NSIS Simple Firewall Plugin

[Speed78]

Hi,

I´ve created a firewall plugin to confiurate the windows firewall. This plugin works with Windows XP SP2, Windows 2003 and Windows Vista.

Here the function list:

SimpleFC::EnableDisableFirewall
SimpleFC::IsFirewallEnabled
SimpleFC::AllowDisallowExceptionsNotAllowed SimpleFC::AreExceptionsNotAllowed
SimpleFC::EnableDisableNotifications
SimpleFC::AreNotificationsEnabled
SimpleFC::StartStopFirewallService SimpleFC::IsFirewallServiceRunning
SimpleFC::AddPort
SimpleFC::IsPortAdded
SimpleFC::RemovePort
SimpleFC::IsPortEnabled
SimpleFC::EnableDisablePort
SimpleFC::AddApplication
SimpleFC::IsApplicationAdded
SimpleFC::RemoveApplication
SimpleFC::IsApplicationEnabled SimpleFC::EnableDisableApplication

I think this plugin uses the most functions of the windows firewall.

Heres is a detailed description of the plugin

Any comments, suggestions and questions are welcome...

Best regards

Rainer

[Afrow UK]

Very nice
Have you made a Wiki page?

Stu

[Speed78]

Hi,

thank you. I´ve made a page. On the first post there is a link, but you can use this

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin


Best regards

Rainer

[Backland]

nice, thanks for sharing!

[Joel]

Nice...

[Red Wine]

Certainly I wouldn't feel happy while running an installer on my machine to alter my firewall settings behind my back.
Hopefully this plugin it's able to do its tricks on the weak integrated windows firewall but unable to affect Comodo in my case.

[Brummelchen]

>> I wouldn't feel happy

Same thoughts here...

>> but unable to affect Comodo in my case.

Secure it with a passwort - it would say that is a must for
firewalls and virus scanners to prevent general abuse - also
for 3rd persons.

[Red Wine]

>> Secure it with a passwort

I can assure you that I'm doing all what it needs up to the point that the one who's gonna hack my system should be a REAL good one and not every amateur out there who loves playing with M$ "secured" systems.
Therefore the question is why the REAL good one would ever care about hacking a system like mine?

[Brummelchen]

a simple user machine is not for interests...
so i turned off teh crappy window wall...
i am well protected as you - if someone hack me it will be from inside ^^

[Comm@nder21]

can't see your points:

either any software you run can alter your firewall settings or none. (because you're not using an admin enabled account or secured the fw with a password)

any nsis installer could do that with system.dll as well, the plugin just makes it easier.

a simple user machine is not for interests...

maybe not for an experienced hacker, but for script kiddies trying out their exploits. or for hordes of trojans trying to enlarge their respective botnet.


windows firewall won't protect you against serious attacks, though it can protect you very well against the automated exploitation hacks of trojans and worms.

[Red Wine]

Originally posted by Comm@nder21
can't see your points:

I'm not surprised...

[Speed78]

Hi,

now NSIS Firewall Plugin 1.01 is released. This is a minor update because there are only documentation issues changed. So the plugin DLL is unchanged and it is not really necessary to update this version.

You can download this here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin

Best regards

Rainer

[Speed78]

Hi,

I´ve released a new version of the firewall plugin. This plugin provides more than 10 firewall functions like add icmp exception and so on.

It also supports the Windows Firewall with Advanced Security on Windows Vista operating system now. So now you can add/remove special firewall rules for your application.

The can find the complete changelog, documentation and download file here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin

If you have any questions or comments please let me now.

Best regards

Rainer

[Speed78]

Hi,

I´ve released a new version of the firewall plugin. This version is a bugfix release and fixes a possible endless loop bug.

The can find the complete changelog, documentation and download file here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin


Best regards

Rainer

[ClayDowling]

This is a very cool plugin, and I'll be pointing a co-worker to it shortly. While there's plenty of opportunity for abuse with a plugin like this, it is nice to be able to ask the user if they would like the installer to make necessary adjustments.

