+            if (!result)
+                return;
+        }
+
         await ModifyRulesAsync(() => Firewall.SetRulesEnabledAsync(rules, enabled),
             $"Error while {(enabled ? "enabling" : "disabling")} firewall rule(s)");
     }
 
     /// <summary>
     /// Gets the command to open the dialog for editing the selected firewall rule.
-    /// Only executable when exactly one rule is selected and modification is allowed.
+    /// Only executable when exactly one rule managed by NETworkManager is selected and modification is allowed.
+    /// Rules not managed by NETworkManager can't be edited (not supported yet), because they may use properties
+    /// that can't be shown in the dialog (e.g. group, service or ICMP types). Rules with unsupported values
+    /// (e.g. port keywords like RPC, see <see cref="FirewallRule.HasUnsupportedValues"/>) can't be edited either,
+    /// because the dialog can't show or keep these values.
     /// </summary>
-    public ICommand EditRuleCommand => new RelayCommand(parameter => { _ = EditRule(); }, _ => ModifyRule_CanExecute() && IsSingleRuleSelected);
+    public ICommand EditRuleCommand => new RelayCommand(parameter => { _ = EditRule(); },
+        _ => ModifyRule_CanExecute() && IsSingleRuleSelected && SelectedResult.IsManaged && !SelectedResult.HasUnsupportedValues);
 
     /// <summary>
     /// Opens the edit-firewall-rule dialog pre-filled with the selected rule's properties.
-    /// On confirmation, deletes the old rule, creates the updated rule via PowerShell,
+    /// On confirmation, updates the changed properties of the rule via PowerShell (other properties and the
+    /// internal ID are kept, see <see cref="Firewall.UpdateRuleAsync"/>),
     /// and refreshes the rule list.
     /// </summary>
     private async Task EditRule()
@@ -324,11 +390,8 @@ private async Task EditRule()
             childWindow.IsOpen = false;
             ConfigurationManager.Current.IsChildWindowOpen = false;
 
-            await ModifyRulesAsync(async () =>
-            {
-                await Firewall.DeleteRuleAsync(instance.Entry);
-                await Firewall.AddRuleAsync(BuildRule(instance));
-            }, "Error while editing firewall rule");
+            await ModifyRulesAsync(() => Firewall.UpdateRuleAsync(instance.Entry, BuildRule(instance)),
+                "Error while editing firewall rule");
         }, _ =>
         {
             childWindow.IsOpen = false;
@@ -346,16 +409,37 @@ await ModifyRulesAsync(async () =>
     /// <summary>
     /// Gets the command to copy the selected firewall rule.
     /// Only executable when exactly one rule is selected and modification is allowed.
+    /// Rules with unsupported values (e.g. port keywords like RPC, see <see cref="FirewallRule.HasUnsupportedValues"/>)
+    /// can't be copied, because the values would be lost and the copy would apply to more traffic (e.g. all ports).
     /// </summary>
-    public ICommand CopyAsRuleCommand => new RelayCommand(parameter => { _ = CopyAsRule(); }, _ => ModifyRule_CanExecute() && IsSingleRuleSelected);
+    public ICommand CopyAsRuleCommand => new RelayCommand(parameter => { _ = CopyAsRule(); },
+        _ => ModifyRule_CanExecute() && IsSingleRuleSelected && !SelectedResult.HasUnsupportedValues);
 
     /// <summary>
     /// Opens the rule dialog pre-filled with the selected rule's properties (name suffixed with " - Copy").
     /// On confirmation, creates a new rule via PowerShell (the selected rule is not changed)
     /// and refreshes the rule list.
+    /// If the rule has properties that are not supported by NETworkManager and restrict the traffic
+    /// (see <see cref="FirewallRule.HiddenProperties"/>), the user must first acknowledge that they are not copied.
     /// </summary>
     private async Task CopyAsRule()
     {
+        var rule = SelectedResult;
+
+        if (rule.HasHiddenProperties)
+        {
+            var result = await DialogHelper.ShowConfirmationMessageAsync(
+                Application.Current.MainWindow,
+                Strings.CopyRule,
+                string.Format(Strings.CopyFirewallRuleHiddenPropertiesMessage, rule.Name,
+                    GetHiddenPropertiesString(rule.HiddenProperties)),
+                ChildWindowIcon.Warn,
+                Strings.Continue);
+
+            if (!result)
+                return;
+        }
+
         var childWindow = new FirewallRuleChildWindow();
 
         var childWindowViewModel = new FirewallRuleViewModel(async instance =>
@@ -368,7 +452,7 @@ private async Task CopyAsRule()
         {
             childWindow.IsOpen = false;
             ConfigurationManager.Current.IsChildWindowOpen = false;
-        }, SelectedResult, EditMode.Copy);
+        }, rule, EditMode.Copy);
 
         childWindow.Title = Strings.CopyRule;
         childWindow.DataContext = childWindowViewModel;
@@ -380,13 +464,15 @@ private async Task CopyAsRule()
 
     /// <summary>
     /// Gets the command to permanently delete the selected firewall rule(s).
-    /// Only executable when a rule is selected and modification is allowed.
+    /// Only executable when a rule is selected, no selected rule is managed by a policy and modification is allowed.
     /// </summary>
-    public ICommand DeleteRuleCommand => new RelayCommand(parameter => { _ = DeleteRules(); }, _ => ModifyRule_CanExecute() && SelectedResult != null);
+    public ICommand DeleteRuleCommand => new RelayCommand(parameter => { _ = DeleteRules(); },
+        _ => ModifyRule_CanExecute() && SelectedResult != null && !IsAnySelectedRuleManagedByPolicy);
 
     /// <summary>
     /// Asks for confirmation and permanently deletes the selected rule(s) via PowerShell,
-    /// then reloads the rule list. Any PowerShell error is written to the log and shown in the status bar.
+    /// then reloads the rule list. If at least one rule is not managed by NETworkManager, a warning
+    /// is added to the confirmation. Any PowerShell error is written to the log and shown in the status bar.
     /// </summary>
     private async Task DeleteRules()
     {
@@ -396,14 +482,19 @@ private async Task DeleteRules()
             return;
 
         var message = rules.Count == 1
-            ? string.Format(Strings.DeleteFirewallRuleMessage, rules[0].Name)
+            ? string.Format(Strings.DeleteFirewallRuleMessage, DialogHelper.FormatItemList([rules[0].Name]))
             : string.Format(Strings.DeleteFirewallRulesMessage, DialogHelper.FormatItemList(rules.Select(rule => rule.Name)));
 
+        var notManagedWarning = GetNotManagedRulesWarning(rules);
+
+        if (notManagedWarning != null)
+            message += Environment.NewLine + Environment.NewLine + notManagedWarning;
+
         var result = await DialogHelper.ShowConfirmationMessageAsync(
             Application.Current.MainWindow,
             rules.Count == 1 ? Strings.DeleteRule : string.Format(Strings.DeleteRulesX, rules.Count),
             message,
-            ChildWindowIcon.Info,
+            notManagedWarning != null ? ChildWindowIcon.Warn : ChildWindowIcon.Info,
             Strings.Delete);
 
         if (!result)
@@ -451,6 +542,43 @@ private IEnumerable<FirewallRule> GetSelectedRules()
     /// </summary>
     private List<FirewallRule> GetTargetEntries() => [.. GetSelectedRules()];
 
+    /// <summary>
+    /// Converts the hidden properties of a rule to a localized, bulleted list (e.g. "- ICMP types", "- Service").
+    /// </summary>
+    /// <param name="properties">The hidden properties.</param>
+    private static string GetHiddenPropertiesString(FirewallRuleHiddenProperties properties)
+    {
+        var names = new List<string>();
+
+        if (properties.HasFlag(FirewallRuleHiddenProperties.IcmpTypes))
+            names.Add(Strings.IcmpTypes);
+
+        if (properties.HasFlag(FirewallRuleHiddenProperties.Service))
+            names.Add(Strings.Service);
+
+        if (properties.HasFlag(FirewallRuleHiddenProperties.Package))
+            names.Add(Strings.AppPackage);
+
+        return DialogHelper.FormatItemList(names);
+    }
+
+    /// <summary>
+    /// Builds a warning which lists the given rules that are not managed by NETworkManager
+    /// (e.g. Windows built-in rules), because changing them may affect Windows or other applications.
+    /// </summary>
+    /// <param name="rules">The rules to check.</param>
+    /// <returns>The warning, or <see langword="null"/> if all rules are managed by NETworkManager.</returns>
+    private static string GetNotManagedRulesWarning(List<FirewallRule> rules)
+    {
+        var notManagedRules = rules.Where(rule => !rule.IsManaged).ToList();
+
+        if (notManagedRules.Count == 0)
+            return null;
+
+        return string.Format(Strings.FirewallRulesNotManagedWarningMessage,
+            DialogHelper.FormatItemList(notManagedRules.Select(rule => rule.Name)));
+    }
+
     /// <summary>
     /// Runs the given modification and reloads the rule list afterwards, also if the modification
     /// failed (e.g. a rule was removed in the meantime), so the list always shows the actual state.
@@ -482,13 +610,21 @@ private async Task ModifyRulesAsync(Func<Task> action, string errorLogMessage)
             // If the refresh failed too, keep its message, so it's visible that the list is not up to date.
             if (error != null)
             {
-                StatusMessage = refreshed ? error.Message : error.Message + Environment.NewLine + StatusMessage;
+                var errorMessage = error is FirewallRuleNotFoundException
+                    ? Strings.FirewallRulesNoLongerExistMessage
+                    : error.Message;
+
+                StatusMessage = refreshed ? errorMessage : errorMessage + Environment.NewLine + StatusMessage;
                 IsStatusMessageDisplayed = true;
             }
         }
         finally
         {
             IsModifying = false;
+
+            // The settings were changed while the rules were modified (see OnViewVisible)
+            if (_refreshPending && _isViewVisible)
+                _ = Refresh();
         }
     }
 
@@ -597,7 +733,8 @@ await DialogHelper.ShowMessageAsync(Application.Current.MainWindow, Strings.Erro
     #region Methods
 
     /// <summary>
-    /// Loads all NETworkManager firewall rules from the system via PowerShell and
+    /// Loads the NETworkManager firewall rules (or all rules, if <see cref="ShowAllRules"/> is enabled)
+    /// from the system via PowerShell and
     /// replaces the contents of <see cref="Results"/> with the new list.
     /// Updates <see cref="StatusMessage"/> throughout to reflect loading progress.
     /// </summary>
@@ -612,6 +749,10 @@ private async Task<bool> Refresh(bool init = false)
             return false;
 
