BlockFolderWindowsFirewall.ps1

<#PSScriptInfo

.VERSION 1.1.0

.GUID c7a7f36d-3d4f-4e2e-9bec-336ec8a0eb16

.AUTHOR asherto

.COMPANYNAME asheroto

.TAGS PowerShell Windows exe block allow unblock firewall folder directory recursive

.PROJECTURI https://github.com/asheroto/BlockFolderWindowsFirewall

.RELEASENOTES
[Version 0.0.1] - Initial Release.
[Version 0.0.2] - Added recurse option.
[Version 0.0.3] - Updated code signing certificate.
[Version 1.0.0] - Major improvements. Added -Version, -Help, -CheckForUpdate. Added inbound/outbound option (will do both if not specified).
[Version 1.0.1] - Added additional line breaks, changed first line to warning, and added PowerShell gallery info to -CheckForUpdate
[Version 1.0.2] - Added UpdateSelf function, fixed CheckForUpdate function.
[Version 1.1.0] - Added -Allow parameter, merged Block/Allow into Set-ExeFirewallRule, refactored main loop.

#>

<#
.SYNOPSIS
    Block, allow, or unblock all EXEs in a specified folder in Windows Firewall.
.DESCRIPTION
	This script provides functionalities to manage (block/allow/unblock) executables (EXEs) in specified directories via Windows Firewall. The operation can be targeted at individual directories or recursively applied to subdirectories as well.

	By default, both Inbound and Outbound connections will be affected, but the scope can be controlled via the -Inbound or -Outbound switches.

	Here are key switches to guide the script's behavior:
	  -Path to specify the target directory.
	  -Recurse switch will include all subdirectories in the operation.
	  -UnblockInstead switch changes the operation mode from blocking to unblocking (removes existing Block rules).
	  -Allow switch creates Allow firewall rules instead of Block rules.
	  -Inbound switch will only affect Inbound connections.
	  -Outbound switch will only affect Outbound connections.

	Additional utilities include:
	  -Version switch displays the current version of the script.
	  -Help switch brings up the help information for the script usage.
	  -CheckForUpdate switch verifies if the current script version is up-to-date.

	Special care should be taken when using this script due to its potentially broad impact. Blocking EXEs indiscriminately may disrupt applications depending on these executables.
.EXAMPLE
    BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder"
    This command will block both inbound and outbound traffic for all EXEs in the specified folder.
.EXAMPLE
	BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder" -Recurse
	This command will block both inbound and outbound traffic for all EXEs in the specified folder and all its subfolders.
.EXAMPLE
	BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder" -Inbound
	This command will block only inbound traffic for all EXEs in the specified folder.
.EXAMPLE
	BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder" -UnblockInstead
	This command will unblock both inbound and outbound traffic for all EXEs in the specified folder.
.EXAMPLE
	BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder" -Recurse -UnblockInstead
	This command will unblock both inbound and outbound traffic for all EXEs in the specified folder and all its subfolders.
.EXAMPLE
	BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder" -Outbound -UnblockInstead
	This command will unblock only outbound traffic for all EXEs in the specified folder.
.EXAMPLE
	BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder" -Allow
	This command will create Allow rules for both inbound and outbound traffic for all EXEs in the specified folder.
.EXAMPLE
	BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder" -Allow -Recurse
	This command will create Allow rules for both inbound and outbound traffic for all EXEs in the specified folder and all its subfolders.
.EXAMPLE
	BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder" -Allow -Inbound
	This command will create Allow rules for only inbound traffic for all EXEs in the specified folder.
.EXAMPLE
	BlockFolderWindowsFirewall -Path "C:\Folder\Subfolder" -Allow -Outbound
	This command will create Allow rules for only outbound traffic for all EXEs in the specified folder.
.PARAMETER Path
    The directory path to target for the operation.
.PARAMETER Recurse
    Include all subdirectories in the operation.
.PARAMETER UnblockInstead
    Change the operation mode from blocking to unblocking (removes existing Block rules).
.PARAMETER Allow
    Create Allow firewall rules instead of Block rules. Cannot be used with -UnblockInstead.
.PARAMETER Inbound
    Only affect Inbound connections.
.PARAMETER Outbound
    Only affect Outbound connections.
.PARAMETER CheckForUpdate
    Verify if the current script version is up-to-date.
.PARAMETER UpdateSelf
    Updates the script to the latest version on PSGallery.
.PARAMETER Version
    Display the current version of the script.
.PARAMETER Help
    Bring up the help information for the script usage.
.NOTES
    Version      : 1.1.0
    Created by   : asheroto
.LINK
    Project Site: https://github.com/asheroto/BlockFolderWindowsFirewall
#>

#Requires -RunAsAdministrator

[CmdletBinding()]
param (
    [String]$Path,
    [Switch]$Outbound,
    [Switch]$Inbound,
    [Switch]$Recurse,
    [Switch]$UnblockInstead,
    [Switch]$Allow,
    [switch]$CheckForUpdate,
    [switch]$UpdateSelf,
    [switch]$Version,
    [switch]$Help
)

# Version
$CurrentVersion = '1.1.0'
$RepoOwner = 'asheroto'
$RepoName = 'BlockFolderWindowsFirewall'
$PowerShellGalleryName = 'BlockFolderWindowsFirewall'

# Display version if -Version is specified
if ($Version.IsPresent) {
    $CurrentVersion
    exit 0
}

# Help
if ($Help) {
    Get-Help -Name $MyInvocation.MyCommand.Source -Full
    exit 0
}

function Get-GitHubRelease {
    <#
        .SYNOPSIS
        Fetches the latest release information of a GitHub repository.

        .DESCRIPTION
        This function uses the GitHub API to get information about the latest release of a specified repository, including its version and the date it was published.

        .PARAMETER Owner
        The GitHub username of the repository owner.

        .PARAMETER Repo
        The name of the repository.

        .EXAMPLE
        Get-GitHubRelease -Owner "asheroto" -Repo "winget-install"
        This command retrieves the latest release version and published datetime of the winget-install repository owned by asheroto.
    #>
    [CmdletBinding()]
    param (
        [string]$Owner,
        [string]$Repo
    )
    try {
        $url = "https://api.github.com/repos/$Owner/$Repo/releases/latest"
        $response = Invoke-RestMethod -Uri $url -ErrorAction Stop

        $latestVersion = $response.tag_name
        $publishedAt = $response.published_at

        # Convert UTC time string to local time
        $UtcDateTime = [DateTime]::Parse($publishedAt, [System.Globalization.CultureInfo]::InvariantCulture, [System.Globalization.DateTimeStyles]::RoundtripKind)
        $PublishedLocalDateTime = $UtcDateTime.ToLocalTime()

        [PSCustomObject]@{
            LatestVersion     = $latestVersion
            PublishedDateTime = $PublishedLocalDateTime
        }
    } catch {
        Write-Error "Unable to check for updates.`nError: $_"
        exit 1
    }
}

function CheckForUpdate {
    param (
        [string]$RepoOwner,
        [string]$RepoName,
        [version]$CurrentVersion,
        [string]$PowerShellGalleryName
    )

    $Data = Get-GitHubRelease -Owner $RepoOwner -Repo $RepoName

    Write-Output ""
    Write-Output ("Repository:       {0,-40}" -f "https://github.com/$RepoOwner/$RepoName")
    Write-Output ("Current Version:  {0,-40}" -f $CurrentVersion)
    Write-Output ("Latest Version:   {0,-40}" -f $Data.LatestVersion)
    Write-Output ("Published at:     {0,-40}" -f $Data.PublishedDateTime)

    if ($Data.LatestVersion -gt $CurrentVersion) {
        Write-Output ("Status:           {0,-40}" -f "A new version is available.")
        Write-Output "`nOptions to update:"
        Write-Output "- Download latest release: https://github.com/$RepoOwner/$RepoName/releases"
        if ($PowerShellGalleryName) {
            Write-Output "- Run: $RepoName -UpdateSelf"
            Write-Output "- Run: Install-Script $PowerShellGalleryName -Force"
        }
    } else {
        Write-Output ("Status:           {0,-40}" -f "Up to date.")
    }
    exit 0
}

function UpdateSelf {
    try {
        # Get PSGallery version of script
        $psGalleryScriptVersion = (Find-Script -Name $PowerShellGalleryName).Version

