NSIS Wiki - User contributions [en]

NSIS Simple Firewall Plugin

2021-05-04T21:30:23Z

Speed78: /* Changelog */

This plugin can be used to configure the Windows firewall. This plugin contains functions to enable, check, add or remove programs or ports to the firewall exception list. It also contains functions for checking the firewall status, enable or disable the firewall and so on.

This plugin is using the MPL License or alternatively the LGPL License.

== Links ==
The ZIP file containing a precompiled plugin DLL (to be saved in NSIS' plugin directory) and the sources.
If you update from a previous version it is strongly '''recommend''' to take look at the changelog.
*Unicode Version: <attach>NSIS_Simple_Firewall_Plugin_Unicode_1.21.zip</attach> (Recommend for >= NSIS 3.x)
*ANSI Version: <attach>NSIS_Simple_Firewall_Plugin_ANSI_1.21.zip</attach>

== Donation ==
If you believe that I am doing a good job and you want to support me please [http://www.speed-soft.de/donation/index.php?language=en donate] any amount via PayPal.

== Short Reference ==

<highlight-nsis>
SimpleFC::EnableDisableFirewall [status]
SimpleFC::IsFirewallEnabled

SimpleFC::AllowDisallowExceptionsNotAllowed [status]
SimpleFC::AreExceptionsNotAllowed

SimpleFC::EnableDisableNotifications [status]
SimpleFC::AreNotificationsEnabled

SimpleFC::StartStopFirewallService [status]
SimpleFC::IsFirewallServiceRunning

SimpleFC::AddPort [port] [name] [protocol] [scope] [ip_version] [remote_addresses] [status]
SimpleFC::IsPortAdded [port] [protocol]
SimpleFC::RemovePort [port] [protocol]

SimpleFC::IsPortEnabled [port] [protocol]
SimpleFC::EnableDisablePort [port] [protocol]

SimpleFC::AddApplication [name] [path] [scope] [ip_version] [remote_addresses] [status]
SimpleFC::IsApplicationAdded [path]
SimpleFC::RemoveApplication [path]

SimpleFC::IsApplicationEnabled [path]
SimpleFC::EnableDisableApplication [path]

SimpleFC::RestoreDefaults

SimpleFC::AllowDisallowIcmpOutboundDestinationUnreachable [status]
SimpleFC::AllowDisallowIcmpRedirect [status]
SimpleFC::AllowDisallowIcmpInboundEchoRequest [status]
SimpleFC::AllowDisallowIcmpOutboundTimeExceeded [status]
SimpleFC::AllowDisallowIcmpOutboundParameterProblem [status]
SimpleFC::AllowDisallowIcmpOutboundSourceQuench [status]
SimpleFC::AllowDisallowIcmpInboundRouterRequest [status]
SimpleFC::AllowDisallowIcmpInboundTimestampRequest [status]
SimpleFC::AllowDisallowIcmpInboundMaskRequest [status]
SimpleFC::AllowDisallowIcmpOutboundPacketTooBig [status]
SimpleFC::IsIcmpTypeAllowed [ip_version] [local_address] [icmp_type]

SimpleFC::AdvAddRule [name] [description] [protocol] [direction]
[status] [profile] [action] [application] [service_name] [icmp_types_and_codes]
[group] [local_ports] [remote_ports] [local_address] [remote_address]
SimpleFC::AdvRemoveRule [name]
SimpleFC::AdvExistsRule [name]
</highlight-nsis>

Parameters:

*port - TCP/UDP port which should be opened/closed
*name - The name of the application/port/rule
*description - Description of the rule
*protocol - One of the following protocol
**1 - ICMPv4
**6 - TCP
**17 - UDP
**58 - ICMPv6
**256 - Any protocol
*scope - One of the following scope
**0 - All networks
**1 - Only local subnets
**2 - Custom scope
**3 - Max scope
**NOTE: If you use custom you must define remote_addresses
*ip_version
**0 - IPv4
**1 - IPv6
**2 - Any version
*icmp_type
**3 - Outbound Destination Unreachable (ICMPv4)
**4 - Outbound Source Quench (ICMPv4)
**5 - Redirect (ICMPv4)
**8 - Inbound Echo Request (ICMPv4)
**9 - Inbound Router Request (ICMPv4)
**11 - Outbound Time Exceeded (ICMPv4)
**12 - Outbound Parameter Problem (ICMPv4)
**13 - Inbound Timespamp Request (ICMPv4)
**17 - Inbound Mask Request (ICMPv4)
**1 - Outbound Destination Unreachable (ICMPv6)
**2 - Outbound Packet Too Big (ICMPv6)
**3 - Outbound Time Exceeded (ICMPv6)
**4 - Outbound Parameter Problem (ICMPv6)
**128 - Inbound Echo Request (ICMPv6)
**137 - Redirect (ICMPv6)
*direction
**1 - In
**2 - Out
*profile
**1 - Domain
**2 - Private
**4 - Public
**2147483647 - All profiles
*action
**0 - Block
**1 - Allow
*application - Path of the application (can be empty)
servicename - Specifies the service name property of the application (can be empty).
**'''Note''': A serviceName value of "*" indicates that a service, not an application, must be sending or receiving traffic.
*icmp_types_and_codes - Specified icmp types and codes (can be empty)
*group - Put the rule in this specified group (can be empty)
**'''Note''': On Vista the group must the a resource string in a exe/dll e.g. "@C:\Program Files\My Application\myapp.exe,-10000". On all other supported operating systems it can be a string value.
*local_ports - Local ports (The protocol property must be set before - Otherwise can be empty)
**'''Note''': The following port keywords are valid addionally: "RPC", "RPC-EPMap", "Teredo", "IPTLSIn", "IPHTTPSIn" and "Ply2Disc"
*remote_ports - Remote ports (The protocol property must be set before - Otherwise can be empty)
**'''Note''': The following port keywords are valid addionally: "RPC", "RPC-EPMap", "Teredo", "IPTLSIn", "IPHTTPSIn" and "Ply2Disc"
*local_address - Local addresses from which the port can listen for traffic (can be empty)
*remote_address - Remote addresses from which the port can listen for traffic (can be empty)
*status - Status of the port, application, rule, firewall or service for example enabled/disabled, start/stop or allow/disallow
**0 - Disabled, stop or disallow
**1 - Enabled, start, or allow

== The Sample Script ==
In this script you can find the two most used functions. If you are searching for some special firewall exceptions please look at "The Sample Script (All Functions)".
<highlight-nsis>
; Add an application to the firewall exception list - All Networks - All IP Version - Enabled
SimpleFC::AddApplication "My Application" "PathToApplication" 0 2 "" 1
Pop $0 ; return error(1)/success(0)

; Remove an application from the firewall exception list
SimpleFC::RemoveApplication "PathToApplication"
Pop $0 ; return error(1)/success(0)
</highlight-nsis>

== The Sample Script (All Functions) ==
In this script you can find the examples of all functions provided by this plugin.