         IsRefreshing = true;
+
+        // Show the loading indicator instead of the (empty) list on the initial load, see IsLoading
+        IsLoading = init;
+
         StatusMessage = Strings.RefreshingDots;
         IsStatusMessageDisplayed = true;
 
@@ -620,14 +761,19 @@ private async Task<bool> Refresh(bool init = false)
 
         try
         {
+            // Reset right before the setting is read, so only a change during the query triggers another refresh (see finally)
+            _refreshPending = false;
+
             var rules = await Firewall.GetRulesAsync(onlyManagedRules: !ShowAllRules);
 
             Application.Current.Dispatcher.Invoke(() =>
             {
-                Results.Clear();
+                // Replace all rules with a single notification, so the view is filtered / sorted only once
+                // (can be 1000+ rules if all rules are shown). ResultsView.DeferRefresh() can't be used, because
+                // the DataGrid accesses the view (selection / current item) while the items are changed.
+                Results.ReplaceAll(rules);
 
-                foreach (var rule in rules)
-                    Results.Add(rule);
+                _hasRulesManagedByPolicy = rules.Any(rule => rule.IsManagedByPolicy);
             });
 
             StatusMessage = string.Format(Strings.ReloadedAtX, DateTime.Now.ToShortTimeString());
@@ -647,6 +793,11 @@ private async Task<bool> Refresh(bool init = false)
         finally
         {
             IsRefreshing = false;
+            IsLoading = false;
+
+            // The settings were changed during the refresh, reload with the new settings
+            if (_refreshPending && _isViewVisible)
+                _ = Refresh();
         }
     }
 
@@ -723,13 +874,37 @@ public void OnContextMenuOpened()
     {
         OnPropertyChanged(nameof(IsAnySelectedEntryEnabled));
         OnPropertyChanged(nameof(IsAnySelectedEntryDisabled));
+        OnPropertyChanged(nameof(IsAnySelectedRuleManagedByPolicy));
     }
 
     /// <summary>
-    /// Called when the view becomes visible.
+    /// Called when a setting is changed. Marks the rules to be reloaded if a setting changed that
+    /// affects the rule list. The rules are reloaded when the view becomes visible again
+    /// (the settings are opened in place of the view, see <see cref="OnViewVisible"/>).
+    /// </summary>
+    private void SettingsManager_PropertyChanged(object sender, PropertyChangedEventArgs e)
+    {
+        switch (e.PropertyName)
+        {
+            case nameof(SettingsInfo.Firewall_ShowAllRules):
+                OnPropertyChanged(nameof(ShowAllRules));
+
+                _refreshPending = true;
+                break;
+        }
+    }
+
+    /// <summary>
+    /// Called when the view becomes visible. Reloads the rules if a relevant setting was changed in the meantime.
     /// </summary>
     public void OnViewVisible()
     {
+        _isViewVisible = true;
+
+        // If rules are being modified, the refresh is done afterwards (see ModifyRulesAsync),
+        // so the error message of the modification is not mixed up with the status of this refresh
+        if (_refreshPending && !IsModifying)
+            _ = Refresh();
     }
 
     /// <summary>
@@ -737,6 +912,7 @@ public void OnViewVisible()
     /// </summary>
     public void OnViewHide()
     {
+        _isViewVisible = false;
     }
 
     #endregion
diff --git a/Source/NETworkManager/ViewModels/HostsFileEditorViewModel.cs b/Source/NETworkManager/ViewModels/HostsFileEditorViewModel.cs
index b4fb4c9a89..7b5c389961 100644
--- a/Source/NETworkManager/ViewModels/HostsFileEditorViewModel.cs
+++ b/Source/NETworkManager/ViewModels/HostsFileEditorViewModel.cs
@@ -570,7 +570,8 @@ private async Task DeleteEntryAction()
 
         if (entries.Count == 1)
         {
-            message = string.Format(Strings.DeleteHostsFileEntryMessage, entries[0].IPAddress, entries[0].Hostname,
+            // Prefixed with "- " like the bulleted list for multiple entries (see DialogHelper.FormatItemList)
+            message = string.Format(Strings.DeleteHostsFileEntryMessage, $"- {entries[0].IPAddress}", entries[0].Hostname,
                 string.IsNullOrEmpty(entries[0].Comment) ? "" : $"# {entries[0].Comment}");
         }
         else
diff --git a/Source/NETworkManager/ViewModels/SettingsViewModel.cs b/Source/NETworkManager/ViewModels/SettingsViewModel.cs
index 73f5a30a2a..900f4db799 100644
--- a/Source/NETworkManager/ViewModels/SettingsViewModel.cs
+++ b/Source/NETworkManager/ViewModels/SettingsViewModel.cs
@@ -133,6 +133,7 @@ public SettingsViewInfo SelectedSettingsView
     private WebConsoleSettingsView _webConsoleSettingsView;
     private SNMPSettingsView _snmpSettingsView;
     private SNTPLookupSettingsView _sntpLookupSettingsView;
+    private FirewallSettingsView _firewallSettingsView;
     private WakeOnLANSettingsView _wakeOnLANSettingsView;
     private RDAPSettingsView _rdapSettingsView;
     private BitCalculatorSettingsView _bitCalculatorSettingsView;
@@ -332,6 +333,11 @@ private void ChangeSettingsContent(SettingsViewInfo settingsViewInfo)
 
                 SettingsContent = _sntpLookupSettingsView;
                 break;
+            case SettingsName.Firewall:
+                _firewallSettingsView ??= new FirewallSettingsView();
+
+                SettingsContent = _firewallSettingsView;
+                break;
             case SettingsName.WakeOnLAN:
                 _wakeOnLANSettingsView ??= new WakeOnLANSettingsView();
 
