How to add several ports to FirewallException in Wix? - wix

Question

I use property PORTS to pass some http ports to my installation.
Then these ports will be stored into init file and used by the application.
I need to add these ports to FirewallException?
But following code does not work:
<Component Id="fwException" Guid="MyGUID">
<Condition>Privileged</Condition>
<RegistryKey Root="HKCU" Key="Software\Company\[ProductName]">
<RegistryValue Name="fwException" Value="1" KeyPath="yes" Type="integer" />
</RegistryKey>
<fire:FirewallException Id="My_Ports" Name="My Node.exe" Profile="domain" Port="[PORTS]" Protocol="tcp" Scope="localSubnet"/>
</Component>
How to add several ports to FirewallException?

Answer 1

Summary
In WIX 3.9 (and earlier), the FirewallExtension only supports a single integer for the Port attribute. The Port attribute supports Formatted values, but the result of the formatting must still be a single integer. In your case [PORTS] must evaluate to a single integer.
If the Port attribute is set to 'Not a number', you would typically see this error in the installation log:
SchedFirewallException: Error 0x80070057: failed to parse record field: 3 as number: Not a number
From #Sean's comment, multiple ports should work in WIX 3.10. See http://wixtoolset.org/issues/4206/ for details of the feature request.
Workaround for WIX 3.9 and Earlier
It is possible to work around this restriction by using FirewallExtension delcarations:
<Component Id="fwException" Guid="-- YOUR GUID --">
<Condition>Privileged</Condition>
<RegistryKey Root="HKCU" Key="Software\Company\[ProductName]">
<RegistryValue Name="fwException" Value="1" KeyPath="yes" Type="integer" />
</RegistryKey>
<fire:FirewallException Id="My_Port1" Name="My Node.exe" Profile="domain" Port="[PORT1]" Protocol="tcp" Scope="localSubnet"/>
<fire:FirewallException Id="My_Port2" Name="My Node.exe" Profile="domain" Port="[PORT2]" Protocol="tcp" Scope="localSubnet"/>
</Component>
If you need a variable number of ports (up to a pre-defined maximum limit) you could try 1 firewall extension per component with a condition on each component:
<Component Id="fwException1" Guid="-- YOUR GUID --">
<Condition>Privileged AND PORT1</Condition>
<RegistryKey Root="HKCU" Key="Software\Company\[ProductName]">
<RegistryValue Name="fwException1" Value="1" KeyPath="yes" Type="integer" />
</RegistryKey>
<fire:FirewallException Id="My_Port1" Name="My Node.exe" Profile="domain" Port="[PORT1]" Protocol="tcp" Scope="localSubnet"/>
</Component>
<Component Id="fwException2" Guid="-- YOUR GUID --">
<Condition>Privileged AND PORT2</Condition>
<RegistryKey Root="HKCU" Key="Software\Company\[ProductName]">
<RegistryValue Name="fwException2" Value="1" KeyPath="yes" Type="integer" />
</RegistryKey>
<fire:FirewallException Id="My_Port2" Name="My Node.exe" Profile="domain" Port="[PORT2]" Protocol="tcp" Scope="localSubnet"/>
</Component>
From the command line you would specify multiple ports as: PORT1=7071, PORT2=7072, and so on. How suitable this is depends on the maximum number of ports you need to specify.