<highlight-nsis>

; Add the port 37/TCP to the firewall exception list - All Networks - All IP Version - Enabled
SimpleFC::AddPort 37 "My Application" 6 0 2 "" 1
Pop $0 ; return error(1)/success(0)

; Check if the port 37/TCP is added to the firewall exception list
SimpleFC::IsPortAdded 37 6
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Added/0=Not added

; Remove the port 37/TCP from the firewall exception list
SimpleFC::RemovePort 37 6
Pop $0 ; return error(1)/success(0)

; Check if the port 37/TCP is enabled/disabled
SimpleFC::IsPortEnabled 37 6
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Not enabled

; Disable the port 37/TCP
SimpleFC::EnableDisablePort 37 6 0
Pop $0 ; return error(1)/success(0)

; Enable the port 37/TCP
SimpleFC::EnableDisablePort 37 6 1
Pop $0 ; return error(1)/success(0)

; Check if an application is enabled/disabled
SimpleFC::IsApplicationEnabled "PathToApplication"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Not enabled

; Disable the application
SimpleFC::EnableDisableApplication "PathToApplication" 0
Pop $0 ; return error(1)/success(0)

; Enable the application
SimpleFC::EnableDisableApplication "PathToApplication" 1
Pop $0 ; return error(1)/success(0)

; Add an application to the firewall exception list - All Networks - All IP Version - Enabled
SimpleFC::AddApplication "My Application" "PathToApplication" 0 2 "" 1
Pop $0 ; return error(1)/success(0)

; Check if the application is added to the firewall exception list
SimpleFC::IsApplicationAdded "PathToApplication"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Added/0=Not added

; Remove an application from the firewall exception list
SimpleFC::RemoveApplication "PathToApplication"
Pop $0 ; return error(1)/success(0)

; Disable the windows firewall
SimpleFC::EnableDisableFirewall 0
Pop $0 ; return error(1)/success(0)

; Enable the windows firewall
SimpleFC::EnableDisableFirewall 1
Pop $0 ; return error(1)/success(0)

; Check if the firewall is enabled
SimpleFC::IsFirewallEnabled
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Disabled

; Enable exceptions are not allowed on the windows firewall
SimpleFC::AllowDisallowExceptionsNotAllowed 1
Pop $0 ; return error(1)/success(0)

; Disable exceptions are not allowed on the windows firewall
SimpleFC::AllowDisallowExceptionsNotAllowed 0
Pop $0 ; return error(1)/success(0)

; Check if exceptions are not allowed
SimpleFC::AreExceptionsNotAllowed
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Exceptions are not allowed is
; activated/0=Exception are not allowed is deactivated

; Enable notifications on the windows firewall
SimpleFC::EnableDisableNotifications 1

; Disable notifications on the windows firewall
SimpleFC::EnableDisableNotifications 0
Pop $0 ; return error(1)/success(0)

; Check if notifications are enabled/disabled
SimpleFC::AreNotificationsEnabled
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Disabled

; Starts the windows firewall service
SimpleFC::StartStopFirewallService 1
Pop $0 ; return error(1)/success(0)

; Stops the windows firewall service
SimpleFC::StartStopFirewallService 0
Pop $0 ; return error(1)/success(0)

; Check if windows firewall service is running
SimpleFC::IsFirewallServiceRunning
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=IsRunning/0=Not Running

; Sets the windows firewall to default settings
SimpleFC::RestoreDefaults
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound destination unreachable state
SimpleFC::AllowDisallowIcmpOutboundDestinationUnreachable 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP redirect state
SimpleFC::AllowDisallowIcmpRedirect 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound echo request
SimpleFC::AllowDisallowIcmpInboundEchoRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound time exceeded
SimpleFC::AllowDisallowIcmpOutboundTimeExceeded 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound parameter problem
SimpleFC::AllowDisallowIcmpOutboundParameterProblem 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound source quench
SimpleFC::AllowDisallowIcmpOutboundSourceQuench 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound router request
SimpleFC::AllowDisallowIcmpInboundRouterRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound timestamp request
SimpleFC::AllowDisallowIcmpInboundTimestampRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound mask request
SimpleFC::AllowDisallowIcmpInboundMaskRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound packet too big
SimpleFC::AllowDisallowIcmpOutboundPacketTooBig 1
Pop $0 ; return error(1)/success(0)

; Check if ICMPv4 echo request is allowed
SimpleFC::IsIcmpTypeAllowed "0" "" "8"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Restricted/0=Not restricted
Pop $2 ; return 1=Allowed/0=Not allowed

; Some example rules for the windows firewall with advanced security.
; Please note this functions are very powerful, so for a detailed
; description please read the windows firewall with advanced
; security api reference:
; http://msdn2.microsoft.com/en-us/library/aa365309.aspx

; Adds an ICMPv4 rule to allow incoming echo reply messages (IcmpCodeAndType = 0:0)
SimpleFC::AdvAddRule "Echo-Reply (ICMPv4 incoming)" \
"Allows incoming Echo Replies messages." "1" "1" "1" "7" "1" "" \
"" "0:0" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Adds an ICMPv4 rule to allow incoming echo request messages (IcmpCodeAndType = 8:0)
SimpleFC::AdvAddRule "Echo-Request (ICMPv4 incoming)" \
"Allows incoming ICMP Echo messages." "1" "1" "1" "7" "1" "" \
"" "8:0" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Add an application rule to allow incoming TCP access on this application
SimpleFC::AdvAddRule "Incoming requests (TCP incoming)" \
"Allows incoming requests." "6" "1" "1" "7" "1" "PathToApplication" \
"" "" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Add an application rule to allow incoming UDP access on this application
SimpleFC::AdvAddRule "Incoming requests (UDP incoming)" \
"Allows incoming requests." "17" "1" "1" "7" "1" "PathToApplication" \
"" "" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Removes a firewall rule
SimpleFC::AdvRemoveRule "Incoming requests (UDP incoming)"
Pop $0 ; return error(1)/success(0)

; Check if the firewall exists
SimpleFC::AdvExistsRule "Incoming requests (UDP incoming)"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Exists/0=DoesnÂ´t exists
</highlight-nsis>

== Changelog ==
*Version 1.21 (Unicode) (2021-05-04)
**Unicode Version added with the same functions like the ANSI version.
*Version 1.21 (ANSI) (2021-05-04)
**SimpleFC::StartStopFirewallService return now correct false if the service cannot be stopped / started. Hint: In Windows 10 the firewall service is part of the Windows Defender and cannot be stopped / started.
*Version 1.20 (ANSI) (2014-06-12)
**Added "ServiceName" parameter to function "AdvAddRule"
**Documentation updated
*Version 1.19 (ANSI) (2012-07-16)
**Documentation updated
*Version 1.18 (ANSI) (2010-02-23)
**Documentation updated
*Version 1.17 (ANSI) (2009-09-05)
**Added changes from the service manager
**The following functions are now case insensitive:
***SimpleFC::IsApplicationAdded
***SimpleFC::IsApplicationEnabled
***SimpleFC::EnableDisableApplication
***SimpleFC::AdvExistsRule
*Version 1.16 (ANSI) (2009-04-13)
**Added changes from the service manager
*Version 1.15 (ANSI) (2008-08-18)
**Added changes from the service manager and checked removed compiler optimization to avoid a false-positive virusscan.
*Version 1.14 (ANSI) (2008-02-05)
** Added changes from the service manager
*Version 1.13 (ANSI) (2008-01-29)
** Added changes from the service manager
*Version 1.12 (ANSI) (2007-11-13)
** Fixed wrong documentation about SimpleFC::AdvExistsRule
*Version 1.11 (ANSI) (2007-08-07)
** Fixed potential endless loop bug in SimpleFC::StartStopFirewallService
*Version 1.10 (ANSI) (2007-08-02)
** Added default firewall functions:
*** SimpleFC::RestoreDefaults
*** SimpleFC::AllowDisallowIcmpOutboundDestinationUnreachable
*** SimpleFC::AllowDisallowIcmpRedirect
*** SimpleFC::AllowDisallowIcmpInboundEchoRequest
*** SimpleFC::AllowDisallowIcmpOutboundTimeExceeded
*** SimpleFC::AllowDisallowIcmpOutboundParameterProblem
*** SimpleFC::AllowDisallowIcmpOutboundSourceQuench
*** SimpleFC::AllowDisallowIcmpInboundRouterRequest
*** SimpleFC::AllowDisallowIcmpInboundTimestampRequest
*** SimpleFC::AllowDisallowIcmpInboundMaskRequest
*** SimpleFC::AllowDisallowIcmpOutboundPacketTooBig
*** SimpleFC::IsIcmpTypeAllowed
** Added functions for Windows Firewall with Advanced Security
*** SimpleFC::AdvAddRule
*** SimpleFC::AdvRemoveRule
*** SimpleFC::AdvExistsRule
*Version 1.01 (ANSI) (2007-07-05)
**Changed missing documentation about the function SimpleFC::IsFirewallEnabled
*Version 1.0 (ANSI) (2007-05-02)
**First offical version

== Important Notes ==

*This plugin is running on Windows XP SP2, Windows 2003, Windows Vista, Windows 7, Windows 8, Windows Server 2012, Windows Server 8.1, Windows Server 2012 R2
*Before you execute some plugin commands it is recommend to check for windows firewall service is running (SimpleFC::IsFirewallServiceRunning).
*All functions with the prefix "Adv" are only for Windows Firewall with Advanced Security (Windows Vista and above). It is recommend to use these functions on the operating systems which supports the Windows Firewall with Advanced Security. Nethertheless, the default functions without the prefix "Adv" can be used.
* If you have any suggestions, comments or questions please mail me: mailto:rainer@speed-soft.de

[[Category:Plugins]]

NSIS Simple Firewall Plugin

2021-05-04T21:26:47Z

Speed78: /* Links */

This plugin can be used to configure the Windows firewall. This plugin contains functions to enable, check, add or remove programs or ports to the firewall exception list. It also contains functions for checking the firewall status, enable or disable the firewall and so on.

