2

I've got a continuous integration system running on my computer which is placing the test build outputs into temporary files on the system.
Unfortunately this means Windows Firewall considers each one to be a separate application and pops up a notification for every single build, which is several over the course of a test run.
These builds communicate exclusively via localhost, so there is absolutely no reason to let them through the firewall. They currently use port 8081 but can be set to anything.

Is there a way to get Windows Firewall to simply leave every program under %TEMP% blocked?

windows firewall has blocked some features of this app

1

You're recieving this prompt because there isn't an explicit rule relating to the application. The default firewall policy allows outbound connections not matching any rule so most of the time this relates to the application accepting inbound connections, which are blocked by default, and thus require a specific firewall rule to exist before they are allowed through the firewall.

Windows Firewall sees your builds as separate programs because they are different executables with different paths.

There are a number of possible ways to address this issue:

Have Each Build Set a Rule

You could create a firewall rule, either as part of the application's code, or as a post-build step executed by your CI tool.

If you don't want to add specific code to your executable (or setup process) to setup a rule, you could have your CI tool execute a PowerShell script similar to the one below

This script removes any existing test build firewall rules and adds a rule allowing inbound connections for the current build:

Param
(
    [Parameter(Mandatory=$true)]
    [string] $BuildPath
)
function Add-TestBuildFirewallRule
{
    Param
    (
        [Parameter(Mandatory=$true)]
        [string] $BuildPath
    )
    $existingRule = Get-NetFirewallRule -Name YourApp-LatestTestBuild -ErrorAction SilentlyContinue
    if($existingRule -ne $null)
    {
        Remove-NetFirewallRule -Name YourApp-LatestTestBuild
    }
    New-NetFirewallRule -Name "YourApp-TestBuild" -DisplayName "Latest Test Build" -Description "Allow the latest test build to accept incomming connections" -Enabled True -Direction Inbound -Program $BuildPath
}
Add-TestBuildFirewallRule -BuildPath $BuildPath

In order to use the provided script you would need to:

  1. Have PowerShell v4.0 installed on the CI server. This should be the case for Windows 8x or Server 2012
  2. Save the script in a directory that your CI tool has Read & Execute rights to in a file with a .ps1 extension
  3. Run the script as an Administrator - this is required because changing firewall rules is a privileged operation
  4. Have your CI tool execute the script using a command similar to: powershell.exe -ExecutionPolicy Bypass Add-BuildFirewallRule.ps1 -BuildPath %FULL_BUILD_PATH You need to replace %FULL_BUILD_PATH% in the command above with the full path to the built executable - your CI tool should be able to do this fairly easily.

Unblock The Target Port

You can have Windows firewall allow all traffic (or all traffic of a certain protocol) on specific port(s). This would allow your builds (and any other application using that port) to communicate. You may be able to specify that communication should be limited to the local machine using the Windows Firewall with Advanced Security UI to create the rule, but I would still avoid this if possible.

0

Through research I realised I was binding to all addresses on the computer including the external ones - which is what triggered the firewall. I changed the tests to explicitly bind to 127.0.0.1 and the firewall hasn't complained since.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.