1

Question: Is it possible to make a Windows Firewall application exception via command line or any other way?

Why

We have a host running Windows 2016 Server with several Hyper-V VM's also running Windows 2016 Server. One is a DHCP server and one hosts the SQL DB. Windows Active Directory has also been setup on our network.

We have 3rd party developed software that works with an SQL database. On the actual VMs it works perfectly, but on any other client computer on the network we cannot get it to communicate with the VM unless temporarily disabling ALL Windows Firewalls.

We are having issues with Windows Firewall causing some things to not be able to connect, and need to add exceptions to the firewall, but I am not sure where to do it.

Additionally, knowing this will help with another client issue for a VOIP SNOM PA1 system to work. After talking to vendor support and sending them log files, they believe it's also a Windows Firewall restriction causing this issue.

Improve this question
1
  • There’s not enough information here to even know where to start. At the very least a diagram would help.
    – Appleoddity
    Commented May 24, 2020 at 14:36

2 Answers 2

Reset to default
2

Allow executable thru Windows Firewall with Command Line

Setup a Windows Firewall rule with NETSH commands and "allow" a specific application executable inbound and/or outbound on any profile from an elevated command prompt run as administrator with the below syntax or something similar. Then run this as a startup script once or on every startup for workstations/servers.

I assume you will only need the inbound rule applied and will point it to the full path of the executable file you need to allow inbound connections to be accepted from but I've shown an example outbound rule too in case.

Allow App Inbound

netsh advfirewall firewall add rule name="3rd Party Exe Out" dir=in action=allow program="C:\Program Files\CoolCo\Cool3P.exe" enable=yes profile=domain,private,public

Allow App Outbound

netsh advfirewall firewall add rule name="3rd Party Exe Out" dir=out action=allow program="C:\Program Files\CoolCo\Cool3P.exe" enable=yes profile=domain,private,public

Supporting Resources

Improve this answer
2
  • 1
    @Lzypenguin .... For the question regarding the 3rd party app only working when W is fully disabled, I've answered that part of the question. It sounds like the VOIP is really needed detail and maybe a bit too much info. I've provided a solution to the question with that respect though. You can also open specific ports and from specific IP addresses too. Depending on how tight you want your FW allow rule, you can get more secure than the examples I provided. If you trust the exe though to allow anything to/from it to anywhere, then perhaps these examples will suffice. Happy to further adjust.
    – Vomit IT - Chunky Mess Style
    Commented May 26, 2020 at 3:05
  • Allowing access to a PROGRAM on both the SQL VM and the program on the end user computer (the program communicates to the SQL DB on the SQL VM, and the program is installed on both so I was able to add the program as an exception on both ends) ended up solving that. Since the program was on both machines I could point to it. But there are several other programs that wont work, and I have added them to the exception on the end user, and the programs still will not work. They are not running on the server, so I do not know where else to add them as exceptions...
    – Lzypenguin
    Commented May 29, 2020 at 18:00
2

Allow Apps thru Windows Firewall with Advanced Security

You could also go to wf.msc and then add a rule to tell the Windows Firewall to allow a specific app inbound and/or outbound on all profiles.

Instructions

  1. Press enter image description here +R, type in wf.msc and then press Enter.

  2. Click on Inbound Rules and then click on New Rule... to the right

    enter image description here

  3. In the Rule Type options window check the Program option and then press Next

    enter image description here

  4. In the Program options window in the This program path field either browse find or specify the full explicit path of the exe of the apps file which you want to allow through the Windows Firewall and then press Next

    enter image description here

  5. In the Actions options window ensure the Allow this connection option is selected and then press Next

    enter image description here

  6. In the Profile options window ensure that all three options of Domain, Public, and Private are selected and then press Next

    enter image description here

  7. In the Name field type in a name for the new rule and then press Finish

    enter image description here

  8. You should now see the new rule you just created. You could then click on the Outbound Rules option and follow the same steps 1 - 8 as listed above for the app you need to allow outbound connections.

    enter image description here

Just follow these steps for allowing all the incoming and outgoing app rules you need and scale accordingly to prevent Windows Firewall from prompting after each reboot.

Improve this answer
11
  • 1
    @Lzypenguin .... Obviously these example screen shots show the Chrome.exe app in them, but you'd simply replace those with what's applicable in your environment.
    – Vomit IT - Chunky Mess Style
    Commented May 26, 2020 at 3:28
  • Which computer would I do this on. I have tried to do it on the computer I am working on, as well as the DHCP server. I still cannot get the program to communicate.
    – Lzypenguin
    Commented May 29, 2020 at 17:25
  • I was able to resolve the SQL one by adding the program to the exception rule on both end user machine as well as SQL VM. Now we have other programs that are NOT communicating with the VM servers (except to get DHCP IP address) and I cannot get them to work. I have added the program to the exception list on the end user computer, and I still cannot get it to connect.
    – Lzypenguin
    Commented May 29, 2020 at 18:02
  • The pastebin link is pastebin.com/P4PqKLBn The program in question I am currently working on communicates through UDP on Port 30303 and 30304. I have added that to the firewall list.
    – Lzypenguin
    Commented May 29, 2020 at 18:06
  • actually I was mistaken. I must have completely turned off the firewall through group policy on accident. I was able to make it work WHEN i turn off the domain firewall completely on the SQL server. But even after adding the program to the exception it is now not working.
    – Lzypenguin
    Commented May 29, 2020 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .