dsccommunity / dsccommunity/NetworkingDsc

xFirewall Can't Detect Rules Created via the GUI (Windows 2012/WMF4)

Open
#121 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug help wanted
Dominant language
PowerShell
Stars
235
Forks
93
PR merge metrics
No merged PRs in 30d

Description

I'm running Windows 2012 (non R2) with WMF4. We have manually created some firewall rules using the GUI, and are now trying to detect and monitor these rules using DSC. When created with the GUI, the resources get a Name that is a GUID, and a DisplayName of whatever you intended the name to be. All the -NetFirewallRule checks in the xFirewall resource use -Name, so it is unable to detect the rule properly. A possible fix would be to have -NetFirewallRule check for either Name or DisplayName matches.

Output:
Here's what happens when I try to Test-TargetResource:

PS C:\Program Files\WindowsPowerShell\Modules\xNetworking\DSCResources\MSFT_xFirewall> $parms

Name Value


Action Allow
Ensure Present
Profile Domain
Description Allow Trend for Exchange2013
LocalPort {80, 443, 5168, 16372...}
Name TrendFirewallPortsforExchange2013 (TCP-IN)
Direction Inbound
Protocol Tcp
DisplayName TrendFirewallPortsforExchange2013 (TCP-IN)

PS C:\Program Files\WindowsPowerShell\Modules\xNetworking\DSCResources\MSFT_xFirewall> Import-Module .\MSFT_xFirewall.psm1

PS C:\Program Files\WindowsPowerShell\Modules\xNetworking\DSCResources\MSFT_xFirewall> Test-TargetResource @parms -Verbose
VERBOSE: Test-TargetResource: Checking settings for firewall rule with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)'.
VERBOSE: Test-TargetResource: Find firewall rule with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)'.
VERBOSE: Get-FirewallRule: No Firewall Rule found with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)'.
VERBOSE: Test-TargetResource: Firewall rule with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)' does not exist.
VERBOSE: Test-TargetResource: Check Firewall rule with Name 'TrendFirewallPortsforExchange2013 (TCP-IN)' returning False.
False

Here's the resource props:
[DBG]: PS C:\Program Files\WindowsPowerShell\Modules\xNetworking\DSCResources\MSFT_xFirewall>> Get-NetFirewallRule | where {$_.DisplayName -like "Trend"} | fl

Name : {615DCE6C-32DD-49B0-B81E-808BA37473DC}
DisplayName : TrendFirewallPortsforExchange2013 (TCP-IN)
Description : Allow Trend for Exchange2013
DisplayGroup :
Group :
Enabled : True
Profile : Domain
Platform : {}
Direction : Inbound
Action : Allow
EdgeTraversalPolicy : Block
LooseSourceMapping : False
LocalOnlyMapping : False
Owner :
PrimaryStatus : OK
Status : The rule was parsed successfully from the store. (65536)
EnforcementStatus : NotApplicable
PolicyStoreSource : PersistentStore
PolicyStoreSourceType : Local

Here's a pic of the GUI:
guirule

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in DSCResources/MSFT_xFirewall/MSFT_xFirewall.psm1, focusing on Get-FirewallRule and Test-TargetResource, then reproduce the behavior with Get-NetFirewallRule and the shown GUI-created rule. Done means Test-TargetResource can detect a rule whose DisplayName matches the requested name even when its Name is a GUID.

Written by the indexing model from the issue text.

Assessment

Tech stack
powershell
Domain
infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.