        # If the current version is less than the PSGallery version, update the script
        if ($CurrentVersion -lt $psGalleryScriptVersion) {
            Write-Output "Updating script to version $psGalleryScriptVersion..."

            # Install NuGet PackageProvider if not already installed
            if (-not (Get-PackageProvider -Name NuGet -ErrorAction SilentlyContinue)) {
                Install-PackageProvider -Name "NuGet" -Force
            }

            # Trust the PSGallery if not already trusted
            $psRepoInstallationPolicy = (Get-PSRepository -Name 'PSGallery').InstallationPolicy
            if ($psRepoInstallationPolicy -ne 'Trusted') {
                Set-PSRepository -Name 'PSGallery' -InstallationPolicy Trusted | Out-Null
            }

            # Update the script
            Install-Script $PowerShellGalleryName -Force

            # If PSGallery was not trusted, reset it to its original state
            if ($psRepoInstallationPolicy -ne 'Trusted') {
                Set-PSRepository -Name 'PSGallery' -InstallationPolicy $psRepoInstallationPolicy | Out-Null
            }

            Write-Output "Script updated to version $psGalleryScriptVersion."
            exit 0
        } else {
            Write-Output "Script is already up to date."
            exit 0
        }
    } catch {
        Write-Output "An error occurred: $_"
        exit 1
    }
}

function Set-ExeFirewallRule {
    param(
        [String]$FileName,
        [String]$FilePath,
        [ValidateSet('Allow', 'Block')]
        [String]$Action,
        [Switch]$Inbound,
        [Switch]$Outbound
    )

    $verb = if ($Action -eq 'Allow') { 'Allowing' } else { 'Blocking' }

    if ($Inbound.IsPresent -eq $false -and $Outbound.IsPresent -eq $false) {
        Write-Output "$verb Inbound and Outbound $FilePath..."
        New-NetFirewallRule -DisplayName $FileName -Direction Inbound -Program $FilePath -Action $Action | Out-Null
        New-NetFirewallRule -DisplayName $FileName -Direction Outbound -Program $FilePath -Action $Action | Out-Null
    } elseif ($Inbound.IsPresent) {
        Write-Output "$verb Inbound $FilePath..."
        New-NetFirewallRule -DisplayName $FileName -Direction Inbound -Program $FilePath -Action $Action | Out-Null
    } elseif ($Outbound.IsPresent) {
        Write-Output "$verb Outbound $FilePath..."
        New-NetFirewallRule -DisplayName $FileName -Direction Outbound -Program $FilePath -Action $Action | Out-Null
    }
}

function Unblock-Exe {
    param(
        [String]$FilePath,
        [Switch]$Inbound,
        [Switch]$Outbound
    )

    if ($Inbound.IsPresent -eq $false -and $Outbound.IsPresent -eq $false) {
        Write-Output "Unblocking Inbound and Outbound $FilePath..."
        $matchingRules = Get-NetFirewallApplicationFilter | ? { $_.AppPath -eq "$FilePath" } | % { Get-NetFirewallRule $_.InstanceID }
        if ($matchingRules) {
            $matchingRules | Remove-NetFirewallRule
        } else {
            Write-Warning "No matching Inbound and Outbound rules found for $FilePath"
        }
    } elseif ($Inbound.IsPresent) {
        Write-Output "Unblocking Inbound $FilePath..."
        $matchingRules = Get-NetFirewallApplicationFilter | ? { $_.AppPath -eq "$FilePath" } | % { Get-NetFirewallRule $_.InstanceID | ? { $_.Direction -eq "Inbound" } }
        if ($matchingRules) {
            $matchingRules | Remove-NetFirewallRule
        } else {
            Write-Warning "No matching Inbound rules found for $FilePath"
        }
    } elseif ($Outbound.IsPresent) {
        Write-Output "Unblocking Outbound $FilePath..."
        $matchingRules = Get-NetFirewallApplicationFilter | ? { $_.AppPath -eq "$FilePath" } | % { Get-NetFirewallRule $_.InstanceID | ? { $_.Direction -eq "Outbound" } }
        if ($matchingRules) {
            $matchingRules | Remove-NetFirewallRule
        } else {
            Write-Warning "No matching Outbound rules found for $FilePath"
        }
    }
}