This plugin is using the MPL License or alternatively the LGPL License.

== Links ==
The ZIP file containing a precompiled plugin DLL (to be saved in NSIS' plugin directory) and the sources.
If you update from a previous version it is strongly '''recommend''' to take look at the changelog.
*Unicode Version: <attach>NSIS_Simple_Firewall_Plugin_Unicode_1.21.zip</attach> (Recommend for >= NSIS 3.x)
*ANSI Version: <attach>NSIS_Simple_Firewall_Plugin_ANSI_1.21.zip</attach>

== Donation ==
If you believe that I am doing a good job and you want to support me please [http://www.speed-soft.de/donation/index.php?language=en donate] any amount via PayPal.

== Short Reference ==

<highlight-nsis>
SimpleFC::EnableDisableFirewall [status]
SimpleFC::IsFirewallEnabled

SimpleFC::AllowDisallowExceptionsNotAllowed [status]
SimpleFC::AreExceptionsNotAllowed

SimpleFC::EnableDisableNotifications [status]
SimpleFC::AreNotificationsEnabled

SimpleFC::StartStopFirewallService [status]
SimpleFC::IsFirewallServiceRunning

SimpleFC::AddPort [port] [name] [protocol] [scope] [ip_version] [remote_addresses] [status]
SimpleFC::IsPortAdded [port] [protocol]
SimpleFC::RemovePort [port] [protocol]

SimpleFC::IsPortEnabled [port] [protocol]
SimpleFC::EnableDisablePort [port] [protocol]

SimpleFC::AddApplication [name] [path] [scope] [ip_version] [remote_addresses] [status]
SimpleFC::IsApplicationAdded [path]
SimpleFC::RemoveApplication [path]

SimpleFC::IsApplicationEnabled [path]
SimpleFC::EnableDisableApplication [path]

SimpleFC::RestoreDefaults

SimpleFC::AllowDisallowIcmpOutboundDestinationUnreachable [status]
SimpleFC::AllowDisallowIcmpRedirect [status]
SimpleFC::AllowDisallowIcmpInboundEchoRequest [status]
SimpleFC::AllowDisallowIcmpOutboundTimeExceeded [status]
SimpleFC::AllowDisallowIcmpOutboundParameterProblem [status]
SimpleFC::AllowDisallowIcmpOutboundSourceQuench [status]
SimpleFC::AllowDisallowIcmpInboundRouterRequest [status]
SimpleFC::AllowDisallowIcmpInboundTimestampRequest [status]
SimpleFC::AllowDisallowIcmpInboundMaskRequest [status]
SimpleFC::AllowDisallowIcmpOutboundPacketTooBig [status]
SimpleFC::IsIcmpTypeAllowed [ip_version] [local_address] [icmp_type]

SimpleFC::AdvAddRule [name] [description] [protocol] [direction]
[status] [profile] [action] [application] [service_name] [icmp_types_and_codes]
[group] [local_ports] [remote_ports] [local_address] [remote_address]
SimpleFC::AdvRemoveRule [name]
SimpleFC::AdvExistsRule [name]
</highlight-nsis>

Parameters:

*port - TCP/UDP port which should be opened/closed
*name - The name of the application/port/rule
*description - Description of the rule
*protocol - One of the following protocol
**1 - ICMPv4
**6 - TCP
**17 - UDP
**58 - ICMPv6
**256 - Any protocol
*scope - One of the following scope
**0 - All networks
**1 - Only local subnets
**2 - Custom scope
**3 - Max scope
**NOTE: If you use custom you must define remote_addresses
*ip_version
**0 - IPv4
**1 - IPv6
**2 - Any version
*icmp_type
**3 - Outbound Destination Unreachable (ICMPv4)
**4 - Outbound Source Quench (ICMPv4)
**5 - Redirect (ICMPv4)
**8 - Inbound Echo Request (ICMPv4)
**9 - Inbound Router Request (ICMPv4)
**11 - Outbound Time Exceeded (ICMPv4)
**12 - Outbound Parameter Problem (ICMPv4)
**13 - Inbound Timespamp Request (ICMPv4)
**17 - Inbound Mask Request (ICMPv4)
**1 - Outbound Destination Unreachable (ICMPv6)
**2 - Outbound Packet Too Big (ICMPv6)
**3 - Outbound Time Exceeded (ICMPv6)
**4 - Outbound Parameter Problem (ICMPv6)
**128 - Inbound Echo Request (ICMPv6)
**137 - Redirect (ICMPv6)
*direction
**1 - In
**2 - Out
*profile
**1 - Domain
**2 - Private
**4 - Public
**2147483647 - All profiles
*action
**0 - Block
**1 - Allow
*application - Path of the application (can be empty)
servicename - Specifies the service name property of the application (can be empty).
**'''Note''': A serviceName value of "*" indicates that a service, not an application, must be sending or receiving traffic.
*icmp_types_and_codes - Specified icmp types and codes (can be empty)
*group - Put the rule in this specified group (can be empty)
**'''Note''': On Vista the group must the a resource string in a exe/dll e.g. "@C:\Program Files\My Application\myapp.exe,-10000". On all other supported operating systems it can be a string value.
*local_ports - Local ports (The protocol property must be set before - Otherwise can be empty)
**'''Note''': The following port keywords are valid addionally: "RPC", "RPC-EPMap", "Teredo", "IPTLSIn", "IPHTTPSIn" and "Ply2Disc"
*remote_ports - Remote ports (The protocol property must be set before - Otherwise can be empty)
**'''Note''': The following port keywords are valid addionally: "RPC", "RPC-EPMap", "Teredo", "IPTLSIn", "IPHTTPSIn" and "Ply2Disc"
*local_address - Local addresses from which the port can listen for traffic (can be empty)
*remote_address - Remote addresses from which the port can listen for traffic (can be empty)
*status - Status of the port, application, rule, firewall or service for example enabled/disabled, start/stop or allow/disallow
**0 - Disabled, stop or disallow
**1 - Enabled, start, or allow

== The Sample Script ==
In this script you can find the two most used functions. If you are searching for some special firewall exceptions please look at "The Sample Script (All Functions)".
<highlight-nsis>
; Add an application to the firewall exception list - All Networks - All IP Version - Enabled
SimpleFC::AddApplication "My Application" "PathToApplication" 0 2 "" 1
Pop $0 ; return error(1)/success(0)

; Remove an application from the firewall exception list
SimpleFC::RemoveApplication "PathToApplication"
Pop $0 ; return error(1)/success(0)
</highlight-nsis>

== The Sample Script (All Functions) ==
In this script you can find the examples of all functions provided by this plugin.

