Firewall

Open inbound or outbound exceptions in Windows Firewall for your application.

Applies to: MSI and MSIX.

---

firewallExceptions – add firewall exceptions

Properties

Property	Type	Required	Default	Description
name	string	yes	–	Display name in wf.msc.
path	string	yes	–	Full path to the file. Can be inside or outside the package.
bound	string[]	yes	–	Subset of ["in", "out"].
profile	string[]	yes	–	Subset of ["private", "public", "domain", "any"].
protocol	enum	yes	–	One of "tcp", "udp", "any". (Single string, not an array.)

Examples

Outbound TCP for the updater on private/domain networks

"firewallExceptions": [
  {
    "name":     "My Application Updater - Outbound",
    "path":     "$.installDir\\My Application.Service.exe",
    "bound":    ["out"],
    "profile":  ["private", "domain"],
    "protocol": "tcp"
  }
]

Inbound and outbound, UDP, all profiles

{
  "name":     "My Application Discovery",
  "path":     "$.installDir\\MyApp.exe",
  "bound":    ["in", "out"],
  "profile":  ["any"],
  "protocol": "udp"
}

---

MSI vs MSIX behavior

Both formats register Windows Firewall rules at install. The rules are removed on uninstall.

---

Validation rules

Validator	Catch
required	name, path, bound, profile, protocol are mandatory.
valid path	firewallExceptions.path is syntactically valid.
valid value	Enum-based fields must use a valid value.

---