Windows Firewall UDF

[JLogan3o13]

I dug this UDF out in response to a request in the General Help forum. There is still some tidying to do, but I thought I would post here for anyone that would benefit. All functions have been tested on both XP and Windows 7.
 

Updated January 22, 2014:

 Tested on XP, WIN7 and WIN8.1, x86 and x64

Current version includes:

• Enable or Disable the Windows Firewall
• Add or Remove Authorized Applications to the Exclusions list
• Add or Delete Ports from the Exclusions list.
• Enable or Disable the use of Exceptions
• Enable or Disable Notifications of blocked applications
• Enable or Disable Existing Ports
• List all Applications in the Exclusions List
• List all Ports in the Exclusions List
• List Properties of the current Firewall Configuration
• Restore the Windows Firewall to its default configuration

Windows Firewall.au3

Edited January 22, 2014 by JLogan3o13

[FireFox]

_ListAuthorizedApps successfully tested on Win XP SP3 32 bits and Win 7 SP1 32 bits.

Br, FireFox.

[JLogan3o13]

Thanks for the update. I do not have a Win732bit, only XP (both 32 and 64) and Win7 64bit. It did not work on Win 7 64. I'll add this bit in the description, though. Thanks again.

[BrewManNH]

I just tested _ListAuthorizedApps on Win7 x64 and it worked ok for me.

Might I suggest though that you have the function return the listing rather than popping up a message box for each one? Seriously annoying when I missed that in the script and I have several apps that have to get listed.

[JScript]

I just tested _ListAuthorizedApps on Win7 x64 and it worked ok for me.

For me too! Thank you mister @JLogan3o13

JS

[JLogan3o13]

I just tested _ListAuthorizedApps on Win7 x64 and it worked ok for me.

Might I suggest though that you have the function return the listing rather than popping up a message box for each one? Seriously annoying when I missed that in the script and I have several apps that have to get listed.

That is odd; I tested on four or five of my Win7 boxes, and it didn't return anything on any of them. I will have to look into it more. Thanks for the info, BrewManNH, and the confirmation, JScript.

Edit: Found the issue on my end that was preventing it from working on Win7. Updated first post to reflect this. Thanks again, gentlemen.

Edited October 19, 2012 by JLogan3o13

[JLogan3o13]

Modified the List functions to return a ListView as suggested by BrewManNH, and added functionality to open and close existing ports. Source updated in first post.

[guinness]

It's bad practice to use a MsgBox in a UDF to return an error. You should settle for SetError instead and let the user decide how to display the error.

[JScript]

I agree, this way the user can display the messages in their native language!

JS

[JLogan3o13]

Thanks for the suggestions, I will take a look at some other UDFs regarding how best to set/use SetError.

[WhiteStar]

I've just grabbed this UDF as it would address a number of FW issues I have to deal with pertaining to an install & management app I am working on. My Dev & Test system is Win-7/64 but I also have Vista-32 & XP-32 on separate machines for testing...

I have been working with an alternative method of creating Firewall rules, opening specific ports, TCP & UDP as required.

Some points I've hit with this UDF. (possibly [Keyboard <-> Chair interface] failure but unlikely)

For testing purposes I made a mini applet with #RequireAdmin otherwise it doesn't work ... Might suggest making a note for that in the first posting as not everyone would likely be aware of that little detail.

_AddAuthorizedApp("App-Test", "D:MynewAppBinMyApp.exe", 2, 0, True)

creates an InBound rule perfectly

does not create an Outbound rule. Possibly a switch for Inbound / Outbound rule

does not address specific ports for App-Test. opening a specific app and allowing it to use only certain ports IE ports:9000-9002 TCP / UDP or ALL (Security being a point here)

_AddPort("MyTestPort", 9999, 0, 6, "True")

does not appear to add any ports to any previous in/out bound rules

it creates a separate rule for the specified port. does not specify which rule to add it to (for example App-Test) if created above. Also does not specify which excutable to allow it for, as it just opens the port to all apps which would be a potential security issue.