diff --git a/Source/NETworkManager/Views/FirewallRuleChildWindow.xaml b/Source/NETworkManager/Views/FirewallRuleChildWindow.xaml
index 3b97546304..e01a0e94b4 100644
--- a/Source/NETworkManager/Views/FirewallRuleChildWindow.xaml
+++ b/Source/NETworkManager/Views/FirewallRuleChildWindow.xaml
@@ -27,7 +27,7 @@
             <RowDefinition Height="20" />
             <RowDefinition Height="Auto" />
         </Grid.RowDefinitions>
-        <ScrollViewer Grid.Row="0" VerticalScrollBarVisibility="Auto">
+        <ScrollViewer Grid.Row="0" VerticalScrollBarVisibility="Auto" HorizontalScrollBarVisibility="Disabled">
             <Grid>
                 <Grid.Resources>
                     <Style TargetType="{x:Type TextBlock}" BasedOn="{StaticResource CenterTextBlock}" />
@@ -207,7 +207,7 @@
                     <TextBox.Text>
                         <Binding Path="Program" Mode="TwoWay" UpdateSourceTrigger="PropertyChanged">
                             <Binding.ValidationRules>
-                                <validators:EmptyOrFileExistsValidator ValidatesOnTargetUpdated="True" />
+                                <validators:EmptyOrFileExistsValidator ValidatesOnTargetUpdated="True" ExpandEnvironmentVariables="True" />
                             </Binding.ValidationRules>
                         </Binding>
                     </TextBox.Text>
diff --git a/Source/NETworkManager/Views/FirewallSettingsView.xaml b/Source/NETworkManager/Views/FirewallSettingsView.xaml
new file mode 100644
index 0000000000..fe4d0a836c
--- /dev/null
+++ b/Source/NETworkManager/Views/FirewallSettingsView.xaml
@@ -0,0 +1,24 @@
+<UserControl x:Class="NETworkManager.Views.FirewallSettingsView"
+             xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"
+             xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml"
+             xmlns:d="http://schemas.microsoft.com/expression/blend/2008"
+             xmlns:mc="http://schemas.openxmlformats.org/markup-compatibility/2006"
+             xmlns:mah="http://metro.mahapps.com/winfx/xaml/controls"
+             xmlns:viewModels="clr-namespace:NETworkManager.ViewModels"
+             xmlns:localization="clr-namespace:NETworkManager.Localization.Resources;assembly=NETworkManager.Localization"
+             mc:Ignorable="d" d:DataContext="{d:DesignInstance viewModels:FirewallSettingsViewModel}">
+    <StackPanel>
+        <TextBlock Text="{x:Static localization:Strings.Firewall}" Style="{StaticResource HeaderTextBlock}" />
+        <StackPanel Orientation="Horizontal">
+            <mah:ToggleSwitch IsOn="{Binding ShowAllRules}"
+                              Header="{x:Static localization:Strings.ShowAllRules}" />
+            <Rectangle Width="24" Height="24" VerticalAlignment="Top"
+                       ToolTip="{x:Static localization:Strings.HelpMessage_FirewallShowAllRules}"
+                       Style="{StaticResource HelpImageRectangle}" Margin="10,0,0,0">
+                <Rectangle.Resources>
+                    <Style TargetType="{x:Type ToolTip}" BasedOn="{StaticResource HelpToolTip}" />
+                </Rectangle.Resources>
+            </Rectangle>
+        </StackPanel>
+    </StackPanel>
+</UserControl>
\ No newline at end of file
diff --git a/Source/NETworkManager/Views/FirewallSettingsView.xaml.cs b/Source/NETworkManager/Views/FirewallSettingsView.xaml.cs
new file mode 100644
index 0000000000..36abf2ac86
--- /dev/null
+++ b/Source/NETworkManager/Views/FirewallSettingsView.xaml.cs
@@ -0,0 +1,23 @@
+using NETworkManager.ViewModels;
+
+namespace NETworkManager.Views;
+
+/// <summary>
+/// View for the Firewall settings.
+/// </summary>
+public partial class FirewallSettingsView
+{
+    /// <summary>
+    /// ViewModel of the view.
+    /// </summary>
+    private readonly FirewallSettingsViewModel _viewModel = new();
+
+    /// <summary>
+    /// Initializes a new instance of the <see cref="FirewallSettingsView"/> class.
+    /// </summary>
+    public FirewallSettingsView()
+    {
+        InitializeComponent();
+        DataContext = _viewModel;
+    }
+}
\ No newline at end of file
diff --git a/Source/NETworkManager/Views/FirewallView.xaml b/Source/NETworkManager/Views/FirewallView.xaml
index 23ad50ebd3..4218037b4f 100644
--- a/Source/NETworkManager/Views/FirewallView.xaml
+++ b/Source/NETworkManager/Views/FirewallView.xaml
@@ -55,10 +55,6 @@
                                     Orientation="Horizontal"
                                     VerticalAlignment="Center"
                                     HorizontalAlignment="Right">
-                            <CheckBox Content="{x:Static localization:Strings.ShowAllRules}"
-                                      IsChecked="{Binding ShowAllRules}"
-                                      VerticalAlignment="Center"
-                                      Margin="0,0,10,0" />
                             <Button Command="{Binding Path=RefreshCommand}"
                                     Style="{StaticResource CleanButton}"
                                     ToolTip="{x:Static localization:Strings.Refresh}"
@@ -90,6 +86,7 @@
                     <controls:MultiSelectDataGrid
                         x:Name="DataGridFirewallRules"
                         Grid.Row="2"
+                        Visibility="{Binding IsLoading, Converter={StaticResource BooleanReverseToVisibilityCollapsedConverter}}"
                         ItemsSource="{Binding ResultsView}"
                         SelectedItem="{Binding SelectedResult}"
                         SelectedItemsList="{Binding SelectedResults, Mode=TwoWay, UpdateSourceTrigger=PropertyChanged}"
@@ -100,9 +97,22 @@
                             <KeyBinding Command="{Binding DeleteRuleCommand}" Key="Delete" />
                         </controls:MultiSelectDataGrid.InputBindings>
                         <controls:MultiSelectDataGrid.Resources>
+                            <!-- Enable, disable and delete are blocked if a selected rule is managed by a policy (see FirewallViewModel.IsAnySelectedRuleManagedByPolicy) -->
+                            <Style x:Key="ManagedByPolicyMenuItem" TargetType="{x:Type MenuItem}" BasedOn="{StaticResource MahApps.Styles.MenuItem}">
+                                <Style.Resources>
+                                    <Style TargetType="{x:Type ToolTip}" BasedOn="{StaticResource WrapToolTip}" />
+                                </Style.Resources>
+                                <Style.Triggers>
+                                    <DataTrigger Binding="{Binding Path=IsAnySelectedRuleManagedByPolicy}" Value="True">
+                                        <Setter Property="ToolTip" Value="{x:Static localization:Strings.FirewallRulesManagedByPolicyMessage}" />
+                                        <Setter Property="ToolTipService.ShowOnDisabled" Value="True" />
+                                    </DataTrigger>
+                                </Style.Triggers>
+                            </Style>
                             <ContextMenu x:Key="RowContextMenu" Opened="ContextMenu_Opened" MinWidth="150">
                                 <MenuItem Header="{x:Static localization:Strings.EnableRule}"
                                           Command="{Binding Path=EnableRuleCommand}"
+                                          Style="{StaticResource ManagedByPolicyMenuItem}"
                                           wpfHelpers:PermissionToolTipHelper.Text="{x:Static localization:Strings.FirewallAdminMessage}"
                                           wpfHelpers:PermissionToolTipHelper.HasPermission="{Binding Source={x:Static settings:ConfigurationManager.Current}, Path=IsAdmin}"
                                           Visibility="{Binding Path=SelectedResult.IsEnabled, Converter={StaticResource BooleanReverseToVisibilityCollapsedConverter}}">
@@ -116,6 +126,7 @@
                                 </MenuItem>
                                 <MenuItem Header="{x:Static localization:Strings.DisableRule}"
                                           Command="{Binding Path=DisableRuleCommand}"
+                                          Style="{StaticResource ManagedByPolicyMenuItem}"
                                           wpfHelpers:PermissionToolTipHelper.Text="{x:Static localization:Strings.FirewallAdminMessage}"
                                           wpfHelpers:PermissionToolTipHelper.HasPermission="{Binding Source={x:Static settings:ConfigurationManager.Current}, Path=IsAdmin}"
                                           Visibility="{Binding Path=SelectedResult.IsEnabled, Converter={StaticResource BooleanToVisibilityCollapsedConverter}}">
@@ -131,6 +142,28 @@
                                           Command="{Binding Path=EditRuleCommand}"
                                           wpfHelpers:PermissionToolTipHelper.Text="{x:Static localization:Strings.FirewallAdminMessage}"
                                           wpfHelpers:PermissionToolTipHelper.HasPermission="{Binding Source={x:Static settings:ConfigurationManager.Current}, Path=IsAdmin}">
+                                    <MenuItem.Resources>
+                                        <Style TargetType="{x:Type ToolTip}" BasedOn="{StaticResource WrapToolTip}" />
+                                    </MenuItem.Resources>
+                                    <MenuItem.Style>
+                                        <Style TargetType="{x:Type MenuItem}" BasedOn="{StaticResource MahApps.Styles.MenuItem}">
+                                            <Style.Triggers>
+                                                <!-- Rules with unsupported values or not managed by NETworkManager can't be edited (see FirewallViewModel.EditRuleCommand) -->
+                                                <DataTrigger Binding="{Binding Path=SelectedResult.HasUnsupportedValues}" Value="True">
+                                                    <Setter Property="ToolTip" Value="{x:Static localization:Strings.FirewallRuleUnsupportedValuesMessage}" />
+                                                    <Setter Property="ToolTipService.ShowOnDisabled" Value="True" />
+                                                </DataTrigger>
+                                                <DataTrigger Binding="{Binding Path=SelectedResult.IsManaged}" Value="False">
+                                                    <Setter Property="ToolTip" Value="{x:Static localization:Strings.EditFirewallRuleNotManagedMessage}" />
+                                                    <Setter Property="ToolTipService.ShowOnDisabled" Value="True" />
+                                                </DataTrigger>
+                                                <DataTrigger Binding="{Binding Path=SelectedResult.IsManagedByPolicy}" Value="True">
+                                                    <Setter Property="ToolTip" Value="{x:Static localization:Strings.FirewallRulesManagedByPolicyMessage}" />
+                                                    <Setter Property="ToolTipService.ShowOnDisabled" Value="True" />
+                                                </DataTrigger>
+                                            </Style.Triggers>
+                                        </Style>
+                                    </MenuItem.Style>
                                     <MenuItem.Icon>
                                         <Rectangle Width="16" Height="16" Fill="{DynamicResource MahApps.Brushes.Gray3}">
                                             <Rectangle.OpacityMask>
@@ -143,6 +176,20 @@
                                           Command="{Binding Path=CopyAsRuleCommand}"
                                           wpfHelpers:PermissionToolTipHelper.Text="{x:Static localization:Strings.FirewallAdminMessage}"
                                           wpfHelpers:PermissionToolTipHelper.HasPermission="{Binding Source={x:Static settings:ConfigurationManager.Current}, Path=IsAdmin}">
+                                    <MenuItem.Resources>
+                                        <Style TargetType="{x:Type ToolTip}" BasedOn="{StaticResource WrapToolTip}" />
+                                    </MenuItem.Resources>
+                                    <MenuItem.Style>
+                                        <Style TargetType="{x:Type MenuItem}" BasedOn="{StaticResource MahApps.Styles.MenuItem}">
+                                            <Style.Triggers>
+                                                <!-- Rules with unsupported values can't be copied (see FirewallViewModel.CopyAsRuleCommand) -->
+                                                <DataTrigger Binding="{Binding Path=SelectedResult.HasUnsupportedValues}" Value="True">
+                                                    <Setter Property="ToolTip" Value="{x:Static localization:Strings.FirewallRuleUnsupportedValuesMessage}" />
+                                                    <Setter Property="ToolTipService.ShowOnDisabled" Value="True" />
+                                                </DataTrigger>
+                                            </Style.Triggers>
+                                        </Style>
+                                    </MenuItem.Style>
                                     <MenuItem.Icon>
                                         <Rectangle Width="16" Height="16" Fill="{DynamicResource MahApps.Brushes.Gray3}">
                                             <Rectangle.OpacityMask>
@@ -153,6 +200,7 @@
                                 </MenuItem>
                                 <MenuItem Header="{x:Static localization:Strings.DeleteRule}"
                                           Command="{Binding Path=DeleteRuleCommand}"
+                                          Style="{StaticResource ManagedByPolicyMenuItem}"
                                           wpfHelpers:PermissionToolTipHelper.Text="{x:Static localization:Strings.FirewallAdminMessage}"
                                           wpfHelpers:PermissionToolTipHelper.HasPermission="{Binding Source={x:Static settings:ConfigurationManager.Current}, Path=IsAdmin}">
                                     <MenuItem.Icon>
@@ -207,9 +255,19 @@
                                               CommandParameter="{Binding Path=SelectedResult.ProgramDisplay}"
                                               Style="{StaticResource CopyMenuItem}" />
                                     <MenuItem Header="{x:Static localization:Strings.InterfaceType}"
-                                              Command="{Binding Path=CopyDataToClipboardCommand}"
-                                              CommandParameter="{Binding Path=SelectedResult.InterfaceType, Converter={StaticResource FirewallInterfaceTypeToStringConverter}}"
-                                              Style="{StaticResource CopyMenuItem}" />
+                                              Command="{Binding Path=CopyDataToClipboardCommand}">
+                                        <MenuItem.Style>
+                                            <Style TargetType="{x:Type MenuItem}" BasedOn="{StaticResource CopyMenuItem}">
+                                                <!-- Unsupported combination of interface types (e.g. "Wired, Wireless") is copied as is -->
+                                                <Setter Property="CommandParameter" Value="{Binding Path=SelectedResult.InterfaceTypeRaw}" />
+                                                <Style.Triggers>
+                                                    <DataTrigger Binding="{Binding Path=SelectedResult.InterfaceTypeRaw}" Value="{x:Null}">
+                                                        <Setter Property="CommandParameter" Value="{Binding Path=SelectedResult.InterfaceType, Converter={StaticResource FirewallInterfaceTypeToStringConverter}}" />
+                                                    </DataTrigger>
+                                                </Style.Triggers>
+                                            </Style>
+                                        </MenuItem.Style>
+                                    </MenuItem>
                                     <MenuItem Header="{x:Static localization:Strings.NetworkProfiles}"
                                               Command="{Binding Path=CopyDataToClipboardCommand}"
                                               CommandParameter="{Binding Path=SelectedResult.NetworkProfiles, Converter={StaticResource FirewallNetworkProfilesToStringConverter}}"
@@ -233,6 +291,7 @@
                             <ContextMenu x:Key="MultiRowContextMenu" Opened="ContextMenu_Opened" MinWidth="150">
                                 <MenuItem Header="{x:Static localization:Strings.Enable}"
                                           Command="{Binding Path=EnableRuleCommand}"
+                                          Style="{StaticResource ManagedByPolicyMenuItem}"
                                           wpfHelpers:PermissionToolTipHelper.Text="{x:Static localization:Strings.FirewallAdminMessage}"
                                           wpfHelpers:PermissionToolTipHelper.HasPermission="{Binding Source={x:Static settings:ConfigurationManager.Current}, Path=IsAdmin}"
                                           Visibility="{Binding Path=IsAnySelectedEntryDisabled, Converter={StaticResource BooleanToVisibilityCollapsedConverter}}">
@@ -246,6 +305,7 @@
                                 </MenuItem>
                                 <MenuItem Header="{x:Static localization:Strings.Disable}"
                                           Command="{Binding Path=DisableRuleCommand}"
+                                          Style="{StaticResource ManagedByPolicyMenuItem}"
                                           wpfHelpers:PermissionToolTipHelper.Text="{x:Static localization:Strings.FirewallAdminMessage}"
                                           wpfHelpers:PermissionToolTipHelper.HasPermission="{Binding Source={x:Static settings:ConfigurationManager.Current}, Path=IsAdmin}"
                                           Visibility="{Binding Path=IsAnySelectedEntryEnabled, Converter={StaticResource BooleanToVisibilityCollapsedConverter}}">
@@ -259,6 +319,7 @@
                                 </MenuItem>
                                 <MenuItem Header="{x:Static localization:Strings.DeleteRules}"
                                           Command="{Binding Path=DeleteRuleCommand}"
+                                          Style="{StaticResource ManagedByPolicyMenuItem}"
                                           wpfHelpers:PermissionToolTipHelper.Text="{x:Static localization:Strings.FirewallAdminMessage}"
                                           wpfHelpers:PermissionToolTipHelper.HasPermission="{Binding Source={x:Static settings:ConfigurationManager.Current}, Path=IsAdmin}">
                                     <MenuItem.Icon>
@@ -284,6 +345,7 @@
                         </controls:MultiSelectDataGrid.Resources>
                         <controls:MultiSelectDataGrid.RowStyle>
                             <Style TargetType="{x:Type DataGridRow}" BasedOn="{StaticResource MahApps.Styles.DataGridRow}">
+                                <EventSetter Event="MouseDoubleClick" Handler="DataGridRow_MouseDoubleClick" />
                                 <Setter Property="ContextMenu" Value="{StaticResource MultiRowContextMenu}" />
                                 <Style.Triggers>
                                     <DataTrigger Binding="{Binding SelectedItems.Count, RelativeSource={RelativeSource FindAncestor, AncestorType={x:Type DataGrid}}}" Value="1">
@@ -322,6 +384,67 @@
                                 </DataGridTemplateColumn.CellTemplate>
                             </DataGridTemplateColumn>
 
