Avoiding a Windows Firewall popup

Question

Hi

My organisation produces a suite of Windows applications that make use of networking, and so when users run our software for the first time, the Windows Firewall (if it is running) brings up a pop-up, informing the user that our app(s) are trying to use the network, prompting the user to allow or deny access.

This occurs with plenty of other apps (Spotify, to give one example), but ee'd like to prevent these popups from happening, as they can be a bit problematic for our users. Some Applications (MSN Messenger, GoogeTalk) operate without ever causing the Firewall to alert the user, and we'd like to do the same.

We've successfully done this on Windows XP by having our installer write appropriate registry keys at:

HKLM\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List

However, this does not have the same effect on Windows 7 - the Firewall popups still take place.

Any ideas how we can do this? (Our installers and software are all digitally signed.)

Thanks Tom Davies

Answer 1

In your installer (i.e. as elevated admin), you need to write code to access the Windows Firewall APIs and add your app as an exception

Answer 2

I actually advise against making this an installer issue for several reasons:

• There are multiple software firewalls out there; you can't code and test for all of them.

• Some (such as the built-in windows firewall ) have API's that won't allow you to configure port exceptions when the FW is disabled.
  If the user later enables the FW you are hosed again.

• There could be external firewalls that still get you.

Instead I prefer to make this a documentation effort so that users and administrators are fully aware of the networking requirements. I once had to goole Apple's website to figure out what ports iTunes needed and I swear to God they made it really hard to find as they tried to soften everything up for consumers.

However, if you want to give it a best faith effort in the install, WiX has a Custom Action extension for interacting with the firewall rather then writing your own Custom Action. Even if you are using another tool such as InstallShield, you can wrap this behavior up in a WiX merge module and then consume it with your primary tool of choice.

You can read about it here at:

Joy Of Setup Blog

and

WiX Documentation

Answer 3

You can add exceptions to Windows Firewall by shelling out to netsh, a utility built into Windows, but the utility works differently on Windows XP and Windows 7. Here are the commands I used:

Windows XP:

add: netsh firewall add allowedprogram mode=ENABLE profile=ALL name=[exception name] program=[program path]

remove: netsh firewall delete allowedprogram profile=ALL program=[program path]

Windows 7:

add: netsh advfirewall firewall add rule action=allow profile=any protocol=any enable=yes direction=[in|out] name=[exception name] program=[program path]

remove: advfirewall firewall delete rule profile=any name=[exception name]