<highlight-nsis>

; Add the port 37/TCP to the firewall exception list - All Networks - All IP Version - Enabled
SimpleFC::AddPort 37 "My Application" 6 0 2 "" 1
Pop $0 ; return error(1)/success(0)

; Check if the port 37/TCP is added to the firewall exception list
SimpleFC::IsPortAdded 37 6
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Added/0=Not added

; Remove the port 37/TCP from the firewall exception list
SimpleFC::RemovePort 37 6
Pop $0 ; return error(1)/success(0)

; Check if the port 37/TCP is enabled/disabled
SimpleFC::IsPortEnabled 37 6
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Not enabled

; Disable the port 37/TCP
SimpleFC::EnableDisablePort 37 6 0
Pop $0 ; return error(1)/success(0)

; Enable the port 37/TCP
SimpleFC::EnableDisablePort 37 6 1
Pop $0 ; return error(1)/success(0)

; Check if an application is enabled/disabled
SimpleFC::IsApplicationEnabled "PathToApplication"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Not enabled

; Disable the application
SimpleFC::EnableDisableApplication "PathToApplication" 0
Pop $0 ; return error(1)/success(0)

; Enable the application
SimpleFC::EnableDisableApplication "PathToApplication" 1
Pop $0 ; return error(1)/success(0)

; Add an application to the firewall exception list - All Networks - All IP Version - Enabled
SimpleFC::AddApplication "My Application" "PathToApplication" 0 2 "" 1
Pop $0 ; return error(1)/success(0)

; Check if the application is added to the firewall exception list
SimpleFC::IsApplicationAdded "PathToApplication"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Added/0=Not added

; Remove an application from the firewall exception list
SimpleFC::RemoveApplication "PathToApplication"
Pop $0 ; return error(1)/success(0)

; Disable the windows firewall
SimpleFC::EnableDisableFirewall 0
Pop $0 ; return error(1)/success(0)

; Enable the windows firewall
SimpleFC::EnableDisableFirewall 1
Pop $0 ; return error(1)/success(0)

; Check if the firewall is enabled
SimpleFC::IsFirewallEnabled
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Disabled

; Enable exceptions are not allowed on the windows firewall
SimpleFC::AllowDisallowExceptionsNotAllowed 1
Pop $0 ; return error(1)/success(0)

; Disable exceptions are not allowed on the windows firewall
SimpleFC::AllowDisallowExceptionsNotAllowed 0
Pop $0 ; return error(1)/success(0)

; Check if exceptions are not allowed
SimpleFC::AreExceptionsNotAllowed
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Exceptions are not allowed is
; activated/0=Exception are not allowed is deactivated

; Enable notifications on the windows firewall
SimpleFC::EnableDisableNotifications 1

; Disable notifications on the windows firewall
SimpleFC::EnableDisableNotifications 0
Pop $0 ; return error(1)/success(0)

; Check if notifications are enabled/disabled
SimpleFC::AreNotificationsEnabled
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Disabled

; Starts the windows firewall service
SimpleFC::StartStopFirewallService 1
Pop $0 ; return error(1)/success(0)

; Stops the windows firewall service
SimpleFC::StartStopFirewallService 0
Pop $0 ; return error(1)/success(0)

; Check if windows firewall service is running
SimpleFC::IsFirewallServiceRunning
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=IsRunning/0=Not Running

; Sets the windows firewall to default settings
SimpleFC::RestoreDefaults
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound destination unreachable state
SimpleFC::AllowDisallowIcmpOutboundDestinationUnreachable 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP redirect state
SimpleFC::AllowDisallowIcmpRedirect 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound echo request
SimpleFC::AllowDisallowIcmpInboundEchoRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound time exceeded
SimpleFC::AllowDisallowIcmpOutboundTimeExceeded 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound parameter problem
SimpleFC::AllowDisallowIcmpOutboundParameterProblem 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound source quench
SimpleFC::AllowDisallowIcmpOutboundSourceQuench 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound router request
SimpleFC::AllowDisallowIcmpInboundRouterRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound timestamp request
SimpleFC::AllowDisallowIcmpInboundTimestampRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound mask request
SimpleFC::AllowDisallowIcmpInboundMaskRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound packet too big
SimpleFC::AllowDisallowIcmpOutboundPacketTooBig 1
Pop $0 ; return error(1)/success(0)

; Check if ICMPv4 echo request is allowed
SimpleFC::IsIcmpTypeAllowed "0" "" "8"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Restricted/0=Not restricted
Pop $2 ; return 1=Allowed/0=Not allowed

; Some example rules for the windows firewall with advanced security.
; Please note this functions are very powerful, so for a detailed
; description please read the windows firewall with advanced
; security api reference:
; http://msdn2.microsoft.com/en-us/library/aa365309.aspx

; Adds an ICMPv4 rule to allow incoming echo reply messages (IcmpCodeAndType = 0:0)
SimpleFC::AdvAddRule "Echo-Reply (ICMPv4 incoming)" \
"Allows incoming Echo Replies messages." "1" "1" "1" "7" "1" "" \
"" "0:0" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Adds an ICMPv4 rule to allow incoming echo request messages (IcmpCodeAndType = 8:0)
SimpleFC::AdvAddRule "Echo-Request (ICMPv4 incoming)" \
"Allows incoming ICMP Echo messages." "1" "1" "1" "7" "1" "" \
"" "8:0" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Add an application rule to allow incoming TCP access on this application
SimpleFC::AdvAddRule "Incoming requests (TCP incoming)" \
"Allows incoming requests." "6" "1" "1" "7" "1" "PathToApplication" \
"" "" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Add an application rule to allow incoming UDP access on this application
SimpleFC::AdvAddRule "Incoming requests (UDP incoming)" \
"Allows incoming requests." "17" "1" "1" "7" "1" "PathToApplication" \
"" "" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Removes a firewall rule
SimpleFC::AdvRemoveRule "Incoming requests (UDP incoming)"
Pop $0 ; return error(1)/success(0)

; Check if the firewall exists
SimpleFC::AdvExistsRule "Incoming requests (UDP incoming)"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Exists/0=DoesnÂ´t exists
</highlight-nsis>

== Changelog ==
*Version 1.20 (2014-06-12)
**Added "ServiceName" parameter to function "AdvAddRule"
**Documentation updated
*Version 1.19 (2012-07-16)
**Documentation updated
*Version 1.18 (2010-02-23)
**Documentation updated
*Version 1.17 (2009-09-05)
**Added changes from the service manager
**The following functions are now case insensitive:
***SimpleFC::IsApplicationAdded
***SimpleFC::IsApplicationEnabled
***SimpleFC::EnableDisableApplication
***SimpleFC::AdvExistsRule
*Version 1.16 (2009-04-13)
**Added changes from the service manager
*Version 1.15 (2008-08-18)
**Added changes from the service manager and checked removed compiler optimization to avoid a false-positive virusscan.
*Version 1.14 (2008-02-05)
** Added changes from the service manager
*Version 1.13 (2008-01-29)
** Added changes from the service manager
*Version 1.12 (2007-11-13)
** Fixed wrong documentation about SimpleFC::AdvExistsRule
*Version 1.11 (2007-08-07)
** Fixed potential endless loop bug in SimpleFC::StartStopFirewallService
*Version 1.10 (2007-08-02)
** Added default firewall functions:
*** SimpleFC::RestoreDefaults
*** SimpleFC::AllowDisallowIcmpOutboundDestinationUnreachable
*** SimpleFC::AllowDisallowIcmpRedirect
*** SimpleFC::AllowDisallowIcmpInboundEchoRequest
*** SimpleFC::AllowDisallowIcmpOutboundTimeExceeded
*** SimpleFC::AllowDisallowIcmpOutboundParameterProblem
*** SimpleFC::AllowDisallowIcmpOutboundSourceQuench
*** SimpleFC::AllowDisallowIcmpInboundRouterRequest
*** SimpleFC::AllowDisallowIcmpInboundTimestampRequest
*** SimpleFC::AllowDisallowIcmpInboundMaskRequest
*** SimpleFC::AllowDisallowIcmpOutboundPacketTooBig
*** SimpleFC::IsIcmpTypeAllowed
** Added functions for Windows Firewall with Advanced Security
*** SimpleFC::AdvAddRule
*** SimpleFC::AdvRemoveRule
*** SimpleFC::AdvExistsRule
*Version 1.01 (2007-07-05)
**Changed missing documentation about the function SimpleFC::IsFirewallEnabled
*Version 1.0 (2007-05-02)
**First offical version

== Important Notes ==

*This plugin is running on Windows XP SP2, Windows 2003, Windows Vista, Windows 7, Windows 8, Windows Server 2012, Windows Server 8.1, Windows Server 2012 R2
*Before you execute some plugin commands it is recommend to check for windows firewall service is running (SimpleFC::IsFirewallServiceRunning).
*All functions with the prefix "Adv" are only for Windows Firewall with Advanced Security (Windows Vista and above). It is recommend to use these functions on the operating systems which supports the Windows Firewall with Advanced Security. Nethertheless, the default functions without the prefix "Adv" can be used.
* If you have any suggestions, comments or questions please mail me: mailto:rainer@speed-soft.de

[[Category:Plugins]]

NSIS Simple Firewall Plugin

2021-05-04T21:26:18Z

Speed78: /* Links */

This plugin can be used to configure the Windows firewall. This plugin contains functions to enable, check, add or remove programs or ports to the firewall exception list. It also contains functions for checking the firewall status, enable or disable the firewall and so on.