+                            <!-- Managed by NETworkManager / not managed / managed by policy (only visible if all rules are shown) -->
+                            <DataGridTemplateColumn Header="" SortMemberPath="IsManaged"
+                                                    Width="24" CanUserResize="False"
+                                                    Visibility="{Binding Data.ShowAllRules, Source={StaticResource BindingProxy}, Converter={StaticResource BooleanToVisibilityCollapsedConverter}}">
+                                <DataGridTemplateColumn.HeaderStyle>
+                                    <Style TargetType="{x:Type DataGridColumnHeader}" BasedOn="{StaticResource DefaultDataGridColumnHeader}">
+                                        <Setter Property="ToolTip" Value="{x:Static localization:Strings.FirewallRuleManagedMessage}" />
+                                    </Style>
+                                </DataGridTemplateColumn.HeaderStyle>
+                                <DataGridTemplateColumn.CellTemplate>
+                                    <DataTemplate DataType="{x:Type firewall:FirewallRule}">
+                                        <Border x:Name="ManagedBorder" Background="Transparent"
+                                                ToolTip="{x:Static localization:Strings.FirewallRuleNotManagedMessage}">
+                                            <Border.Resources>
+                                                <Style TargetType="{x:Type ToolTip}" BasedOn="{StaticResource WrapToolTip}" />
+                                            </Border.Resources>
+                                            <Rectangle x:Name="ManagedIcon" Width="16" Height="16"
+                                                       Fill="{DynamicResource MahApps.Brushes.Gray3}">
+                                                <Rectangle.OpacityMask>
+                                                    <VisualBrush Stretch="Uniform" Visual="{iconPacks:Material Kind=ShieldOffOutline}" />
+                                                </Rectangle.OpacityMask>
+                                            </Rectangle>
+                                        </Border>
+                                        <DataTemplate.Triggers>
+                                            <DataTrigger Binding="{Binding (firewall:FirewallRule.IsManaged)}" Value="True">
+                                                <Setter TargetName="ManagedBorder" Property="ToolTip" Value="{x:Static localization:Strings.FirewallRuleManagedMessage}" />
+                                                <Setter TargetName="ManagedIcon" Property="OpacityMask">
+                                                    <Setter.Value>
+                                                        <VisualBrush Stretch="Uniform" Visual="{iconPacks:Material Kind=ShieldOutline}" />
+                                                    </Setter.Value>
+                                                </Setter>
+                                            </DataTrigger>
+                                            <DataTrigger Binding="{Binding (firewall:FirewallRule.Source)}" Value="{x:Static firewall:FirewallRuleSource.GroupPolicy}">
+                                                <Setter TargetName="ManagedBorder" Property="ToolTip" Value="{x:Static localization:Strings.FirewallRuleManagedByGroupPolicyMessage}" />
+                                                <Setter TargetName="ManagedIcon" Property="OpacityMask">
+                                                    <Setter.Value>
+                                                        <VisualBrush Stretch="Uniform" Visual="{iconPacks:Material Kind=ShieldLockOutline}" />
+                                                    </Setter.Value>
+                                                </Setter>
+                                            </DataTrigger>
+                                            <DataTrigger Binding="{Binding (firewall:FirewallRule.Source)}" Value="{x:Static firewall:FirewallRuleSource.MDM}">
+                                                <Setter TargetName="ManagedBorder" Property="ToolTip" Value="{x:Static localization:Strings.FirewallRuleManagedByMDMMessage}" />
+                                                <Setter TargetName="ManagedIcon" Property="OpacityMask">
+                                                    <Setter.Value>
+                                                        <VisualBrush Stretch="Uniform" Visual="{iconPacks:Material Kind=ShieldLockOutline}" />
+                                                    </Setter.Value>
+                                                </Setter>
+                                            </DataTrigger>
+                                            <DataTrigger Binding="{Binding (firewall:FirewallRule.Source)}" Value="{x:Static firewall:FirewallRuleSource.Other}">
+                                                <Setter TargetName="ManagedBorder" Property="ToolTip" Value="{x:Static localization:Strings.FirewallRuleManagedByOtherMessage}" />
+                                                <Setter TargetName="ManagedIcon" Property="OpacityMask">
+                                                    <Setter.Value>
+                                                        <VisualBrush Stretch="Uniform" Visual="{iconPacks:Material Kind=ShieldLockOutline}" />
+                                                    </Setter.Value>
+                                                </Setter>
+                                            </DataTrigger>
+                                        </DataTemplate.Triggers>
+                                    </DataTemplate>
+                                </DataGridTemplateColumn.CellTemplate>
+                            </DataGridTemplateColumn>
+
                             <!-- Enabled -->
                             <DataGridCheckBoxColumn Header="{x:Static localization:Strings.Enabled}"
                                                     Binding="{Binding (firewall:FirewallRule.IsEnabled)}"
@@ -333,6 +456,24 @@
                                                 Binding="{Binding (firewall:FirewallRule.Name)}"
                                                 SortMemberPath="Name"
                                                 MinWidth="150" />
+
+                            <!-- Program (file name, full path as tooltip) -->
+                            <DataGridTextColumn Header="{x:Static localization:Strings.Program}"
+                                                SortMemberPath="ProgramFileName"
+                                                MinWidth="100">
+                                <DataGridTextColumn.Binding>
+                                    <Binding Path="(firewall:FirewallRule.ProgramFileName)">
+                                        <Binding.TargetNullValue>
+                                            <x:Static Member="localization:Strings.Any" />
+                                        </Binding.TargetNullValue>
+                                    </Binding>
+                                </DataGridTextColumn.Binding>
+                                <DataGridTextColumn.ElementStyle>
+                                    <Style TargetType="{x:Type TextBlock}">
+                                        <Setter Property="ToolTip" Value="{Binding (firewall:FirewallRule.ProgramDisplay)}" />
+                                    </Style>
+                                </DataGridTextColumn.ElementStyle>
+                            </DataGridTextColumn>
                             
                             <!-- Direction -->
                             <DataGridTemplateColumn Header="{x:Static localization:Strings.Direction}"
@@ -519,8 +660,20 @@
                                         <TextBlock Grid.Row="0" Grid.Column="4"
                                                    Text="{x:Static localization:Strings.InterfaceType}"
                                                    Style="{StaticResource InfoTextBlock}" />
-                                        <TextBox Grid.Row="0" Grid.Column="6"
-                                                 Text="{Binding (firewall:FirewallRule.InterfaceType), Mode=OneWay, Converter={StaticResource FirewallInterfaceTypeToStringConverter}}" />
+                                        <TextBox Grid.Row="0" Grid.Column="6">
+                                            <TextBox.Style>
+                                                <Style TargetType="{x:Type TextBox}" BasedOn="{StaticResource TextBlockAsTextBox}">
+                                                    <Setter Property="ContextMenu" Value="{StaticResource CopyContextMenu}" />
+                                                    <!-- Unsupported combination of interface types (e.g. "Wired, Wireless") is shown as is -->
+                                                    <Setter Property="Text" Value="{Binding (firewall:FirewallRule.InterfaceTypeRaw), Mode=OneWay}" />
+                                                    <Style.Triggers>
+                                                        <DataTrigger Binding="{Binding (firewall:FirewallRule.InterfaceTypeRaw)}" Value="{x:Null}">
+                                                            <Setter Property="Text" Value="{Binding (firewall:FirewallRule.InterfaceType), Mode=OneWay, Converter={StaticResource FirewallInterfaceTypeToStringConverter}}" />
+                                                        </DataTrigger>
+                                                    </Style.Triggers>
+                                                </Style>
+                                            </TextBox.Style>
+                                        </TextBox>
 
