Windows中通过C++添加防火墙规则

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66

#include <iostream> #include <Windows.h> #include <netfw.h>   int main() {     HRESULT hr = CoInitializeEx(0, COINIT_APARTMENTTHREADED);// 初始化 COM     if (SUCCEEDED(hr)) {         INetFwPolicy2* pFwPolicy2 = NULL;         //创建防火墙策略         hr = CoCreateInstance(__uuidof(NetFwPolicy2), NULL, CLSCTX_INPROC_SERVER, __uuidof(INetFwPolicy2), (void**)&pFwPolicy2);         if (SUCCEEDED(hr)) {             INetFwRules* pFwRules = NULL;             //获取防火墙规则             hr = pFwPolicy2->get_Rules(&pFwRules);             if (SUCCEEDED(hr)) {                            INetFwRule* pFwRule = NULL;                 // 在这里你可以通过遍历 pFwRules 获取并修改你想要的规则                // 例如，假设我们要修改名为 "MyFirewallRule" 的规则                 BSTR ruleName = SysAllocString(L"MyFirewallRule");                 //从规则集合中获取指定名称的规则                 hr = pFwRules->Item(ruleName, &pFwRule);                 if (SUCCEEDED(hr)) {                     std::cout << "Firewall rule is exist" << std::endl;                     pFwRules->Remove(ruleName);//删除名为""MyFirewallRule"的防火墙                     SysFreeString(ruleName);                     pFwRules->Release();                     pFwPolicy2->Release();<br>                                        CoUninitialize();//反初始化COM                       return -1;                 }                 //创建一个新的防火墙规则                 hr = CoCreateInstance(__uuidof(NetFwRule), NULL, CLSCTX_INPROC_SERVER, __uuidof(INetFwRule),(void**)&pFwRule);                 if (SUCCEEDED(hr)) {                     // 设置规则的属性                     pFwRule->put_Name(ruleName);                     pFwRule->put_Description(SysAllocString(L"My Firewall Rule"));                     pFwRule->put_Action(NET_FW_ACTION_ALLOW); // 允许连接                     pFwRule->put_Direction(NET_FW_RULE_DIR_IN); // 入站规则                     pFwRule->put_Enabled(VARIANT_TRUE); // 启用规则                                       pFwRule->put_Protocol(NET_FW_IP_PROTOCOL_TCP); // TCP 协议                     pFwRule->put_LocalPorts(SysAllocString(L"83")); // 本地端口 83                     pFwRule->put_InterfaceTypes(SysAllocString(L"All")); // 适用于所有网络接口                       // 将规则添加到规则集合中                     hr = pFwRules->Add(pFwRule);                       if (SUCCEEDED(hr)) {                         std::cout << "Firewall rule added successfully." << std::endl;                     }                     else {                         std::cout << "Failed to add firewall rule: " << hr << std::endl;                     }                       pFwRule->Release();                 }                 SysFreeString(ruleName);                 pFwRules->Release();             }             pFwPolicy2->Release();         }         CoUninitialize();//反初始化COM     }       return 0; }

添加到防火墙之前：

 添加到防火墙之后：

 防火墙的基本状态设置

?

1 2 3

# 查看当前防火墙状态： netsh advfirewall show allprofiles netsh advfirewall show allprofiles state

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20

# 恢复初始防火墙设置： netsh advfirewall reset   # 设置默认输入和输出策略： # 设置为允许 netsh advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound # 设置为拒绝 netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound   # 显示默认的入站和出站防火墙行为。 netsh advfirewall show allprofiles firewallpolicy   # 显示日志记录设置。 netsh advfirewall show allprofiles logging   # 开启防火墙 netsh advfirewall set allprofiles state on   #关闭防火墙： netsh advfirewall set allprofiles state off

 防火墙的入站规则设置：

?

1 2 3 4 5

# 允许 netsh advfirewall firewall add rule name=test dir=in action=allow protocol=tcp localport=8080   # 阻止 netsh advfirewall firewall add rule name=test dir=in action=block protocol=tcp localport=8080

防火墙的出站规则设置：

?

1 2 3 4 5

# 允许 netsh advfirewall firewall add rule name=test dir=out action=allow protocol=tcp localport=8080   # 阻止 netsh advfirewall firewall add rule name=test dir=out action=block protocol=tcp localport=8080

删除入站出站规则：

?

1 2 3 4 5

# 删除入站允许 netsh advfirewall firewall delete rule name=test dir=in action=allow protocol=tcp localport=8080   # 删除出站允许 netsh advfirewall firewall delete rule name=test dir=out action=allow protocol=tcp localport=8080

防火墙的其他设置：

允许并阻止ping：可以使用netsh来控制给定系统如何响应ping请求以及是否响应。以下两个netsh命令显示了如何阻止然后打开Windows防火墙来ping请求：

?

1 2	netsh advfirewall firewall add rule name="All ICMP V4" dir=in action=block protocol=icmpv4 netsh advfirewall firewall add rule name="All ICMP V4" dir=in action=allow protocol=icmpv4

启用程序：另一个常见任务是为给定程序打开Windows防火墙。以下示例说明了如何添加使Windows Live Messenger通过Windows防火墙工作的规则：

?

1	netsh advfirewall firewall add rule name="rule name" dir=in action=allow program="C:\\Path\\To\\Your\\Program.exe"

导出和导入防火墙设置文件:

?

1 2	netsh advfirewall export "C:\temp\WFconfiguration.wfw" netsh advfirewall import "C:\temp\WFconfiguration.wfw"