This plugin is using the MPL License or alternatively the LGPL License.

== Links ==
The ZIP file containing a precompiled plugin DLL (to be saved in NSIS' plugin directory) and the sources.
If you update from a previous version it is strongly '''recommend''' to take look at the changelog.
*Unicode Version: <attach>NSIS_Simple_Firewall_Plugin_Unicode_1.21.zip</attach> (Recommend for >= NSIS 3.x)
*ANSI Version: <attach>NSIS_Simple_Firewall_Plugin_ANSI_1.21.zip</attach>

== Short Reference ==

<highlight-nsis>
SimpleFC::EnableDisableFirewall [status]
SimpleFC::IsFirewallEnabled

SimpleFC::AllowDisallowExceptionsNotAllowed [status]
SimpleFC::AreExceptionsNotAllowed

SimpleFC::EnableDisableNotifications [status]
SimpleFC::AreNotificationsEnabled

SimpleFC::StartStopFirewallService [status]
SimpleFC::IsFirewallServiceRunning

SimpleFC::AddPort [port] [name] [protocol] [scope] [ip_version] [remote_addresses] [status]
SimpleFC::IsPortAdded [port] [protocol]
SimpleFC::RemovePort [port] [protocol]

SimpleFC::IsPortEnabled [port] [protocol]
SimpleFC::EnableDisablePort [port] [protocol]

SimpleFC::AddApplication [name] [path] [scope] [ip_version] [remote_addresses] [status]
SimpleFC::IsApplicationAdded [path]
SimpleFC::RemoveApplication [path]

SimpleFC::IsApplicationEnabled [path]
SimpleFC::EnableDisableApplication [path]

SimpleFC::RestoreDefaults

SimpleFC::AllowDisallowIcmpOutboundDestinationUnreachable [status]
SimpleFC::AllowDisallowIcmpRedirect [status]
SimpleFC::AllowDisallowIcmpInboundEchoRequest [status]
SimpleFC::AllowDisallowIcmpOutboundTimeExceeded [status]
SimpleFC::AllowDisallowIcmpOutboundParameterProblem [status]
SimpleFC::AllowDisallowIcmpOutboundSourceQuench [status]
SimpleFC::AllowDisallowIcmpInboundRouterRequest [status]
SimpleFC::AllowDisallowIcmpInboundTimestampRequest [status]
SimpleFC::AllowDisallowIcmpInboundMaskRequest [status]
SimpleFC::AllowDisallowIcmpOutboundPacketTooBig [status]
SimpleFC::IsIcmpTypeAllowed [ip_version] [local_address] [icmp_type]

SimpleFC::AdvAddRule [name] [description] [protocol] [direction]
[status] [profile] [action] [application] [service_name] [icmp_types_and_codes]
[group] [local_ports] [remote_ports] [local_address] [remote_address]
SimpleFC::AdvRemoveRule [name]
SimpleFC::AdvExistsRule [name]
</highlight-nsis>

Parameters:

*port - TCP/UDP port which should be opened/closed
*name - The name of the application/port/rule
*description - Description of the rule
*protocol - One of the following protocol
**1 - ICMPv4
**6 - TCP
**17 - UDP
**58 - ICMPv6
**256 - Any protocol
*scope - One of the following scope
**0 - All networks
**1 - Only local subnets
**2 - Custom scope
**3 - Max scope
**NOTE: If you use custom you must define remote_addresses
*ip_version
**0 - IPv4
**1 - IPv6
**2 - Any version
*icmp_type
**3 - Outbound Destination Unreachable (ICMPv4)
**4 - Outbound Source Quench (ICMPv4)
**5 - Redirect (ICMPv4)
**8 - Inbound Echo Request (ICMPv4)
**9 - Inbound Router Request (ICMPv4)
**11 - Outbound Time Exceeded (ICMPv4)
**12 - Outbound Parameter Problem (ICMPv4)
**13 - Inbound Timespamp Request (ICMPv4)
**17 - Inbound Mask Request (ICMPv4)
**1 - Outbound Destination Unreachable (ICMPv6)
**2 - Outbound Packet Too Big (ICMPv6)
**3 - Outbound Time Exceeded (ICMPv6)
**4 - Outbound Parameter Problem (ICMPv6)
**128 - Inbound Echo Request (ICMPv6)
**137 - Redirect (ICMPv6)
*direction
**1 - In
**2 - Out
*profile
**1 - Domain
**2 - Private
**4 - Public
**2147483647 - All profiles
*action
**0 - Block
**1 - Allow
*application - Path of the application (can be empty)
servicename - Specifies the service name property of the application (can be empty).
**'''Note''': A serviceName value of "*" indicates that a service, not an application, must be sending or receiving traffic.
*icmp_types_and_codes - Specified icmp types and codes (can be empty)
*group - Put the rule in this specified group (can be empty)
**'''Note''': On Vista the group must the a resource string in a exe/dll e.g. "@C:\Program Files\My Application\myapp.exe,-10000". On all other supported operating systems it can be a string value.
*local_ports - Local ports (The protocol property must be set before - Otherwise can be empty)
**'''Note''': The following port keywords are valid addionally: "RPC", "RPC-EPMap", "Teredo", "IPTLSIn", "IPHTTPSIn" and "Ply2Disc"
*remote_ports - Remote ports (The protocol property must be set before - Otherwise can be empty)
**'''Note''': The following port keywords are valid addionally: "RPC", "RPC-EPMap", "Teredo", "IPTLSIn", "IPHTTPSIn" and "Ply2Disc"
*local_address - Local addresses from which the port can listen for traffic (can be empty)
*remote_address - Remote addresses from which the port can listen for traffic (can be empty)
*status - Status of the port, application, rule, firewall or service for example enabled/disabled, start/stop or allow/disallow
**0 - Disabled, stop or disallow
**1 - Enabled, start, or allow

== The Sample Script ==
In this script you can find the two most used functions. If you are searching for some special firewall exceptions please look at "The Sample Script (All Functions)".
<highlight-nsis>
; Add an application to the firewall exception list - All Networks - All IP Version - Enabled
SimpleFC::AddApplication "My Application" "PathToApplication" 0 2 "" 1
Pop $0 ; return error(1)/success(0)

; Remove an application from the firewall exception list
SimpleFC::RemoveApplication "PathToApplication"
Pop $0 ; return error(1)/success(0)
</highlight-nsis>

== The Sample Script (All Functions) ==
In this script you can find the examples of all functions provided by this plugin.