                                         <!-- Row 2: Network profiles | Description -->
                                         <TextBlock Grid.Row="2" Grid.Column="0"
@@ -540,6 +693,37 @@
                         </controls:MultiSelectDataGrid.RowDetailsTemplate>
                     </controls:MultiSelectDataGrid>
 
+                    <!-- Row 2: No rules found (not shown while loading) -->
+                    <TextBlock Grid.Row="2"
+                               Text="{x:Static localization:Strings.NoFirewallRulesFoundMessage}">
+                        <TextBlock.Style>
+                            <Style TargetType="{x:Type TextBlock}" BasedOn="{StaticResource MessageTextBlock}">
+                                <Setter Property="Visibility" Value="Collapsed" />
+                                <Style.Triggers>
+                                    <MultiDataTrigger>
+                                        <MultiDataTrigger.Conditions>
+                                            <Condition Binding="{Binding IsLoading}" Value="False" />
+                                            <Condition Binding="{Binding Results.Count}" Value="0" />
+                                        </MultiDataTrigger.Conditions>
+                                        <Setter Property="Visibility" Value="Visible" />
+                                    </MultiDataTrigger>
+                                </Style.Triggers>
+                            </Style>
+                        </TextBlock.Style>
+                    </TextBlock>
+
+                    <!-- Row 2: Loading indicator (initial load only, see FirewallViewModel.IsLoading) -->
+                    <StackPanel Grid.Row="2"
+                                VerticalAlignment="Center"
+                                Visibility="{Binding IsLoading, Converter={StaticResource BooleanToVisibilityCollapsedConverter}}">
+                        <networkManager:LoadingIndicator IsActive="True"
+                                                         Style="{DynamicResource LoadingIndicatorArcsStyle}"
+                                                         SpeedRatio="1"
+                                                         Margin="0,0,0,10" />
+                        <TextBlock Text="{x:Static localization:Strings.LoadingFirewallRulesDots}"
+                                   Style="{StaticResource MessageTextBlock}" />
+                    </StackPanel>
+
                     <!-- Row 4: Status message -->
                     <Grid Grid.Row="4" VerticalAlignment="Center">
                         <Grid.ColumnDefinitions>
diff --git a/Source/NETworkManager/Views/FirewallView.xaml.cs b/Source/NETworkManager/Views/FirewallView.xaml.cs
index 61d85c59b6..1e3ba55bdf 100644
--- a/Source/NETworkManager/Views/FirewallView.xaml.cs
+++ b/Source/NETworkManager/Views/FirewallView.xaml.cs
@@ -1,6 +1,8 @@
 using System;
 using System.Windows;
 using System.Windows.Controls;
+using System.Windows.Controls.Primitives;
+using System.Windows.Input;
 using System.Windows.Media;
 using NETworkManager.ViewModels;
 
@@ -56,6 +58,24 @@ private void ExpandRowDetails_OnClick(object sender, RoutedEventArgs e)
         }
     }
 
+    /// <summary>
+    /// Opens the edit dialog for the rule when a row is double-clicked (if the rule can be edited).
+    /// Double-clicks on buttons / checkboxes (e.g. the expand/collapse chevron) and in the row details
+    /// (e.g. to select text) are ignored.
+    /// </summary>
+    private void DataGridRow_MouseDoubleClick(object sender, MouseButtonEventArgs e)
+    {
+        for (var element = e.OriginalSource as DependencyObject; element != null && element != sender;
+             element = element is Visual ? VisualTreeHelper.GetParent(element) : LogicalTreeHelper.GetParent(element))
+        {
+            if (element is ButtonBase or DataGridDetailsPresenter)
+                return;
+        }
+
+        if (_viewModel.EditRuleCommand.CanExecute(null))
+            _viewModel.EditRuleCommand.Execute(null);
+    }
+
     /// <summary>
     /// Offload event for toggling view to the view model.
     /// </summary>
diff --git a/Website/docs/application/firewall.md b/Website/docs/application/firewall.md
index 9d08cf8e20..abc4e6aec3 100644
--- a/Website/docs/application/firewall.md
+++ b/Website/docs/application/firewall.md
@@ -6,7 +6,7 @@ keywords: [NETworkManager, Windows Firewall, firewall rules, inbound, outbound,
 
 # Firewall
 
-The **Firewall** allows you to view, add, edit, enable, disable, or delete Windows Firewall rules managed by NETworkManager. Rules are identified by a `NETworkManager_` prefix in their display name so that only rules created through NETworkManager are shown in this view.
+The **Firewall** allows you to view, add, edit, enable, disable, or delete Windows Firewall rules managed by NETworkManager. Rules are identified by a `NETworkManager_` prefix in their display name so that only rules created through NETworkManager are shown in this view. Enable [**Show all rules**](#show-all-rules) in the settings to show all Windows Firewall rules.
 
 :::info
 
@@ -22,6 +22,8 @@ Without administrator privileges, the view is read-only. Use the **Restart as ad
 
 ![Firewall](../img/firewall.png)
 
+The **Program** column shows the file name of the program the rule applies to (e.g. `putty.exe`). The full path (e.g. `%ProgramFiles%\PuTTY\putty.exe`) is shown as tooltip and in the row details.
+
 ### Toolbar
 
 | Button | Description |
@@ -29,6 +31,34 @@ Without administrator privileges, the view is read-only. Use the **Restart as ad
 | **Add rule...** | Opens a dialog to create a new firewall rule |
 | **Windows Firewall Settings** | Opens the Windows Firewall management console (`WF.msc`) |
 
+### Rules not managed by NETworkManager
+
+By default, only rules managed by NETworkManager (display name prefixed with `NETworkManager_`) are shown. If [**Show all rules**](#show-all-rules) is enabled in the settings, all active Windows Firewall rules are shown (e.g. Windows built-in rules, rules created by other applications or from Group Policy).
+
+When all rules are shown, an additional column shows where a rule comes from. Click the column header to sort by it.
+
+| Icon | Description |
+|------|-------------|
+| Shield | Managed by NETworkManager. All actions are available. |
+| Crossed-out shield | Not managed by NETworkManager (e.g. Windows built-in rule or created by another application). The rule can be enabled, disabled, deleted or copied, but not edited. |
+| Shield with lock | Managed by a policy (Group Policy or Mobile Device Management (MDM), e.g. Microsoft Intune) or created by Windows at runtime (e.g. dynamic or hardcoded rules). The rule can't be changed locally, it can only be copied. |
+
+If at least one of the selected rules is managed by a policy, **Enable**, **Disable** and **Delete** are disabled for the whole selection.
+
+Rules not managed by NETworkManager can be enabled, disabled, deleted (also together with other selected rules) or used as a template via **Copy as...** (the copy is created as a new rule managed by NETworkManager), but editing them is not supported (yet). These rules may use properties that can't be shown in the edit dialog (e.g. rule group, service, ICMP types, edge traversal or app packages). The **Edit** action is disabled for these rules.
+
+Some rules (mostly Windows built-in rules) use values that are not supported by NETworkManager, such as port keywords (e.g. `RPC`, `RPCEPMap`, `IPHTTPSIn`), a combination of interface types (e.g. `Wired, Wireless`), a protocol that is not listed in the dialog (e.g. `IGMP` or `IPv6`) or the program `System`. These values are shown as they are, but such rules can neither be **edited** nor used for **Copy as...**, because the dialog can't show or keep these values and the new rule could apply to more traffic (e.g. to all ports). This also applies to rules managed by NETworkManager that were changed outside of NETworkManager (e.g. in the Windows Firewall management console).
+
+When enabling, disabling or deleting rules and at least one of the selected rules is not managed by NETworkManager, a warning listing these rules is shown, which must be confirmed (for delete, the warning is added to the existing confirmation).
+
+When using **Copy as...** on a rule that uses properties which are not supported by NETworkManager but restrict the traffic (ICMP types, a service or an app package, e.g. set in the Windows Firewall management console), a warning listing these properties is shown first, which must be confirmed. These properties are not copied, so the new rule may apply to more traffic than the original rule (e.g. to all services of a program instead of a single one). Review the new rule carefully before saving it. When editing a rule, these properties are kept.
+
+:::warning
+
+Be careful when disabling or deleting Windows built-in rules or rules created by other applications, as this may break network functionality of Windows or the application.
+
+:::
+
 ### Context menu
 
 Multiple rules can be selected (`Ctrl` / `Shift` + click) to enable, disable or delete them at once.
@@ -37,8 +67,8 @@ Multiple rules can be selected (`Ctrl` / `Shift` + click) to enable, disable or
 |--------|-------------|
 | **Enable** | Enables the selected rule or rules |
 | **Disable** | Disables the selected rule or rules |
-| **Edit** | Opens the edit dialog for the selected rule (single rule only) |
-| **Copy as** | Opens the dialog pre-filled with the selected rule to create a new rule based on it (single rule only) |
+| **Edit** | Opens the edit dialog for the selected rule (single rule only, only rules managed by NETworkManager without [unsupported values](#rules-not-managed-by-networkmanager)) |
+| **Copy as** | Opens the dialog pre-filled with the selected rule to create a new rule based on it (single rule only, not for rules with [unsupported values](#rules-not-managed-by-networkmanager)) |
 | **Delete** | Removes the selected rule or rules (after confirmation) |
 | **Copy** | Copies the rule information to the clipboard (single rule only) |
 | **Export** | Exports the selected rules (or all rules) to a file |
@@ -48,7 +78,7 @@ Multiple rules can be selected (`Ctrl` / `Shift` + click) to enable, disable or
 | Key | Action |
 |-----|--------|
 | `F5` | Refresh |
-| `F2` | Edit selected rule |
+| `F2` / Double-click | Edit selected rule (only if the rule can be edited) |
 | `Del` | Delete selected rule or rules |
 
 :::note
@@ -61,6 +91,8 @@ Before enabling, disabling or deleting, it is checked that all selected rules st
 
 The **Add rule** dialog is opened by clicking the **Add rule...** button below the rule list. The same dialog (with the values pre-filled) is used to **edit** an existing rule, or to create a new rule based on an existing one via **Copy as...** in the context menu (the name is suffixed with ` - Copy`, the original rule is not changed).
 
