Firewall exceptions for installed applications

[MortSkil]

Wise for Windows Installer supports creating firewall exceptions, either by opening desired ports or allowing installed applications through the wall.
Is there any such feature in InstallAware?

[CandiceJones]

Sorry, this is not built-in.

If this is a registry based setting, try to import the MSI database Wise creates using the Database Import Wizard, and see what entries it has created there. You can also try sniffing what their setup does using PackageAware.

If this is API based, we could build a plug-in for it so you could do this easily from your setup using a single MSIcode command.

[MortSkil]

I will check what Wise does and let you know my findings as soon as I have time to dig into it .

[MortSkil]

- and, if you provide this feature as a plug-in: Will that be available for the IA community for free, or would we have to order this feature specifically?

[CandiceJones]

Free

[MortSkil]

Splendid

Please feel free to transfer (or copy) this topic to Technical support if you want.

[MortSkil]

Check out the Windows Firewall Scripting article. It contains many useful scripts illustrating how to manipulate the Firewall.

Is it best to use this information in the InstallAware project directly, or would you recommend a plug-in from InstallAware?

Seems like a huge security hole, though. If a user with administrative privileges runs a malicious program, there seem to be nothing to stop the program from digging large holes in any local firewall.

-Morten

[CandiceJones]

Very interesting! I think the simplest way would be to save these scripts as text files and then to add them to your project as support files, then run them using the Windows Script Host (if I recall the name correctly) from $SUPPORTDIR$. I believe there was an .exe file that could be directly used which would take care of this.

As far as the security vulnerability, yes you are exactly right. This is a big vulnerability!

[MortSkil]

Well, from my point of view, our users should not have to edit the firewall configuration in order to let our IP-aware programs work, so I prefer to define my software as not being malicious by purpose


Do you know if it is possible to execute a VB script using Windows Scripting Host silently?

Do you have any experience with different brands of firewall/antivirus software and programs installed using InstallAware?

[CandiceJones]

Yes I believe there are samples for that in this forum. I believe InstallAware works well with all security products out there - we are not aware of any issues.

[Tinus]

Check out the Windows Firewall Scripting article. It contains many useful scripts illustrating how to manipulate the Firewall.
-Morten

Morten, in my projects I simply call netsh.exe:

Code: Select all

Run Program $WINSYSDIR$\\netsh.exe firewall add port protocol=TCP port=12345 name="bla bla" profile=ALL (WAIT)


[MortSkil]

Thanks a lot! I will check this out and see how it works for my first InstallAware project.