<highlight-nsis>

; Add the port 37/TCP to the firewall exception list - All Networks - All IP Version - Enabled
SimpleFC::AddPort 37 "My Application" 6 0 2 "" 1
Pop $0 ; return error(1)/success(0)

; Check if the port 37/TCP is added to the firewall exception list
SimpleFC::IsPortAdded 37 6
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Added/0=Not added

; Remove the port 37/TCP from the firewall exception list
SimpleFC::RemovePort 37 6
Pop $0 ; return error(1)/success(0)

; Check if the port 37/TCP is enabled/disabled
SimpleFC::IsPortEnabled 37 6
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Not enabled

; Disable the port 37/TCP
SimpleFC::EnableDisablePort 37 6 0
Pop $0 ; return error(1)/success(0)

; Enable the port 37/TCP
SimpleFC::EnableDisablePort 37 6 1
Pop $0 ; return error(1)/success(0)

; Check if an application is enabled/disabled
SimpleFC::IsApplicationEnabled "PathToApplication"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Not enabled

; Disable the application
SimpleFC::EnableDisableApplication "PathToApplication" 0
Pop $0 ; return error(1)/success(0)

; Enable the application
SimpleFC::EnableDisableApplication "PathToApplication" 1
Pop $0 ; return error(1)/success(0)

; Add an application to the firewall exception list - All Networks - All IP Version - Enabled
SimpleFC::AddApplication "My Application" "PathToApplication" 0 2 "" 1
Pop $0 ; return error(1)/success(0)

; Check if the application is added to the firewall exception list
SimpleFC::IsApplicationAdded "PathToApplication"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Added/0=Not added

; Remove an application from the firewall exception list
SimpleFC::RemoveApplication "PathToApplication"
Pop $0 ; return error(1)/success(0)

; Disable the windows firewall
SimpleFC::EnableDisableFirewall 0
Pop $0 ; return error(1)/success(0)

; Enable the windows firewall
SimpleFC::EnableDisableFirewall 1
Pop $0 ; return error(1)/success(0)

; Check if the firewall is enabled
SimpleFC::IsFirewallEnabled
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Disabled

; Enable exceptions are not allowed on the windows firewall
SimpleFC::AllowDisallowExceptionsNotAllowed 1
Pop $0 ; return error(1)/success(0)

; Disable exceptions are not allowed on the windows firewall
SimpleFC::AllowDisallowExceptionsNotAllowed 0
Pop $0 ; return error(1)/success(0)

; Check if exceptions are not allowed
SimpleFC::AreExceptionsNotAllowed
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Exceptions are not allowed is
; activated/0=Exception are not allowed is deactivated

; Enable notifications on the windows firewall
SimpleFC::EnableDisableNotifications 1

; Disable notifications on the windows firewall
SimpleFC::EnableDisableNotifications 0
Pop $0 ; return error(1)/success(0)

; Check if notifications are enabled/disabled
SimpleFC::AreNotificationsEnabled
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Enabled/0=Disabled

; Starts the windows firewall service
SimpleFC::StartStopFirewallService 1
Pop $0 ; return error(1)/success(0)

; Stops the windows firewall service
SimpleFC::StartStopFirewallService 0
Pop $0 ; return error(1)/success(0)

; Check if windows firewall service is running
SimpleFC::IsFirewallServiceRunning
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=IsRunning/0=Not Running

; Sets the windows firewall to default settings
SimpleFC::RestoreDefaults
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound destination unreachable state
SimpleFC::AllowDisallowIcmpOutboundDestinationUnreachable 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP redirect state
SimpleFC::AllowDisallowIcmpRedirect 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound echo request
SimpleFC::AllowDisallowIcmpInboundEchoRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound time exceeded
SimpleFC::AllowDisallowIcmpOutboundTimeExceeded 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound parameter problem
SimpleFC::AllowDisallowIcmpOutboundParameterProblem 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound source quench
SimpleFC::AllowDisallowIcmpOutboundSourceQuench 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound router request
SimpleFC::AllowDisallowIcmpInboundRouterRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound timestamp request
SimpleFC::AllowDisallowIcmpInboundTimestampRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP inbound mask request
SimpleFC::AllowDisallowIcmpInboundMaskRequest 1
Pop $0 ; return error(1)/success(0)

; Enable ICMP outbound packet too big
SimpleFC::AllowDisallowIcmpOutboundPacketTooBig 1
Pop $0 ; return error(1)/success(0)

; Check if ICMPv4 echo request is allowed
SimpleFC::IsIcmpTypeAllowed "0" "" "8"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Restricted/0=Not restricted
Pop $2 ; return 1=Allowed/0=Not allowed

; Some example rules for the windows firewall with advanced security.
; Please note this functions are very powerful, so for a detailed
; description please read the windows firewall with advanced
; security api reference:
; http://msdn2.microsoft.com/en-us/library/aa365309.aspx

; Adds an ICMPv4 rule to allow incoming echo reply messages (IcmpCodeAndType = 0:0)
SimpleFC::AdvAddRule "Echo-Reply (ICMPv4 incoming)" \
"Allows incoming Echo Replies messages." "1" "1" "1" "7" "1" "" \
"" "0:0" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Adds an ICMPv4 rule to allow incoming echo request messages (IcmpCodeAndType = 8:0)
SimpleFC::AdvAddRule "Echo-Request (ICMPv4 incoming)" \
"Allows incoming ICMP Echo messages." "1" "1" "1" "7" "1" "" \
"" "8:0" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Add an application rule to allow incoming TCP access on this application
SimpleFC::AdvAddRule "Incoming requests (TCP incoming)" \
"Allows incoming requests." "6" "1" "1" "7" "1" "PathToApplication" \
"" "" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Add an application rule to allow incoming UDP access on this application
SimpleFC::AdvAddRule "Incoming requests (UDP incoming)" \
"Allows incoming requests." "17" "1" "1" "7" "1" "PathToApplication" \
"" "" "@PathToApplication,-10000" "" "" "" ""
Pop $0 ; return error(1)/success(0)

; Removes a firewall rule
SimpleFC::AdvRemoveRule "Incoming requests (UDP incoming)"
Pop $0 ; return error(1)/success(0)

; Check if the firewall exists
SimpleFC::AdvExistsRule "Incoming requests (UDP incoming)"
Pop $0 ; return error(1)/success(0)
Pop $1 ; return 1=Exists/0=DoesnÂ´t exists
</highlight-nsis>

== Changelog ==
*Version 1.20 (2014-06-12)
**Added "ServiceName" parameter to function "AdvAddRule"
**Documentation updated
*Version 1.19 (2012-07-16)
**Documentation updated
*Version 1.18 (2010-02-23)
**Documentation updated
*Version 1.17 (2009-09-05)
**Added changes from the service manager
**The following functions are now case insensitive:
***SimpleFC::IsApplicationAdded
***SimpleFC::IsApplicationEnabled
***SimpleFC::EnableDisableApplication
***SimpleFC::AdvExistsRule
*Version 1.16 (2009-04-13)
**Added changes from the service manager
*Version 1.15 (2008-08-18)
**Added changes from the service manager and checked removed compiler optimization to avoid a false-positive virusscan.
*Version 1.14 (2008-02-05)
** Added changes from the service manager
*Version 1.13 (2008-01-29)
** Added changes from the service manager
*Version 1.12 (2007-11-13)
** Fixed wrong documentation about SimpleFC::AdvExistsRule
*Version 1.11 (2007-08-07)
** Fixed potential endless loop bug in SimpleFC::StartStopFirewallService
*Version 1.10 (2007-08-02)
** Added default firewall functions:
*** SimpleFC::RestoreDefaults
*** SimpleFC::AllowDisallowIcmpOutboundDestinationUnreachable
*** SimpleFC::AllowDisallowIcmpRedirect
*** SimpleFC::AllowDisallowIcmpInboundEchoRequest
*** SimpleFC::AllowDisallowIcmpOutboundTimeExceeded
*** SimpleFC::AllowDisallowIcmpOutboundParameterProblem
*** SimpleFC::AllowDisallowIcmpOutboundSourceQuench
*** SimpleFC::AllowDisallowIcmpInboundRouterRequest
*** SimpleFC::AllowDisallowIcmpInboundTimestampRequest
*** SimpleFC::AllowDisallowIcmpInboundMaskRequest
*** SimpleFC::AllowDisallowIcmpOutboundPacketTooBig
*** SimpleFC::IsIcmpTypeAllowed
** Added functions for Windows Firewall with Advanced Security
*** SimpleFC::AdvAddRule
*** SimpleFC::AdvRemoveRule
*** SimpleFC::AdvExistsRule
*Version 1.01 (2007-07-05)
**Changed missing documentation about the function SimpleFC::IsFirewallEnabled
*Version 1.0 (2007-05-02)
**First offical version