+When editing a rule, only the changed properties are updated. Properties that are not supported by NETworkManager (e.g. rule group, service or ICMP types set in the Windows Firewall management console) are kept. If the protocol is changed, ICMP types are reset to `Any`, because they are only valid for the ICMP protocol they were set for.
+
 ![Add rule](../img/firewall-rule.png)
 
 The display name of every rule created with NETworkManager is automatically prefixed with `NETworkManager_` so it can be picked up by NETworkManager on the next refresh. The prefix is hidden in the user interface.
@@ -263,7 +295,7 @@ Full path to an executable the rule applies to. When set, the rule only matches
 
 :::note
 
-If a path is provided, the file must exist on the local computer.
+If a path is provided, the file must exist on the local computer. Environment variables (e.g. `%SystemRoot%\System32\svchost.exe`) are supported.
 
 An empty value means **Any** program.
 
@@ -303,3 +335,15 @@ Network profiles the rule applies to. At least one profile must be selected.
 The last enabled profile cannot be unchecked — at least one profile must remain selected.
 
 :::
+
+## Settings
+
+### Show all rules
+
+Show all active Windows Firewall rules (e.g. Windows built-in rules, rules created by other applications or from Group Policy / MDM) instead of only the rules managed by NETworkManager. The rule list is reloaded when the setting is changed.
+
+See [Rules not managed by NETworkManager](#rules-not-managed-by-networkmanager) for what can be done with these rules.
+
+**Type:** `Boolean`
+
+**Default:** `Disabled`
diff --git a/Website/docs/changelog/next-release.md b/Website/docs/changelog/next-release.md
index fb962aef29..0a859fa9ae 100644
--- a/Website/docs/changelog/next-release.md
+++ b/Website/docs/changelog/next-release.md
@@ -89,11 +89,24 @@ Release date: **xx.xx.2026**
 
 - Added **Copy as...** to the context menu to create a new rule based on an existing one (name suffixed with ` - Copy`). [0544698](https://github.com/BornToBeRoot/NETworkManager/commit/0544698aefc325ab36ca4c8e80250e1fe0b62d4a)
 - Multiple rules can now be selected to enable, disable or delete them at once. If one of the selected rules was removed in the meantime, nothing is changed. [#3627](https://github.com/BornToBeRoot/NETworkManager/pull/3627)
+- A loading indicator is shown while the rules are loaded initially, and a message is shown if no rules are found. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+- A rule can now be edited by double-clicking it. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+- Added a **Program** column that shows the file name of the program (full path as tooltip). [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+- New **Settings > Firewall** page. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+- Added the **Show all rules** option (**Settings > Firewall**) to show all active Windows Firewall rules (including rules from Group Policy / MDM) instead of only the rules managed by NETworkManager. A new column with an icon shows whether a rule is managed by NETworkManager, not managed, or managed by a policy. Rules managed by a policy can only be copied. Rules not managed by NETworkManager can be enabled, disabled, deleted (after confirming a warning) or used as a template via **Copy as...** (with a warning if the rule uses properties that are not copied, e.g. ICMP types, a service or an app package), but editing them is not supported (yet). Rules with values that are not supported by NETworkManager (e.g. port keywords like `RPC`, a combination of interface types, a protocol like `IGMP` or the program `System`) are shown correctly, but can't be edited or copied. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
 
 ## Bug Fixes
 
 - Fixed changes to lists in the settings (e.g. query histories, port profiles, custom commands) not being saved if no other setting was changed in the same session. This happened since the settings are stored as JSON. [#3607](https://github.com/BornToBeRoot/NETworkManager/pull/3607)
 
+**Firewall**
+
+- Fixed a horizontal scrollbar appearing in the add / edit / copy rule dialog when the name or description is very long. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+- Fixed port keywords (e.g. `RPC`) and combinations of interface types being shown as **Any**. Editing a rule that was changed outside of NETworkManager to use such values no longer silently removes them (the rule can't be edited in this case). [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+- Fixed the program of a rule not being shown in the row details and the edit dialog. Saving the edit dialog then removed the program from the rule, so the rule applied to all programs. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+- Fixed editing a rule deleting and re-creating it, which removed properties that are not supported by NETworkManager (e.g. ICMP types or a service set in the Windows Firewall management console). Only the changed properties are updated now (ICMP types are reset if the protocol is changed). [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+- Fixed program paths with environment variables (e.g. `%SystemRoot%\System32\svchost.exe`) being rejected as non-existent in the add / edit / copy rule dialog. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+
 **Ping Monitor**
 
 - Fixed long error messages (e.g. from a failed host resolution) in the tooltip of the error icon not being wrapped. [#3626](https://github.com/BornToBeRoot/NETworkManager/pull/3626)

From fe3d384acd78c4bdb86cdfa6a16e558efc525847 Mon Sep 17 00:00:00 2001
From: BornToBeRoot <16019165+BornToBeRoot@users.noreply.github.com>
Date: Tue, 20 Oct 2026 23:36:29 +0200
Subject: [PATCH 3/4] Chore: Use correct order

---
 .../Resources/Strings.Designer.cs             | 224 +++++++++---------
 1 file changed, 112 insertions(+), 112 deletions(-)

diff --git a/Source/NETworkManager.Localization/Resources/Strings.Designer.cs b/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
index e5c4483dcc..50cfba6694 100644
--- a/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
+++ b/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
@@ -1220,6 +1220,15 @@ public static string ApplyWindowsKeyCombinationsLikeAltTab {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to App package.
+        /// </summary>
+        public static string AppPackage {
+            get {
+                return ResourceManager.GetString("AppPackage", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Are you sure?.
         /// </summary>
@@ -2358,6 +2367,19 @@ public static string CopyEntry {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to The rule "{0}" uses the following properties, which are not supported by NETworkManager and are not copied:
+        ///
+        ///{1}
+        ///
+        ///The new rule may apply to more traffic than the original rule (e.g. to all services of a program instead of a single one). Please review the new rule carefully before saving it..
+        /// </summary>
+        public static string CopyFirewallRuleHiddenPropertiesMessage {
+            get {
+                return ResourceManager.GetString("CopyFirewallRuleHiddenPropertiesMessage", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Copy.
         /// </summary>
@@ -3383,6 +3405,15 @@ public static string DisableRule {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Disable rules ({0}).
+        /// </summary>
+        public static string DisableRulesX {
+            get {
+                return ResourceManager.GetString("DisableRulesX", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Disclaimer.
         /// </summary>
@@ -3744,6 +3775,15 @@ public static string EditEntryDots {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Editing rules that are not managed by NETworkManager is not supported (yet), because they may use properties that can't be shown in the dialog (e.g. rule group, service or ICMP types). Use "Copy as..." to create a managed copy of the rule..
+        /// </summary>
+        public static string EditFirewallRuleNotManagedMessage {
+            get {
+                return ResourceManager.GetString("EditFirewallRuleNotManagedMessage", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Edit group.
         /// </summary>
@@ -3954,6 +3994,15 @@ public static string EnableRule {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Enable rules ({0}).
+        /// </summary>
+        public static string EnableRulesX {
+            get {
+                return ResourceManager.GetString("EnableRulesX", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Encryption.
         /// </summary>
@@ -5016,82 +5065,6 @@ public static string FirewallRuleDirection_Outbound {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to Firewall rules.
-        /// </summary>
-        public static string FirewallRules {
-            get {
-                return ResourceManager.GetString("FirewallRules", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Show all rules.
-        /// </summary>
-        public static string ShowAllRules {
-            get {
-                return ResourceManager.GetString("ShowAllRules", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to ICMP types.
-        /// </summary>
-        public static string IcmpTypes {
-            get {
-                return ResourceManager.GetString("IcmpTypes", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to App package.
-        /// </summary>
-        public static string AppPackage {
-            get {
-                return ResourceManager.GetString("AppPackage", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to The rule "{0}" uses the following properties, which are not supported by NETworkManager and are not copied:
-        ///
-        ///{1}
-        ///
-        ///The new rule may apply to more traffic than the original rule (e.g. to all services of a program instead of a single one). Please review the new rule carefully before saving it..
-        /// </summary>
-        public static string CopyFirewallRuleHiddenPropertiesMessage {
-            get {
-                return ResourceManager.GetString("CopyFirewallRuleHiddenPropertiesMessage", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Loading firewall rules....
-        /// </summary>
-        public static string LoadingFirewallRulesDots {
-            get {
-                return ResourceManager.GetString("LoadingFirewallRulesDots", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to No firewall rules found. Use "Add rule..." to create a rule or enable "Show all rules" in the settings to show all Windows Firewall rules..
-        /// </summary>
-        public static string NoFirewallRulesFoundMessage {
-            get {
-                return ResourceManager.GetString("NoFirewallRulesFoundMessage", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to One or more of the selected firewall rules no longer exist (e.g. deleted in the Windows Firewall management console). Nothing was changed..
-        /// </summary>
-        public static string FirewallRulesNoLongerExistMessage {
-            get {
-                return ResourceManager.GetString("FirewallRulesNoLongerExistMessage", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to Managed by Group Policy. The rule can't be changed locally, but it can be copied..
         /// </summary>
@@ -5119,33 +5092,6 @@ public static string FirewallRuleManagedByOtherMessage {
             }
         }
         
