Question

Does anyone know if it is possible to reliably determine (programattically C/C++…) whether or not a firewall or IP filtering software is installed on a Windows PC? I need to detect whether a certain server IP is being blocked in my client software by the host OS.

I don’t need to worry about external hardware firewals in this situation as I have full control of this. It is only software firewalls that I am concerned with. My hope was that I could iterate the windows network stack or NDIS interfaces and determine this

Answer 1

After reading some of your comments in reply to other answers, I think this might actually be closer to what you’re looking for. It might not catch every type of firewall but any major firewall vendor should be registered with the Security Center and therefore detected with this method. You could also combine this with some of the other answers here to give yourself a second level of verification.

Detecting running firewalls in windows

It’s an Expert’s Exchange post so you may not be able to read the thread. Just in case, I’ve copied and pasted the relevant info. It’s in VBScript but it should point you in the right direction as far as what WMI namespaces you can use.

KemalRouge: I’ve just solved this problem with some help from a colleague. He pointed me in the direction of a knowledge base article, which pointed out that this information was stored in the WMI database

Basically, it’s possible to query the WMI in a few lines of code to find out what firewalls/anti-virus software is being monitored by the Security Center, and the status of this software (i.e. enabled or not).

Anyway, if you’re interested, here’s some VB code I used to test this out (you’ll need a reference to "Microsoft WMI Scripting V1.2 Library"):

Private Sub DumpFirewallInfo()  Dim oLocator    As WbemScripting.SWbemLocator Dim oService    As WbemScripting.SWbemServicesEx Dim oFirewalls  As WbemScripting.SWbemObjectSet Dim oFirewall   As WbemScripting.SWbemObjectEx Dim oFwMgr      As Variant             Set oFwMgr = CreateObject("HNetCfg.FwMgr")         Debug.Print "Checking the Windows Firewall..."     Debug.Print "Windows Firewal Enabled: " & oFwMgr.LocalPolicy.CurrentProfile.FirewallEnabled     Debug.Print ""         Set oFwMgr = Nothing             Debug.Print "Checking for other installed firewalls..."         Set oLocator = New WbemScripting.SWbemLocator     Set oService = oLocator.ConnectServer(".", "root\SecurityCenter")     oService.Security_.ImpersonationLevel = 3      Set oFirewalls = oService.ExecQuery("SELECT * FROM FirewallProduct") ' This could also be "AntivirusProduct"         For Each oFirewall In oFirewalls         Debug.Print "Company:       " & vbTab & oFirewall.CompanyName         Debug.Print "Firewall Name: " & vbTab & oFirewall.DisplayName         Debug.Print "Enabled:       " & vbTab & Format$(oFirewall.Enabled)         Debug.Print "Version:       " & vbTab & oFirewall.versionNumber         Debug.Print ""     Next oFirewall         Set oFirewall = Nothing     Set oFirewalls = Nothing     Set oService = Nothing     Set oLocator = Nothing  End Sub