1 files changed, 68 insertions, 0 deletions
diff --git a/packaging/win/firewall.ps1 b/packaging/win/firewall.ps1
new file mode 100644
index 0000000..abed109
--- /dev/null
+++ b/packaging/win/firewall.ps1
@@ -0,0 +1,68 @@
+<#
+.SYNOPSIS
+    Add (or remove) the inbound Windows Firewall rules MeshBay needs.
+
+.DESCRIPTION
+    WebRTC binds an ephemeral UDP port per connection and the browser always
+    dials the node (aioice cannot resolve the peer's mDNS `.local` candidate),
+    so the node must accept unsolicited inbound UDP. Without a rule, Windows
+    pops an "Allow access" dialog the first time each of MeshBay.exe and
+    meshbay-node.exe binds a socket.
+
+    The installer runs this once, elevated, so the user answers one UAC prompt
+    instead of two firewall dialogs later. Declining the installer's offer is
+    fine -- the dialogs are the fallback.
+
+    Shipped as an extraResource at <install>\resources\firewall.ps1, so it
+    locates the two executables from its own path and takes no arguments beyond
+    the action. Runs elevated and windowless, so it leaves a trace at
+    %TEMP%\meshbay-firewall.log.
+
+.PARAMETER Action
+    add     (default) create/replace the rules
+    remove  delete them
+#>
+[CmdletBinding()]
+param(
+    [ValidateSet("add", "remove")]
+    [string]$Action = "add"
+)
+
+$ErrorActionPreference = "Stop"
+$log = Join-Path $env:TEMP "meshbay-firewall.log"
+"[{0}] {1}" -f (Get-Date -Format s), $Action | Add-Content $log
+
+# This script sits at <install>\resources\firewall.ps1.
+$resources = $PSScriptRoot
+$install   = Split-Path -Parent $resources
+$GROUP     = "MeshBay"
+
+$targets = @(
+    @{ Name = "MeshBay";      Path = Join-Path $install  "MeshBay.exe" }
+    @{ Name = "MeshBay Node"; Path = Join-Path $resources "node-runtime\meshbay-node.exe" }
+)
+
+try {
+    foreach ($t in $targets) {
+        # Idempotent: clear any existing rule of this name first.
+        Remove-NetFirewallRule -DisplayName $t.Name -ErrorAction SilentlyContinue
+
+        if ($Action -eq "add") {
+            if (-not (Test-Path $t.Path)) {
+                "  skip $($t.Name): $($t.Path) not found" | Add-Content $log
+                continue
+            }
+            New-NetFirewallRule -DisplayName $t.Name -Group $GROUP `
+                -Direction Inbound -Action Allow `
+                -Program $t.Path -Protocol UDP -Profile Any | Out-Null
+            "  allowed $($t.Name)  ($($t.Path))" | Add-Content $log
+        }
+        else {
+            "  removed $($t.Name)" | Add-Content $log
+        }
+    }
+}
+catch {
+    "  ERROR: $_" | Add-Content $log
+    throw
+}