-        /// <summary>
-        ///   Looks up a localized string similar to At least one of the selected rules is managed by a policy (e.g. Group Policy or MDM) or created by Windows at runtime and can't be changed locally..
-        /// </summary>
-        public static string FirewallRulesManagedByPolicyMessage {
-            get {
-                return ResourceManager.GetString("FirewallRulesManagedByPolicyMessage", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to This rule uses values that are not supported by NETworkManager (e.g. port keywords like RPC, a combination of interface types, a protocol like IGMP or the program System). Editing or copying the rule is not supported (yet), because these values would be lost and the new rule could apply to more traffic (e.g. to all ports)..
-        /// </summary>
-        public static string FirewallRuleUnsupportedValuesMessage {
-            get {
-                return ResourceManager.GetString("FirewallRuleUnsupportedValuesMessage", resourceCulture);
-            }
-        }
-        
-        /// <summary>
-        ///   Looks up a localized string similar to Show all active Windows Firewall rules (e.g. Windows built-in rules, rules created by other applications or from Group Policy) instead of only the rules managed by NETworkManager. Rules not managed by NETworkManager can be enabled, disabled, deleted or copied, but not edited. Rules from a policy (e.g. Group Policy or MDM) can only be copied..
-        /// </summary>
-        public static string HelpMessage_FirewallShowAllRules {
-            get {
-                return ResourceManager.GetString("HelpMessage_FirewallShowAllRules", resourceCulture);
-            }
-        }
-        
         /// <summary>
         ///   Looks up a localized string similar to Managed by NETworkManager..
         /// </summary>
@@ -5165,20 +5111,29 @@ public static string FirewallRuleNotManagedMessage {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to Enable rules ({0}).
+        ///   Looks up a localized string similar to Firewall rules.
         /// </summary>
-        public static string EnableRulesX {
+        public static string FirewallRules {
             get {
-                return ResourceManager.GetString("EnableRulesX", resourceCulture);
+                return ResourceManager.GetString("FirewallRules", resourceCulture);
             }
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to Disable rules ({0}).
+        ///   Looks up a localized string similar to At least one of the selected rules is managed by a policy (e.g. Group Policy or MDM) or created by Windows at runtime and can't be changed locally..
         /// </summary>
-        public static string DisableRulesX {
+        public static string FirewallRulesManagedByPolicyMessage {
             get {
-                return ResourceManager.GetString("DisableRulesX", resourceCulture);
+                return ResourceManager.GetString("FirewallRulesManagedByPolicyMessage", resourceCulture);
+            }
+        }
+        
+        /// <summary>
+        ///   Looks up a localized string similar to One or more of the selected firewall rules no longer exist (e.g. deleted in the Windows Firewall management console). Nothing was changed..
+        /// </summary>
+        public static string FirewallRulesNoLongerExistMessage {
+            get {
+                return ResourceManager.GetString("FirewallRulesNoLongerExistMessage", resourceCulture);
             }
         }
         
@@ -5194,11 +5149,11 @@ public static string FirewallRulesNotManagedWarningMessage {
         }
         
         /// <summary>
-        ///   Looks up a localized string similar to Editing rules that are not managed by NETworkManager is not supported (yet), because they may use properties that can't be shown in the dialog (e.g. rule group, service or ICMP types). Use "Copy as..." to create a managed copy of the rule..
+        ///   Looks up a localized string similar to This rule uses values that are not supported by NETworkManager (e.g. port keywords like RPC, a combination of interface types, a protocol like IGMP or the program System). Editing or copying the rule is not supported (yet), because these values would be lost and the new rule could apply to more traffic (e.g. to all ports)..
         /// </summary>
-        public static string EditFirewallRuleNotManagedMessage {
+        public static string FirewallRuleUnsupportedValuesMessage {
             get {
-                return ResourceManager.GetString("EditFirewallRuleNotManagedMessage", resourceCulture);
+                return ResourceManager.GetString("FirewallRuleUnsupportedValuesMessage", resourceCulture);
             }
         }
         
@@ -5632,6 +5587,15 @@ public static string HelpMessage_ExperimentalFeatures {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Show all active Windows Firewall rules (e.g. Windows built-in rules, rules created by other applications or from Group Policy) instead of only the rules managed by NETworkManager. Rules not managed by NETworkManager can be enabled, disabled, deleted or copied, but not edited. Rules from a policy (e.g. Group Policy or MDM) can only be copied..
+        /// </summary>
+        public static string HelpMessage_FirewallShowAllRules {
+            get {
+                return ResourceManager.GetString("HelpMessage_FirewallShowAllRules", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Number of backups that are retained before the oldest one is deleted..
         /// </summary>
@@ -6040,6 +6004,15 @@ public static string HTTPStatusCode {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to ICMP types.
+        /// </summary>
+        public static string IcmpTypes {
+            get {
+                return ResourceManager.GetString("IcmpTypes", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to ICMPv4.
         /// </summary>
@@ -7040,6 +7013,15 @@ public static string LldpCdp {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Loading firewall rules....
+        /// </summary>
+        public static string LoadingFirewallRulesDots {
+            get {
+                return ResourceManager.GetString("LoadingFirewallRulesDots", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Local addresses.
         /// </summary>
@@ -7985,6 +7967,15 @@ public static string NoEnabledNetworkAdaptersFound {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to No firewall rules found. Use "Add rule..." to create a rule or enable "Show all rules" in the settings to show all Windows Firewall rules..
+        /// </summary>
+        public static string NoFirewallRulesFoundMessage {
+            get {
+                return ResourceManager.GetString("NoFirewallRulesFoundMessage", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to No matching commands!.
         /// </summary>
@@ -11776,6 +11767,15 @@ public static string ShowAddressBar {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Show all rules.
+        /// </summary>
+        public static string ShowAllRules {
+            get {
+                return ResourceManager.GetString("ShowAllRules", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Show closed ports.
         /// </summary>

From 1a08bb88c8c2b775c940220e8e4e95ca2b318cce Mon Sep 17 00:00:00 2001
From: BornToBeRoot <16019165+BornToBeRoot@users.noreply.github.com>
Date: Wed, 21 Oct 2026 00:18:42 +0200
Subject: [PATCH 4/4] Chore: Feedback from copilot

---
 .../Resources/Strings.Designer.cs             | 18 +++++++
 .../Resources/Strings.resx                    |  6 +++
 .../Firewall/Firewall.cs                      | 50 +++++++++++++------
 .../Firewall/FirewallRuleHiddenProperties.cs  | 12 ++++-
 .../ViewModels/FirewallViewModel.cs           |  6 +++
 Website/docs/application/firewall.md          |  2 +-
 Website/docs/changelog/next-release.md        |  2 +-
 7 files changed, 79 insertions(+), 17 deletions(-)

diff --git a/Source/NETworkManager.Localization/Resources/Strings.Designer.cs b/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
index 50cfba6694..f009997dd5 100644
--- a/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
+++ b/Source/NETworkManager.Localization/Resources/Strings.Designer.cs
@@ -7715,6 +7715,15 @@ public static string Network {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Network adapters.
+        /// </summary>
+        public static string NetworkAdapters {
+            get {
+                return ResourceManager.GetString("NetworkAdapters", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Network address.
         /// </summary>
@@ -13352,6 +13361,15 @@ public static string Username {
             }
         }
         
+        /// <summary>
+        ///   Looks up a localized string similar to Users and authentication.
+        /// </summary>
+        public static string UsersAndAuthentication {
+            get {
+                return ResourceManager.GetString("UsersAndAuthentication", resourceCulture);
+            }
+        }
+        
         /// <summary>
         ///   Looks up a localized string similar to Use SSL (LDAPS).
         /// </summary>
diff --git a/Source/NETworkManager.Localization/Resources/Strings.resx b/Source/NETworkManager.Localization/Resources/Strings.resx
index 7c452cce81..8a727ed0af 100644
--- a/Source/NETworkManager.Localization/Resources/Strings.resx
+++ b/Source/NETworkManager.Localization/Resources/Strings.resx
@@ -4343,6 +4343,12 @@ You can copy your profile files from “{0}” to “{1}” to migrate your exis
   <data name="IcmpTypes" xml:space="preserve">
     <value>ICMP types</value>
   </data>
+  <data name="NetworkAdapters" xml:space="preserve">
+    <value>Network adapters</value>
+  </data>
+  <data name="UsersAndAuthentication" xml:space="preserve">
+    <value>Users and authentication</value>
+  </data>
   <data name="AppPackage" xml:space="preserve">
     <value>App package</value>
   </data>
diff --git a/Source/NETworkManager.Models/Firewall/Firewall.cs b/Source/NETworkManager.Models/Firewall/Firewall.cs
index 0aa86d065f..70d32bae36 100644
--- a/Source/NETworkManager.Models/Firewall/Firewall.cs
+++ b/Source/NETworkManager.Models/Firewall/Firewall.cs
@@ -66,7 +66,8 @@ public class Firewall
 
     /// <summary>
     /// PowerShell expression that maps a rule (<c>$rule</c>) and its filters (<c>$portFilter</c>,
-    /// <c>$addressFilter</c>, <c>$appFilter</c>, <c>$ifTypeFilter</c>, <c>$svcFilter</c>) to the object parsed by <see cref="GetRulesAsync"/>.
+    /// <c>$addressFilter</c>, <c>$appFilter</c>, <c>$ifTypeFilter</c>, <c>$svcFilter</c>, <c>$ifFilter</c>, <c>$secFilter</c>)
+    /// to the object parsed by <see cref="GetRulesAsync"/>.
     /// Shared by the query for rules managed by NETworkManager and the query for all rules.
     /// </summary>
     private const string RuleProjectionScript = @"[PSCustomObject]@{
@@ -88,6 +89,12 @@ public class Firewall
         IcmpType      = ($portFilter.IcmpType -join ',')
         Service       = [string]$svcFilter.Service
         Package       = [string]$appFilter.Package
+        InterfaceAlias = ($ifFilter.InterfaceAlias -join ',')
+        LocalUser      = [string]$secFilter.LocalUser
+        RemoteUser     = [string]$secFilter.RemoteUser
+        RemoteMachine  = [string]$secFilter.RemoteMachine
+        Authentication = [string]$secFilter.Authentication
+        Encryption     = [string]$secFilter.Encryption
     }";
 