[Speed78]

Hi,

I´ve released a new version of the firewall plugin. This version is a release to improve the documentation on the website and in the Readme.txt.

The website provides now a common functions sample script. I think these functions in the section are the most needed functions to create filewall exception in a setup.

The plugin file is unchanged. If you are using version 1.11 you don´t need to update it, except you want the improved documentation .

The can find the complete changelog, documentation and download file here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin


Best regards

Rainer

[Speed78]

Hi,

I´ve released a new version of the firewall plugin. This version is a release to add the changes from the service manager due to the new changes of the NSIS Simple Service Plugin.

The can find the complete changelog, documentation and download file here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin


Best regards

Rainer

[Speed78]

Hi,

I´ve released a new version of the firewall plugin. This version is a release to add the changes from the service manager due to the new changes of the NSIS Simple Service Plugin.

The can find the complete changelog, documentation and download file here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin


Best regards

Rainer

[Speed78]

Hi,

I´ve released a new version of the firewall plugin. This version is a minor release without any bugfixes or new features. But it is compiled without optimazation to avoid a false-positive virusscan.

The can find the complete changelog, documentation and download file here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin


Best regards

Rainer

[Speed78]

Hi,

I´ve released a new version of the firewall plugin. This version is a minor release without any bugfixes or new features. Only the changes from the NSIS Simple Service Plugin are added.

The can find the complete changelog, documentation and download file here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin


Best regards

Rainer

[Speed78]

Hi,

I´ve released a new version of the firewall plugin. This version is a minor release with some bugfixes.

The can find the complete changelog, documentation and download file here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin


Best regards

Rainer

[akatik]

Does it work with 2008 Server?

[TrifonovS]

I have a problem with this plug-in together with NSIS V3.00 and Unicode support.
Without Unicode (Unicode false) the plug-in works fine and returns 0. Here is the code:

PHP Code:

SimpleFC::AddApplication "App name" "C:\My Path\MyApp.exe" 0 2 "" 1
Pop $0 


But when I enable Unicode support (Unicode true), the same code returns 1.
Is there any chance this plug-in to be updated?

[Speed78]

Ole Ole,

Germany has won this fight this evening That are good news... but the bad news are - I'm sorry - there is no chance to update this plugin to Unicode. If you want you can do this on your own... the source code is available

Kind regards

Speed78

[TrifonovS]

I changed this plug-in with liteFirewall and I solved my problems, because liteFirewall has an Unicode version.

[TrifonovS]

I got a problem with liteFirewall plug-in under Windows XP 32-bit version (I haven't tested it under 64-bit version). It simply crashes. This doesn't happen on the other OS above Windows XP. Is there any solution?

[JasonFriday13]

I had a quick look at the source, but it's in Pascal which is a language I don't know or use. If it was in C I might have had a crack at unicode support.

[Afrow UK]

Originally Posted by TrifonovS

I got a problem with liteFirewall plug-in under Windows XP 32-bit version (I haven't tested it under 64-bit version). It simply crashes. This doesn't happen on the other OS above Windows XP. Is there any solution?

So it seems your solution would be to modify SimpleFC yourself to work with Unicode I'm afraid. Either that or find out why liteFirewall is crashing using a debugger.

Stu

[TrifonovS]

I think that I found the reason for the crash of liteFirewall under Windows XP. It was a mistake in my scripts. The path to the applications that I want to exclude from Firewall was wrong. Somehow this cases crash only under Windows XP. When I fixed it, I see no more crashed. But unfortunately I found that the needed applications are still blocked from the Firewall (on all OS). I see the new rules in the Firewall exclude list, but they don't work. I couldn't find the reason (I don't exclude a possibility that I'm doing something wrong).
Meantime I saw that nsisFirewall also have a Unicode version. I used it instead of liteFirewall and now all works well.
For now I have a solution and I won't make more trials.
Thank you for the opinions.

