Search code examples
tcpportipczeromqwindows-firewall

How to suppress the Windows Security Alert for Windows Firewall?

When I create the Hello World example in C++ from The Guide on ZeroMQ found here: http://zguide.zeromq.org/page:all#Ask-and-Ye-Shall-Receive

and run the application, I get a Windows Security Alert that asks if I would like to allow the application to communicate on public or private networks.

It looks like this: Screenshot

Here is where things get interesting.

I only need my program to listen on port 5555 for connections from localhost and I do NOT need to allow incoming connections on port 5555. This is because I only want to communicate between applications on the localhost.

Client and server are both running on the same machine.

Here is my current process. I start the server, the Windows Security Alert comes up, since I am running the application as a non-administrator account, I only have standard permissions. Then I click Cancel on the Alert.

Clicking cancel on the alert puts an explicit deny inbound rule on all ports for HelloWorldServer.exe. This is totally fine.

Then I start the client. Since the client is connecting to the localhost. I actually does not need to send messages outside of the local machine, and all of its messages arrive at the server just fine.

Given an explicit deny rule on incoming connections to HelloWorldServer.exe, the messages can still arrive from the client on the local host. This is a desirable result.

Now the question becomes is there anyway to automatically respond to the Windows Security Alert to click cancel? Is there any way to suppress it from popping up since the allow is not needed?

The prompt is undesirable because it implies that the application needs to create a vulnerability when it does not.

Please assume that Named Pipes are not a valid alternative to tcp as a means of inter-process communication.

Solution

  • When binding the socket the caller may specify the IP address the socket is bound to. The coding samples provided by ZeroMQ specify 

    socket.bind ("tcp://*:5555");

    where * appears to be specify all possible addresses (INADDR_ANY in BSD socket-derived parlance) which will trigger the Windows firewall as it allows remote and local addresses.

    Calling socket.bind with the localhost address 127.0.0.1

    socket.bind ("tcp://127.0.0.1:5555");

    limits the sockets allowed to connect to the local machine and should silence the firewall warning for most Windows firewall configurations.