     #region Methods
@@ -128,6 +135,8 @@ public static async Task<List<FirewallRule>> GetRulesAsync(bool onlyManagedRules
     $appFilter         = $rule | Get-NetFirewallApplicationFilter
     $ifTypeFilter      = $rule | Get-NetFirewallInterfaceTypeFilter
     $svcFilter         = $rule | Get-NetFirewallServiceFilter
+    $ifFilter          = $rule | Get-NetFirewallInterfaceFilter
+    $secFilter         = $rule | Get-NetFirewallSecurityFilter
     {RuleProjectionScript}
 }}");
                 }
@@ -140,6 +149,8 @@ public static async Task<List<FirewallRule>> GetRulesAsync(bool onlyManagedRules
 $app = @{{}}; Get-NetFirewallApplicationFilter -PolicyStore ActiveStore | ForEach-Object {{ $app[$_.InstanceID] = $_ }}
 $if = @{{}}; Get-NetFirewallInterfaceTypeFilter -PolicyStore ActiveStore | ForEach-Object {{ $if[$_.InstanceID] = $_ }}
 $sf = @{{}}; Get-NetFirewallServiceFilter -PolicyStore ActiveStore | ForEach-Object {{ $sf[$_.InstanceID] = $_ }}
+$inf = @{{}}; Get-NetFirewallInterfaceFilter -PolicyStore ActiveStore | ForEach-Object {{ $inf[$_.InstanceID] = $_ }}
+$sec = @{{}}; Get-NetFirewallSecurityFilter -PolicyStore ActiveStore | ForEach-Object {{ $sec[$_.InstanceID] = $_ }}
 # The filters are matched by InstanceID. If an ID occurs more than once (e.g. a local and a Group Policy rule
 # with the same ID), the filters of these rules are queried per rule, so they are not mixed up.
 $count = @{{}}; foreach ($rule in $rules) {{ $count[$rule.InstanceID]++ }}
@@ -152,12 +163,16 @@ public static async Task<List<FirewallRule>> GetRulesAsync(bool onlyManagedRules
         $appFilter     = $rule | Get-NetFirewallApplicationFilter
         $ifTypeFilter  = $rule | Get-NetFirewallInterfaceTypeFilter
         $svcFilter     = $rule | Get-NetFirewallServiceFilter
+        $ifFilter      = $rule | Get-NetFirewallInterfaceFilter
+        $secFilter     = $rule | Get-NetFirewallSecurityFilter
     }} else {{
         $portFilter    = $pf[$id]
         $addressFilter = $af[$id]
         $appFilter     = $app[$id]
         $ifTypeFilter  = $if[$id]
         $svcFilter     = $sf[$id]
+        $ifFilter      = $inf[$id]
+        $secFilter     = $sec[$id]
     }}
     $list.Add({RuleProjectionScript})
 }}
@@ -203,10 +218,7 @@ public static async Task<List<FirewallRule>> GetRulesAsync(bool onlyManagedRules
                             NetworkProfiles = ParseProfile(result.Properties["Profile"]?.Value?.ToString()),
                             InterfaceType = ParseInterfaceType(result.Properties["InterfaceType"]?.Value?.ToString(), out var interfaceTypeRaw),
                             InterfaceTypeRaw = interfaceTypeRaw,
-                            HiddenProperties = ParseHiddenProperties(
-                                result.Properties["IcmpType"]?.Value?.ToString(),
-                                result.Properties["Service"]?.Value?.ToString(),
-                                result.Properties["Package"]?.Value?.ToString()),
+                            HiddenProperties = ParseHiddenProperties(result),
                         };
 
                         // Use ToString() (not "as string"), because the value can be wrapped in a PSObject
@@ -812,28 +824,38 @@ private static List<string> ParseAddresses(string value)
     }
 
     /// <summary>
-    /// Determines the <see cref="FirewallRuleHiddenProperties"/> of a rule. A property is set if its value
-    /// is not empty and not <c>"Any"</c>.
+    /// Determines the <see cref="FirewallRuleHiddenProperties"/> of a rule. A restriction is set if its value
+    /// is not empty and not <c>"Any"</c> (authentication / encryption: not <c>"NotRequired"</c>).
     /// </summary>
-    /// <param name="icmpTypes">The ICMP types (comma-separated) returned by PowerShell.</param>
-    /// <param name="service">The service returned by PowerShell.</param>
-    /// <param name="package">The app package returned by PowerShell.</param>
-    private static FirewallRuleHiddenProperties ParseHiddenProperties(string icmpTypes, string service, string package)
+    /// <param name="result">The rule object returned by PowerShell (see <see cref="RuleProjectionScript"/>).</param>
+    private static FirewallRuleHiddenProperties ParseHiddenProperties(SMA.PSObject result)
     {
+        string Get(string name) => result.Properties[name]?.Value?.ToString();
+
         static bool IsSet(string value) =>
             !string.IsNullOrWhiteSpace(value) && !value.Equals("Any", StringComparison.OrdinalIgnoreCase);
 
+        static bool IsRequired(string value) =>
+            !string.IsNullOrWhiteSpace(value) && !value.Equals("NotRequired", StringComparison.OrdinalIgnoreCase);
+
         var properties = FirewallRuleHiddenProperties.None;
 
-        if (IsSet(icmpTypes))
+        if (IsSet(Get("IcmpType")))
             properties |= FirewallRuleHiddenProperties.IcmpTypes;
 
-        if (IsSet(service))
+        if (IsSet(Get("Service")))
             properties |= FirewallRuleHiddenProperties.Service;
 
-        if (IsSet(package))
+        if (IsSet(Get("Package")))
             properties |= FirewallRuleHiddenProperties.Package;
 
+        if (IsSet(Get("InterfaceAlias")))
+            properties |= FirewallRuleHiddenProperties.InterfaceAlias;
+
+        if (IsSet(Get("LocalUser")) || IsSet(Get("RemoteUser")) || IsSet(Get("RemoteMachine")) ||
+            IsRequired(Get("Authentication")) || IsRequired(Get("Encryption")))
+            properties |= FirewallRuleHiddenProperties.Security;
+
         return properties;
     }
 
diff --git a/Source/NETworkManager.Models/Firewall/FirewallRuleHiddenProperties.cs b/Source/NETworkManager.Models/Firewall/FirewallRuleHiddenProperties.cs
index 863ae92f16..b02eedfe0a 100644
--- a/Source/NETworkManager.Models/Firewall/FirewallRuleHiddenProperties.cs
+++ b/Source/NETworkManager.Models/Firewall/FirewallRuleHiddenProperties.cs
@@ -28,5 +28,15 @@ public enum FirewallRuleHiddenProperties
     /// <summary>
     /// App package (e.g. only a single Microsoft Store app).
     /// </summary>
-    Package = 4
+    Package = 4,
+
+    /// <summary>
+    /// Network adapters (interface aliases, e.g. only the VPN adapter).
+    /// </summary>
+    InterfaceAlias = 8,
+
+    /// <summary>
+    /// Security conditions (local / remote users or computers, required authentication or encryption).
+    /// </summary>
+    Security = 16
 }
\ No newline at end of file
diff --git a/Source/NETworkManager/ViewModels/FirewallViewModel.cs b/Source/NETworkManager/ViewModels/FirewallViewModel.cs
index 6a5d6fcc9c..8232fdab9f 100644
--- a/Source/NETworkManager/ViewModels/FirewallViewModel.cs
+++ b/Source/NETworkManager/ViewModels/FirewallViewModel.cs
@@ -559,6 +559,12 @@ private static string GetHiddenPropertiesString(FirewallRuleHiddenProperties pro
         if (properties.HasFlag(FirewallRuleHiddenProperties.Package))
             names.Add(Strings.AppPackage);
 
+        if (properties.HasFlag(FirewallRuleHiddenProperties.InterfaceAlias))
+            names.Add(Strings.NetworkAdapters);
+
+        if (properties.HasFlag(FirewallRuleHiddenProperties.Security))
+            names.Add(Strings.UsersAndAuthentication);
+
         return DialogHelper.FormatItemList(names);
     }
 
diff --git a/Website/docs/application/firewall.md b/Website/docs/application/firewall.md
index abc4e6aec3..d1a5106ea1 100644
--- a/Website/docs/application/firewall.md
+++ b/Website/docs/application/firewall.md
@@ -51,7 +51,7 @@ Some rules (mostly Windows built-in rules) use values that are not supported by
 
 When enabling, disabling or deleting rules and at least one of the selected rules is not managed by NETworkManager, a warning listing these rules is shown, which must be confirmed (for delete, the warning is added to the existing confirmation).
 
-When using **Copy as...** on a rule that uses properties which are not supported by NETworkManager but restrict the traffic (ICMP types, a service or an app package, e.g. set in the Windows Firewall management console), a warning listing these properties is shown first, which must be confirmed. These properties are not copied, so the new rule may apply to more traffic than the original rule (e.g. to all services of a program instead of a single one). Review the new rule carefully before saving it. When editing a rule, these properties are kept.
+When using **Copy as...** on a rule that uses properties which are not supported by NETworkManager but restrict the traffic (ICMP types, a service, an app package, specific network adapters, or users / required authentication, e.g. set in the Windows Firewall management console), a warning listing these properties is shown first, which must be confirmed. These properties are not copied, so the new rule may apply to more traffic than the original rule (e.g. to all services of a program instead of a single one). Review the new rule carefully before saving it. When editing a rule, these properties are kept.
 
 :::warning
 
diff --git a/Website/docs/changelog/next-release.md b/Website/docs/changelog/next-release.md
index 0a859fa9ae..f1a0e31af8 100644
--- a/Website/docs/changelog/next-release.md
+++ b/Website/docs/changelog/next-release.md
@@ -93,7 +93,7 @@ Release date: **xx.xx.2026**
 - A rule can now be edited by double-clicking it. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
 - Added a **Program** column that shows the file name of the program (full path as tooltip). [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
 - New **Settings > Firewall** page. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
-- Added the **Show all rules** option (**Settings > Firewall**) to show all active Windows Firewall rules (including rules from Group Policy / MDM) instead of only the rules managed by NETworkManager. A new column with an icon shows whether a rule is managed by NETworkManager, not managed, or managed by a policy. Rules managed by a policy can only be copied. Rules not managed by NETworkManager can be enabled, disabled, deleted (after confirming a warning) or used as a template via **Copy as...** (with a warning if the rule uses properties that are not copied, e.g. ICMP types, a service or an app package), but editing them is not supported (yet). Rules with values that are not supported by NETworkManager (e.g. port keywords like `RPC`, a combination of interface types, a protocol like `IGMP` or the program `System`) are shown correctly, but can't be edited or copied. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
+- Added the **Show all rules** option (**Settings > Firewall**) to show all active Windows Firewall rules (including rules from Group Policy / MDM) instead of only the rules managed by NETworkManager. A new column with an icon shows whether a rule is managed by NETworkManager, not managed, or managed by a policy. Rules managed by a policy can only be copied. Rules not managed by NETworkManager can be enabled, disabled, deleted (after confirming a warning) or used as a template via **Copy as...** (with a warning if the rule uses properties that are not copied, e.g. ICMP types, a service, an app package, specific network adapters or users / required authentication), but editing them is not supported (yet). Rules with values that are not supported by NETworkManager (e.g. port keywords like `RPC`, a combination of interface types, a protocol like `IGMP` or the program `System`) are shown correctly, but can't be edited or copied. [#3630](https://github.com/BornToBeRoot/NETworkManager/pull/3630)
 
 ## Bug Fixes