# Update the script if -UpdateSelf is specified
if ($UpdateSelf) { UpdateSelf }

# Check for updates if -CheckForUpdate is specified
if ($CheckForUpdate) { CheckForUpdate -RepoOwner $RepoOwner -RepoName $RepoName -CurrentVersion $CurrentVersion -PowerShellGalleryName $PowerShellGalleryName }

# If Path is not set, check if -Version, -Help, or -CheckForUpdate is specified
if ("" -eq $Path) {
    if ($Version.IsPresent -or $Help.IsPresent -or $CheckForUpdate.IsPresent) {
        # Do nothing
    } else {
        Write-Error "-Path is required"
        exit 1
    }
}

# -Allow and -UnblockInstead are mutually exclusive
if ($Allow.IsPresent -and $UnblockInstead.IsPresent) {
    Write-Error "-Allow and -UnblockInstead cannot be used together"
    exit 1
}

# If any operation switch is specified, -Path is required
if ($Recurse.IsPresent -or $UnblockInstead.IsPresent -or $Allow.IsPresent -or $Outbound.IsPresent -or $Inbound.IsPresent) {
    if ("" -eq $Path) {
        Write-Error "-Path is required"
        exit 1
    }
}

# Confirm folder path exists
if (Test-Path -Path $Path -PathType Container) {
    # Update note
    Write-Output "`n$RepoName $CurrentVersion"
    Write-Output "To check for updates, run $RepoName -CheckForUpdate`n"

    # Folder path exists
    Write-Output "Folder exists, continuing...`n"

    # Pause for 10 seconds if the folder is C:\
    If ($Path -eq "C:\") {
        Write-Warning "You specified C:\ as the path, this will affect all EXEs on the C drive. Press CTRL+C to cancel, or wait 10 seconds to continue..."
        Start-Sleep -Seconds 10
    }

    # Print operation summary line
    $recursePrefix = if ($Recurse) { "Recursively " } else { "" }
    if ($Allow) {
        Write-Output "${recursePrefix}Allowing EXEs in $Path..."
    } elseif ($UnblockInstead) {
        Write-Output "${recursePrefix}Unblocking EXEs in $Path..."
    } else {
        Write-Output "${recursePrefix}Blocking EXEs in $Path..."
    }

    # Build Get-ChildItem params
    $gciParams = @{ Path = $Path; Filter = '*.exe' }
    if ($Recurse) { $gciParams['Recurse'] = $true }

    Get-ChildItem @gciParams | ForEach-Object {
        $FilePath = $_.FullName
        $FileName = Split-Path $FilePath -Leaf
        if ($Allow) {
            Set-ExeFirewallRule -FilePath $FilePath -FileName $FileName -Action Allow -Inbound:$Inbound.IsPresent -Outbound:$Outbound.IsPresent
        } elseif ($UnblockInstead) {
            Unblock-Exe -FilePath $FilePath -Inbound:$Inbound.IsPresent -Outbound:$Outbound.IsPresent
        } else {
            Set-ExeFirewallRule -FilePath $FilePath -FileName $FileName -Action Block -Inbound:$Inbound.IsPresent -Outbound:$Outbound.IsPresent
        }
    }

    Write-Output "Done!"
} else {
    # Folder path does not exist
    Write-Warning "Folder does not exist, please run the script again with a valid path"
}

Write-Output ""