dsccommunity / dsccommunity/NetworkingDsc
xFirewall Can't Detect Rules Created via the GUI (Windows 2012/WMF4)
Nobody has claimed this yet.
- Dominant language
- PowerShell
- Stars
- 235
- Forks
- 93
- PR merge metrics
- No merged PRs in 30d
Description
I'm running Windows 2012 (non R2) with WMF4. We have manually created some firewall rules using the GUI, and are now trying to detect and monitor these rules using DSC. When created with the GUI, the resources get a Name that is a GUID, and a DisplayName of whatever you intended the name to be. All the -NetFirewallRule checks in the xFirewall resource use -Name, so it is unable to detect the rule properly. A possible fix would be to have -NetFirewallRule check for either Name or DisplayName matches.
Output:
Here's what happens when I try to Test-TargetResource:
PS C:\Program Files\WindowsPowerShell\Modules\xNetworking\DSCResources\MSFT_xFirewall> $parms
Name Value
Action Allow
Ensure Present
Profile Domain
Description Allow Trend for Exchange2013
LocalPort {80, 443, 5168, 16372...}
Name TrendFirewallPortsforExchange2013 (TCP-IN)
Direction Inbound
Protocol Tcp
DisplayName TrendFirewallPortsforExchange2013 (TCP-IN)
PS C:\Program Files\WindowsPowerShell\Modules\xNetworking\DSCResources\MSFT_xFirewall> Import-Module .\MSFT_xFirewall.psm1
PS C:\Program Files\WindowsPowerShell\Modules\xNetworking\DSCResources\MSFT_xFirewall> Test-TargetResource @parms -Verbose
VERBOSE: Test-TargetResource: Checking settings for firewall rule with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)'.
VERBOSE: Test-TargetResource: Find firewall rule with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)'.
VERBOSE: Get-FirewallRule: No Firewall Rule found with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)'.
VERBOSE: Test-TargetResource: Firewall rule with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)' does not exist.
VERBOSE: Test-TargetResource: Check Firewall rule with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)' returning False.
False
Here's the resource props:
[DBG]: PS C:\Program Files\WindowsPowerShell\Modules\xNetworking\DSCResources\MSFT_xFirewall>> Get-NetFirewallRule | where {$_.DisplayName -like "Trend"} | fl
Name : {615DCE6C-32DD-49B0-B81E-808BA37473DC}
DisplayName : TrendFirewallPortsforExchange2013 (TCP-IN)
Description : Allow Trend for Exchange2013
DisplayGroup :
Group :
Enabled : True
Profile : Domain
Platform : {}
Direction : Inbound
Action : Allow
EdgeTraversalPolicy : Block
LooseSourceMapping : False
LocalOnlyMapping : False
Owner :
PrimaryStatus : OK
Status : The rule was parsed successfully from the store. (65536)
EnforcementStatus : NotApplicable
PolicyStoreSource : PersistentStore
PolicyStoreSourceType : Local
Here's a pic of the GUI:
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in DSCResources/MSFT_xFirewall/MSFT_xFirewall.psm1, focusing on Get-FirewallRule and Test-TargetResource, then reproduce the behavior with Get-NetFirewallRule and the shown GUI-created rule. Done means Test-TargetResource can detect a rule whose DisplayName matches the requested name even when its Name is a GUID.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- powershell
- Domain
- infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100