<# .SYNOPSIS Add (or remove) the inbound Windows Firewall rules MeshBay needs. .DESCRIPTION WebRTC binds an ephemeral UDP port per connection and the browser always dials the node (aioice cannot resolve the peer's mDNS `.local` candidate), so the node must accept unsolicited inbound UDP. Without a rule, Windows pops an "Allow access" dialog the first time each of MeshBay.exe and meshbay-node.exe binds a socket. The installer runs this once, elevated, so the user answers one UAC prompt instead of two firewall dialogs later. Declining the installer's offer is fine -- the dialogs are the fallback. Shipped as an extraResource at \resources\firewall.ps1, so it locates the two executables from its own path and takes no arguments beyond the action. Runs elevated and windowless, so it leaves a trace at %TEMP%\meshbay-firewall.log. .PARAMETER Action add (default) create/replace the rules remove delete them #> [CmdletBinding()] param( [ValidateSet("add", "remove")] [string]$Action = "add" ) $ErrorActionPreference = "Stop" $log = Join-Path $env:TEMP "meshbay-firewall.log" "[{0}] {1}" -f (Get-Date -Format s), $Action | Add-Content $log # This script sits at \resources\firewall.ps1. $resources = $PSScriptRoot $install = Split-Path -Parent $resources $GROUP = "MeshBay" $targets = @( @{ Name = "MeshBay"; Path = Join-Path $install "MeshBay.exe" } @{ Name = "MeshBay Node"; Path = Join-Path $resources "node-runtime\meshbay-node.exe" } ) try { foreach ($t in $targets) { # Idempotent: clear any existing rule of this name first. Remove-NetFirewallRule -DisplayName $t.Name -ErrorAction SilentlyContinue if ($Action -eq "add") { if (-not (Test-Path $t.Path)) { " skip $($t.Name): $($t.Path) not found" | Add-Content $log continue } New-NetFirewallRule -DisplayName $t.Name -Group $GROUP ` -Direction Inbound -Action Allow ` -Program $t.Path -Protocol UDP -Profile Any | Out-Null " allowed $($t.Name) ($($t.Path))" | Add-Content $log } else { " removed $($t.Name)" | Add-Content $log } } } catch { " ERROR: $_" | Add-Content $log throw }