== Important Notes ==

*This plugin is running on Windows XP SP2, Windows 2003, Windows Vista, Windows 7, Windows 8, Windows Server 2012, Windows Server 8.1, Windows Server 2012 R2
*Before you execute some plugin commands it is recommend to check for windows firewall service is running (SimpleFC::IsFirewallServiceRunning).
*All functions with the prefix "Adv" are only for Windows Firewall with Advanced Security (Windows Vista and above). It is recommend to use these functions on the operating systems which supports the Windows Firewall with Advanced Security. Nethertheless, the default functions without the prefix "Adv" can be used.
* If you have any suggestions, comments or questions please mail me: mailto:rainer@speed-soft.de

[[Category:Plugins]]

File:NSIS Simple Firewall Plugin Unicode 1.21.zip

2021-05-04T21:24:57Z

Speed78:

File:NSIS Simple Firewall Plugin ANSI 1.21.zip

2021-05-04T21:23:22Z

Speed78:

NSIS Simple Service Plugin

Speed78: /* Short Reference */

This plugin contains basic service functions like start, stop the service or checking the service status. It also contains advanced service functions for example setting the service description, changed the logon account, granting or removing the service logon privilege.

This plugin is using the MPL License or alternatively the LGPL License.

== Links ==
<attach>NSIS_Simple_Service_Plugin_1.27.zip</attach> The ZIP file containing a precompiled plugin DLL (to be saved in NSIS' plugin directory) and the sources. If you update from a previous version it is strongly '''recommend''' to take look at the changelog.

== Donation ==
If you believe that I am doing a good job and you want to support me please [http://www.speed-soft.de/donation/index.php?language=en donate] any amount via PayPal.

== Short Reference ==

<highlight-nsis>
SimpleSC::InstallService [name_of_service] [display_name] [service_type]
[start_type] [binary_path] [dependencies] [account] [password]
SimpleSC::RemoveService [name_of_service]

SimpleSC::StartService [name_of_service] [arguments]
SimpleSC::StopService [name_of_service] [wait_for_file_release]
SimpleSC::PauseService [name_of_service]
SimpleSC::ContinueService [name_of_service]
SimpleSC::RestartService [name_of_service] [arguments]
SimpleSC::ExistsService [name_of_service]

SimpleSC::GetServiceDisplayName [name_of_service]
SimpleSC::GetServiceName [display_name]
SimpleSC::GetServiceStatus [name_of_service]
SimpleSC::GetServiceDescription [name_of_service]
SimpleSC::GetServiceStartType [name_of_service]
SimpleSC::GetServiceBinaryPath [name_of_service]
SimpleSC::GetServiceLogon [name_of_service]
SimpleSC::GetServiceFailure [name_of_service]

SimpleSC::SetServiceDescription [name_of_service] [service_description]
SimpleSC::SetServiceStartType [name_of_service] [start_type]
SimpleSC::SetServiceBinaryPath [name_of_service] [binary_path]
SimpleSC::SetServiceLogon [name_of_service] [account] [password]
SimpleSC::SetServiceFailure [name_of_service] [reset_period] [reboot_message]
[command] [action_type_1] [action_delay_1] [action_type_2] [action_delay_2]
[action_type_3] [action_delay_3]

SimpleSC::GrantServiceLogonPrivilege [account]
SimpleSC::RemoveServiceLogonPrivilege [account]

SimpleSC::ServiceIsPaused [name_of_service]
SimpleSC::ServiceIsRunning [name_of_service]
SimpleSC::ServiceIsStopped [name_of_service]

SimpleSC::GetErrorMessage [error_code]
</highlight-nsis>

Parameters:

*name_of_service - The name of the service used for Start/Stop commands and all further commands
*display_name - The name as shown in the service control manager applet in system control
*service_type - One of the following codes
**1 - SERVICE_KERNEL_DRIVER - Driver service.
**2 - SERVICE_FILE_SYSTEM_DRIVER - File system driver service.
**16 - SERVICE_WIN32_OWN_PROCESS - Service that runs in its own process. (Should be used in most cases)
**32 - SERVICE_WIN32_SHARE_PROCESS - Service that shares a process with one or more other services.
**256 - SERVICE_INTERACTIVE_PROCESS - The service can interact with the desktop.
***'''Note''': If you specify either SERVICE_WIN32_OWN_PROCESS or SERVICE_WIN32_SHARE_PROCESS, and the service is running in the context of the LocalSystem account, you can also specify this value. Example: SERVICE_WIN32_OWN_PROCESS or SERVICE_INTERACTIVE_PROCESS - (16 or 256) = 272
***'''Note''': Services cannot directly interact with a user as of Windows Vista. Therefore, this technique should not be used in new code. See for more information: http://msdn2.microsoft.com/en-us/library/ms683502(VS.85).aspx

*start_type - one of the following codes
**0 - SERVICE_BOOT_START - Driver boot stage start
**1 - SERVICE_SYSTEM_START - Driver scm stage start
**2 - SERVICE_AUTO_START - Service auto start (Should be used in most cases)
**3 - SERVICE_DEMAND_START - Driver/service manual start
**4 - SERVICE_DISABLED - Driver/service disabled
*service_status - one of the following codes
**1 - SERVICE_STOPPED
**2 - SERVICE_START_PENDING
**3 - SERVICE_STOP_PENDING
**4 - SERVICE_RUNNING
**5 - SERVICE_CONTINUE_PENDING
**6 - SERVICE_PAUSE_PENDING
**7 - SERVICE_PAUSED
*binary_path - The path to the binary including all necessary parameters
*dependencies - Needed services, controls which services have to be started before this one; use the forward slash "/" to add more more than one service
*account - The username/account which should be used
*password - Password of the aforementioned account to be able to logon as a service
**'''Note''': If you do not specify account/password, the local system account will be used to run the service
*arguments - Arguments passed to the service main function.
**'''Note''': Driver services do not receive these arguments.
*reset_period - The time after which to reset the failure count to zero if there are no failures, in seconds. Specify 0 (INFINITE) to indicate that this value should never be reset
*reboot_message - The message to be broadcast to server users before rebooting
*command - The command line of the process to execute in response to the SC_ACTION_RUN_COMMAND service controller action. This process runs under the same account as the service
*action_type_x - one of the following codes for the action to be performed
**0 - SC_ACTION_NONE - No action
**1 - SC_ACTION_RESTART - Restart the service
**2 - SC_ACTION_REBOOT - Reboot the computer (Note: The service user must have the SE_SHUTDOWN_NAME privilege)
**3 - SC_ACTION_RUN_COMMAND - Run a command
*action_delay_x - The time to wait before performing the specified action, in milliseconds
*error_code - Error code of a function
*service_description - The description as shown in the service control manager applet in system control
*wait_for_file_release - Wait for file release after the service is stopped. This is useful if the binary file will be overwritten after stopping the service.
**0 - NO_WAIT - No wait for file release
**1 - WAIT - Wait for file release
**Note: If SERVICE_WIN32_OWN_PROCESS is used this option should be set to WAIT. If SERVICE_WIN32_SHARE_PROCESS is used this option should only be set to WAIT if the last service in the process is stopped.