_ListAuthorizedApps()

lists previously manually configed apps and App-Test and does this nicely

_ListAuthorizedPorts()

shows "All Authorized Applications" (line 334) which should show "All Authorized Ports"

Sample C# code which shows using the netsh to accomplish adding an app with specified ports, protocol (tcp/udp), in/out bound

static public void OpenFirewallPort(string ruleName, int portNumber)
{           
    switch (Environment.OSVersion.Version.Major)            
    {
        // Is Windows XP running (Windows NT 5)?
        case 5:                  
            // Opening port for both TCP and UDP : removing eventual existing rule then creating new one                    
            RunShellCommand("netsh firewall delete portopening all " + portNumber.ToString());                  
            RunShellCommand("netsh firewall add portopening all " + portNumber.ToString());                  
            break;               
            // Is Windows Vista running (Windows NT 6)?             
        case 6:                  
            // Opening port for TCP : removing eventual existing rule then creating new one                 
            RunShellCommand("netsh advfirewall firewall delete rule name=" + ruleName + " dir=in protocol=tcp localport=" + portNumber.ToString());                 
            RunShellCommand("netsh advfirewall firewall add rule name=" + ruleName + " dir=in action=allow enable=yes protocol=tcp localport=" + portNumber.ToString());                     
            // Opening port for UDP : removing eventual existing rule then creating new one                 
            RunShellCommand("netsh advfirewall firewall delete rule name=" + ruleName + " dir=in protocol=udp localport=" + portNumber.ToString());                 
            RunShellCommand("netsh advfirewall firewall add rule name=AAA_MyTest dir=in action=allow enable=yes protocol=udp localport=8002-8005,8007,9000-9010" + portNumber.ToString());                   
        break;          
    }       
}

Thanks for the great work ! Hope my suggestions / thoughts help,

WhiteStar

[ricky]

Hello,

thanks for your udf, I'm testing it in my computer with autoIt 3.3.10.2 but in _ListAuthorizedApps() the parameters to the ArrayDisplay are wrong because by default noting appears and without the parameters the script find some apps.

You need to replace by :

In _ListAuthorizedApps() replace by :

_ArrayDisplay($aArray, "All Authorized Applications", 7, 0, "|", "Application Name|Enabled - True or False|IP Version|File Name|Remote Addresses|Scope")

In _ListAuthorizedPorts() replace by :

_ArrayDisplay($aArray, "All Authorized Applications", 8, 0, "|", "Port Name|Port Number|IP Version|Protocol TCP(6) or UDP(17)" & _
        "|Remote Addresses|Scope|Enabled|Builtin")

Edited January 9, 2014 by ricky03

[JLogan3o13]

Hi, ricky03. I am revisiting all my work since the recent upgrade. Thank you for the suggestions, I will look into updating this soon.

[AutID]

I find these function very usefull and the udf is good.

But wouldn't the functions crash the script if there are errors since it is not in pure autoit?

And I think seterrror would be better since it is a udf and it can be included in projects.

Edited January 10, 2014 by AutID

[JLogan3o13]

Hi, AutID. Changing to SetError has been suggested already, and will be implemented in the rewrite that I mentioned above.

[AutID]

Ok my bad mentioning it twice. Didn't read the entire thread. I will try to write this in autoit and see what it gives. All these functions are really good idea.

Great job.

[JLogan3o13]

Updated first post. Tested XP SP2 through WIN8.1

[wraithdu]

Nice update. You might want to change the names of your global variables though, they are very generic. I went with $__g_WF_fwMgr and $__g_WF_fwProfile. You could probably also use an IsObj() check in your _create function to avoid reinitializing the global object on each call.

Edited January 22, 2014 by wraithdu

[JLogan3o13]

Thanks for the suggestions, I will take a look at those this weekend.

[ricky]

Hello,

thanks for this update. It's possible to add a change log in the first post to see the changes?

Thanks for sharing!