Avoiding a Windows Firewall popup

Question

My organisation produces a suite of Windows applications that make use of networking, and so when users run our software for the first time, the Windows Firewall (if it is runni

Answer 1

You can add exceptions to Windows Firewall by shelling out to netsh, a utility built into Windows, but the utility works differently on Windows XP and Windows 7. Here are the commands I used:

Windows XP:

add: netsh firewall add allowedprogram mode=ENABLE profile=ALL name=[exception name] program=[program path]

remove: netsh firewall delete allowedprogram profile=ALL program=[program path]

Windows 7:

add: netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=[in|out] name=[exception name] program=[program path]

remove: advfirewall firewall delete rule profile=any name=[exception name]

Answer 2

I actually advise against making this an installer issue for several reasons:

• There are multiple software firewalls out there; you can't code and test for all of them.

• Some (such as the built-in windows firewall ) have API's that won't allow you to configure port exceptions when the FW is disabled.
  If the user later enables the FW you are hosed again.

• There could be external firewalls that still get you.

Instead I prefer to make this a documentation effort so that users and administrators are fully aware of the networking requirements. I once had to goole Apple's website to figure out what ports iTunes needed and I swear to God they made it really hard to find as they tried to soften everything up for consumers.

However, if you want to give it a best faith effort in the install, WiX has a Custom Action extension for interacting with the firewall rather then writing your own Custom Action. Even if you are using another tool such as InstallShield, you can wrap this behavior up in a WiX merge module and then consume it with your primary tool of choice.

You can read about it here at:

Joy Of Setup Blog

and

WiX Documentation

Answer 3

In your installer (i.e. as elevated admin), you need to write code to access the Windows Firewall APIs and add your app as an exception