17

I need to open up the Windows Firewall for outbound connections for an application I'm writing.

The best answers I've been able to locate are here:

http://www.shafqatahmed.com/2008/01/controlling-win.html

http://www.vincenzo.net/isxkb/index.php?title=Adding_a_rule_to_the_Windows_firewall

The problem is that method only creates an inbound rule, and not an outbound rule. (Both the C# and InnoSetup script use the same method.) This is entirely useless for me.

The default behaviour for the Windows Firewall is to allow outbound traffic, but that doesn't guarantee that someone won't change that.

I would prefer to do this in the installer (using InnoSetup) rather than doing it in C#.

Did I miss something?

Does anyone know how to create an outbound rule?

1
  • The links are broken.
    – VLL
    Oct 10 at 11:35

5 Answers 5

27

You can use netsh if you need add some exceptions for your application.

write in command line (for XP):

netsh firewall add allowedprogram ?

write in command line (for W7):

netsh advfirewall firewall add rule ?

This difference becouse netsh firewall command is deprecated. Instead, we have to use the command netsh advfirewall firewall.

More information about using the command netsh advfirewall firewall instead of the netsh firewall command we can see in Knowledge Base there: http://go.microsoft.com/fwlink/?linkid=121488

Examples:

Adding a rule for incoming traffic without security encapsulation for messenger.exe:

netsh advfirewall firewall add rule name="allow messenger" dir=in program="c:\programfiles\messenger\msmsgs.exe" security=authnoencap action=allow

Adding a rule for outgoing traffic at the port 80:

netsh advfirewall firewall add rule name="allow80" protocol=TCP dir=out localport=80 action=block

Adding rules to inbound traffic with safety & traffic encryption for TCP through port 80:

netsh advfirewall firewall add rule name="Require Encryption for Inbound TCP/80" protocol=TCP dir=in localport=80 security=authdynenc action=allow
1

TechNet does: Create an Outbound Port Rule on Windows 7, Windows Vista, Windows Server 2008 or Windows Server 2008 R2

Although I assume you meant to create such rules programatically, if that's the case you might be interested in Working with Group Policy Objects Programmatically.

Finally if you're planning to do that during installation, InnoSetup should be able to merge the necessary registry keys at setup time.

1
  • The second link is broken.
    – VLL
    Oct 10 at 11:33
1

The problem with netsh is that it does not work on some Windows versions (e.g. Windows Vista Basic). That is why it is better to add the exception without using netsh. This article contains sample Inno Setup code.

2
  • That's also not so reliable across the Windows versions; see the remarks on MSDN: "The Windows Firewall API is available for use in the operating systems specified in the Requirements section. It may be altered or unavailable in subsequent versions. For Windows Vista and later, use of the Windows Firewall with Advanced Security API is recommended", Requirements: Minimum supported client: Windows Vista, Windows XP with SP2; Minimum supported server: Windows Server 2003 with SP1. So, as you can see, even on Windows Vista which is this API part of it's not recommended. MS is sometimes crazy :-)
    – TLama
    Feb 24, 2014 at 13:48
  • The link is broken.
    – VLL
    Oct 10 at 11:32
0

This is one of the many tasks that can be passed off to the Windows command-line tools. netsh does the appropriate things, but it (like everything else netsh does) is next to impossible to find. The simple version is:
netsh firewall add allowedprogram <path> <name>
For more details, run:
netsh firewall add allowedprogram ?

These can be done either in the [Run] section or by calling Exec.

Note that this is depreciated in Windows 7; if you're only targeting Vista/2008 or later, you should use netsh advfirewall firewall instead. Microsoft has an article on converting from the former the latter, but I still have to support XP, so I haven't done this.

0

You can execute netsh in [Run] section of the installer. This example opens port 80 for any executable:

[Run]
; Remove firewall exception first when upgrading
Filename: "{sys}\netsh.exe"; Parameters: "advfirewall firewall delete rule name=""My WWW Server"" "; Flags: runhidden

; Add firewall exception
Filename: "{sys}\netsh.exe"; Parameters: "advfirewall firewall add rule name=""My WWW Server"" protocol=TCP dir=out localport=80 action=allow "; Flags: runhidden

[UninstallRun]
Filename: "{sys}\netsh.exe"; Parameters: "advfirewall firewall delete rule name=""My WWW Server"" "; Flags: runhidden; RunOnceId: "RemoveFirewallExc"

Change dir=out to dir=in to create an inbound rule.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.