== The Sample Script ==
<highlight-nsis>
; Install a service - ServiceType own process - StartType automatic - NoDependencies - Logon as
; System Account
SimpleSC::InstallService "MyService" "My Service Display Name" "16" "2"
"C:\MyPath\MyService.exe" "" "" ""
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Install a service - ServiceType interact with desktop - StartType automatic - Dependencies on
; "Windows Time Service" (w32time) and "WWW Publishing Service" (w3svc) - Logon as System Account
SimpleSC::InstallService "MyService" "My Service Display Name" "272" "2"
"C:\MyPath\MyService.exe" "w32time/w3svc" "" ""
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Remove a service
SimpleSC::RemoveService "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Start a service
SimpleSC::StartService "MyService" ""
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Start a service with two arguments "/param1=true" "/param2=1"
SimpleSC::StartService "MyService" "/param1=true /param2=1"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Start a service with two arguments "-p param1" "-param2"
SimpleSC::StartService "MyService" '"-p param1" -param2'
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Stop a service
SimpleSC::StopService "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Pause a service
SimpleSC::PauseService "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Continue a service
SimpleSC::ContinueService "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Restart a service
SimpleSC::RestartService "MyService" ""
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Restart a service with two arguments "/param1=true" "/param2=1"
SimpleSC::RestartService "MyService" "/param1=true /param2=1"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Start a service with two arguments "-p param1" "-param2"
SimpleSC::RestartService "MyService" '"-p param1" -param2'
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Check if the service exists
SimpleSC::ExistsService "MyService"
Pop $0 ; returns an errorcode if the service doesnÂ´t exists (<>0)/service exists (0)

; Get the displayname of a service
SimpleSC::GetServiceDisplayName "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns the displayname of the service

; Get the servicename of a service by the displayname
SimpleSC::GetServiceName "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns the servicename of the service

; Get the current status of a service
SimpleSC::GetServiceStatus "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns the status of the service
; Valid values are:
; 1 - SERVICE_STOPPED
; 2 - SERVICE_START_PENDING
; 3 - SERVICE_STOP_PENDING
; 4 - SERVICE_RUNNING
; 5 - SERVICE_CONTINUE_PENDING
; 6 - SERVICE_PAUSE_PENDING
; 7 - SERVICE_PAUSED

; Get the description of a service
SimpleSC::GetServiceDescription "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns the description of the service

; Get the start type of the service
SimpleSC::GetServiceStartType "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns the start type of the service
; Valid values are:
; 0 - SERVICE_BOOT_START
; 1 - SERVICE_SYSTEM_START
; 2 - SERVICE_AUTO_START
; 3 - SERVICE_DEMAND_START
; 4 - SERVICE_DISABLED

; Get the binary path of a service
SimpleSC::GetServiceBinaryPath "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns the binary path of the service

; Get the service logon user of the service
SimpleSC::GetServiceLogon "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns the logon username of the service

; Set the description of a service (Not supported on Windows NT 4.0)
SimpleSC::SetServiceDescription "MyService" "Sample Description"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Set the starttype to automatic of a service
SimpleSC::SetServiceStartType "MyService" "2"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Sets the service logon to a user and grant the user the "SeServiceLogonPrivilege"
SimpleSC::SetServiceLogon "MyService" "MyServiceUser" "MyServiceUserPassword"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
IntCmp $0 0 +1 Done Done ; If successful grant the service logon privilege to "MyServiceUser"
; Note: Every serviceuser must have the ServiceLogonPrivilege to start the service
SimpleSC::GrantServiceLogonPrivilege "MyServiceUser"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Done:

; Sets the service binary path
SimpleSC::SetServiceBinaryPath "MyService" "C:\MySoftware\MyService.exe"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Remove the "SeServiceLogonPrivilege" from a user
SimpleSC::RemoveServiceLogonPrivilege "MyServiceUser"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)

; Check if the service is paused
SimpleSC::ServiceIsPaused "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns 1 (service is paused) - returns 0 (service is not paused)

; Check if the service is running
SimpleSC::ServiceIsRunning "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns 1 (service is running) - returns 0 (service is not running)

; Check if the service is stopped
SimpleSC::ServiceIsStopped "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
Pop $1 ; returns 1 (service is stopped) - returns 0 (service is not stopped)

; Show the error message if a function fails
SimpleSC::StopService "MyService"
Pop $0 ; returns an errorcode (<>0) otherwise success (0)
IntCmp $0 0 Done +1 +1
Push $0
SimpleSC::GetErrorMessage
Pop $0
MessageBox MB_OK|MB_ICONSTOP "Stopping fails - Reason: $0"
Done:
</highlight-nsis>

== Changelog ==
* Version 1.28 (2010-09-14)
**SimpleSC::GetServiceFailure function added
**SimpleSC::SetServiceFailure function added
**SimpleSC::StopService WaitForFileRelease feature added
* Version 1.27 (2010-03-23)
**Documentation updated
* Version 1.26 (2009-05-21)
**Fixed wait for status bug on starting, stopping, pausing or continuing a service
* Version 1.25 (2009-04-23)
**SimpleSC::SetServiceLogon supports now non-domain username without the ".\"-prefix
**SimpleSC::SetServiceBinaryPath function added
*Version 1.24 (2009-04-13)
**Fixed wait for status bug if the service status changed. Now, if a service stops, starts aso. the plugin will work like the recommendations in the MSDN.
*Version 1.23 (2008-08-23)
**Removed compiler optimization to avoid a false-positive virusscan.
*Version 1.22 (2008-08-17)
**SimpleSC::GrantServiceLogonPrivilege and SimpleSC::RemoveServiceLogonPrivilege works now correct with domain names like MyDomain\MyUser.
**Added function SimpleSC::GetServiceLogon to get the logon username of a service.
*Version 1.21 (2008-02-10)
**SimpleSC::ExistsService results now 0 if the service exists and <> 0 if the service doensnÂ´t exists.
*Version 1.20 (2008-02-05)
**Every function now returns <> 0 if there is an error. Use SimpleSC::GetErrorMessage to get the message of a function result.
**Added function SimpleSC::GetErrorMessage to get the message of a function result.
**SimpleSC::ExistsService results now 0 if the service exists and <> 0 if the service doensnÂ´t exists.
**SimpleSC::RestartService supports now arguments.
***'''Note''': The signature has been changed. If you update from a previous version you must check your parameters.
*Version 1.10 (2008-01-29)
**SimpleSC::InstallService supports now more than one dependencies (delimitter is the forward slash).
***'''Note''': The signature has been changed. If you update from a previous version you must check your parameters.
**SimpleSC::InstallService supports now more service types e.g. to create an interactive service.
***'''Note''': The signature has been changed. If you update from a previous version you must check your parameters.
**SimpleSC::StartService supports now arguments.
***'''Note''': The signature has been changed. If you update from a previous version you must check your parameters.
*Version 1.05 (2008-01-12)
**The functions SimpleSC::StopService and SimpleSC::RestartService are now improved. Now all dependent services are stopping recursively too.
*Version 1.04 (2007-08-07)
**Fixed bug for possible endless loops. This concerns to the functions StartService, StopService, ContinueService and PauseService.
*Version 1.03 (2007-08-02)
**Added function SimpleSC::GetServiceBinaryPath to get the binary path of a specified service.
*Version 1.02 (2007-05-29)
**Changed wrong documentation informations about the functions SimpleSC::InstallService and SimpleSC::RemoveService.
*Version 1.01 (2007-05-07)
**Changed wrong status-results in Readme.txt. This concerns to the functions ServiceIsPaused, ServiceIsRunning and ServiceIsStopped.
**Changed the access privileges of the plugin. The plugin now uses the lowest privlege of each function to execute.
*Version 1.0 (2007-05-02)
**First offical version

== Important Notes ==
*The function "SetServiceLogon" only works if the servicetype is "SERVICE_WIN32_OWN_PROCESS"
* The functions "GetServiceDescription" or "SetServiceDescription" are only available on systems higher than Windows NT.
* If you change the logon of an service to a new user you have to grant him the Service Logon Privilege. Otherwise the service cannot be started by the user you have assigned.
* The functions StartService, StopService, PauseService and ContinueService uses a timeout of 30 seconds. This means the function must be executed within 30 seconds, otherwise the functions will return an error.
* If you have any suggestions, comments or questions please mail me: mailto:rainer@speed-soft.de

[[Category:Plugins]]