I need to implement a tool which adds and deletes rules in Windows Firewall. The rules can be inbound or outbound, forbidding communication on specified protocols, IPs and ports. I am having trouble with making the design decision on which of the following options I'm aware of to use:

  1. PowerShell, as described e.g. in https://technet.microsoft.com/en-us/library/jj554906(v=wps.630).aspx . The trouble with this option is that (correct me if I'm wrong) it seems it is not supported on Windows 7, while my tool must work on Windows 7, Windows 8(.1), and desirably later versions of Windows. Also, I'm not allowed to use C#, while PowerShell doesn't integrate with C++ except (possibly, I'm not sure) via calling PowerShell process, giving it command line options and reading/writing from/to its output/input streams.
  2. "netsh advfirewall firewall" way. The problem with this option is that Windows 8.1 says that "netsh advfirewall" context is deprecated and may be removed from later versions of Windows. So I'm afraid that taking this way will make my tool not working on Windows 9 or 10.
  3. COM interfaces of Windows firewall, as in these examples https://msdn.microsoft.com/en-us/library/windows/desktop/dd339604(v=vs.85).aspx . The required C++ coding is not a problem, though it may take longer than usage of PowerShell or command line (netsh advfirewall firewall).

Which option would be the best design decision for adding/deleting Windows Firewall rules? Are there other options or advantages/disadvantages of the options I listed?

  • Simply polling for opinion is off-topic. We cannot help you decide. Feel free to ask about a specific implementation problem though, either here or most likely on StackOverflow (which is where programming-related questions belong). – Karan May 30 '15 at 19:10
  • The specific implementation problem is "how to add/delete rules in Windows Firewall" (as the title of the question says) so that the implementation works for all Windows versions starting with Windows 7. The command-line options like PowerShell and "netsh advfirewall firewall" seem to more belong here (system administration), while COM option belongs to StackOverflow. – Serge Rogatch May 31 '15 at 8:05

For Windows 7, the way to do it is different

Everything firewall-related in Server 2008/Vista / Server R2/ Windows 7, is managed through the HNetCfg.FwPolicy2 COM object

from here

If you want to use PowerShell but need to target both versions of the OS, I would say that writing 2 functions would be simplest since you already seem to know how to do it for Windows 8.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.