Configuring Windows XP firewall

Using netsh for configuring the firewall

To disable Windows XP firewall, you have to execute the following:

netsh firewall set opmode disable

To add ports to the exception list:

netsh firewall add portopening [protocol] [port number] [rule name]

[protocol] can be TCP or UDP (remove the brackets when you insert your values).

To add a program to the exception list:

add allowedprogram program = [path] name = [name] mode = [ENABLE|DISABLE] scope = [ALL|SUBNET|CUSTOM] addresses = [addresses] profile = [CURRENT|DOMAIN|STANDARD|ALL]

Everything besides [program] and [name] is optional. You might want to check the article in the MS Windows XP TechCenter for default values and a detailed explanation.

To allow remote administration to the exception list:

netsh firewall set service remoteadmin enable

To allow file and printer sharing for Microsoft networks:

netsh firewall set service fileandprint enable

It is enough to execute those commands only once, as the settings will survive the reboot, so you may use execute="once". If you want to use check conditions to notice if someone has changed a rule, look in HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\ for rules that involve opening particular ports.

Examples

To open e.g. port 22 in the Windows XP firewall, you have to execute the following:

netsh firewall add portopening TCP 22 SSH enable subnet

In packages.xml you should add a line like below:

<package
        id="open-port-22"
        name="Open port 22 on windows firewall"
        revision="1"
        reboot="false"
        notify="false"
        priority="2">      
        
        <install cmd='netsh firewall add portopening TCP 22 SSH enable subnet' />
        
</package>

This is useful if you want to run a SSH server (i.e. freeSSHd), but still want to have your firewall enabled.

To add a rule to open 143/tcp to a particular network and to notice if someone changed your settings, the following can be used:

<!-- Rule present and turned on -->
<package
 id="fw-143-example-on"
 name="Firewall: IMAP example on"
 revision="1"
 reboot="false"
 priority="0">

   <check type="registry" condition="equals" path="HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\143:TCP" value="143:TCP:192.0.2.0/255.255.255.0:Enabled:IMAP example" />

   <install cmd='netsh firewall add portopening TCP 143 "IMAP example" ENABLE CUSTOM "192.0.2.0/255.255.255.0"'>
     <exit code="0" />
   </install>

   <remove cmd='netsh firewall remove portopening TCP 143'>
     <exit code="0" />
   </remove>
</package>

<!-- Rule present but turned off -->
<package
 id="fw-143-example-off"
 name="Firewall: IMAP example off"
 revision="1"
 reboot="false"
 priority="0">

   <check type="logical" condition="not" />
    <!-- Depending on what you're trying to accomplish, you may want to check merely the existence of an entry for 143:TCP -->
    <check type="registry" condition="equals" path="HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\143:TCP" value="143:TCP:192.0.2.0/255.255.255.0:Enabled:IMAP example" />
   </check>

   <install cmd='netsh firewall add portopening TCP 143 "IMAP example" DISABLE CUSTOM "192.0.2.0/255.255.255.0"'>
     <exit code="0" />
   </install>

   <remove cmd='netsh firewall remove portopening TCP 143'>
     <exit code="0" />
   </remove>
</package>