[TrifonovS]

Just a short update from me. nsisFirewall does his job well, but now I need something more that this plug-in doesn't support. A need to enable not specific application, but just a TCP port. So it is really necessary to come back to the SimpleFC. And again, the problem is that it doesn't support Unicode and I'm not good with Pascal. I was desperate and I tried to search in Internet for a solution. Suddenly I found the following http://forums.winamp.com/showthread.php?p=2706895 topic.
There is a macro that converts Unicode to ANSI and can be used like a workaround. Here it is the macro once more:

!define Unicode2Ansi "!insertmacro Unicode2Ansi"

!macro Unicode2Ansi String outVar
System::Call 'kernel32::WideCharToMultiByte(i 0, i 0, w "${String}", i -1, t .s, i ${NSIS_MAX_STRLEN}, i 0, i 0) i'
Pop "${outVar}"
!macroend

After some tests I see no problems to work with existing ANSI variant of this plug-in.
And I have to admit that SimpeFC is the best plug-in for managing the Firewall, it is just pity that his creator don't want to continue with its further development. Anyway, congratulations for the job he have already done...

[Anders]

Have you tried http://nsis.sourceforge.net/CallAnsiPlugin_plug-in ?

[TrifonovS]

No! I'm wandering how I couldn't find this plug-in . I will try it in suitable time, because now my installer is stable.
Thank you for the idea!!!

[Speed78]

Hi,

I've released a new version of the firewall plugin. This version is a minor release with one addion in the "AdvAddRule" function.

The can find the complete changelog, documentation and download file here:

http://nsis.sourceforge.net/NSIS_Simple_Firewall_Plugin


Best regards

Rainer

[TrifonovS]

Still there is no Unicode support ... I hope in next version...

[Andreasx]

Hi,

I have a problem using the plug-in for adding a program in the firewall:
It doesn't work correct, because it only adds a rule for the private network not for the public network.
This is what i wrote:
SimpleFC::AddApplication "Program-Name" "$INSTDIR\program-name.exe" 0 2 "" 1

Am I doing something wrong?

[Speed78]

Dear Andreas,

this belongs to the "old" MS firewall support e.g. for XP. You you are using >= Vista please use "AdvAddRule". Take a look at the "Important Notes"!

Kind regards

Rainer

[Andreasx]

Originally Posted by Speed78

this belongs to the "old" MS firewall support e.g. for XP. You you are using >= Vista please use "AdvAddRule". Take a look at the "Important Notes"!

OK,
it is was bid more complicated, but it worked!

Thank you!!

[TrifonovS]

Hi!

I need some support again. I use the function AdvAddRule and I'm trying to set a rule for all protocols. According to the documentation:

1 - ICMPv4
6 - TCP
17 - UDP
58 - ICMPv6
256 - Any protocol

I have to use value 256 for any protocol. When I call the function it returns 0 (success), but looking in the Firewall settings, I see that the protocol is actually set to 2 (IGMP). I cannot guess what I'm doing wrong. When I try with specific protocol all is OK. Can you help, please?

[TrifonovS]

Short update... I found the problem, but I don't understand it. I'm compiling my installer with Unicode option. We already know that this plug-in doesn't support Unicode, therefore I used the macro that converts Unicode string to ANSI as it was posted above. But I don't do this conversion for values. I thought that it is not necessary, therefore I pass this specific parameter to the function directly... and it didn't work. Now I covert it with the macro and then pass it to the function... and it works well...
I see also another problem. I can not define a group. If I use an empty string, it works. But if I try to define something else (even if I convert it with the macro from Unicode to ANSI), I always get an error from the function. Any ideas?

[Afrow UK]

All variables in NSIS are strings. Therefore all values are passed to plug-ins as strings. The plug-in then converts those values to integer if it needs to.

Stu