feat: funciones PowerShell infra — firewall y portproxy
Funciones PowerShell para gestión de red en Windows: win_firewall_add_rule, win_firewall_remove_rule, win_portproxy_add y win_portproxy_remove. Útiles para configurar acceso de red en entornos WSL2. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
@@ -0,0 +1,52 @@
|
||||
---
|
||||
name: win_firewall_add_rule
|
||||
kind: function
|
||||
lang: ps
|
||||
domain: infra
|
||||
version: "1.0.0"
|
||||
purity: impure
|
||||
signature: "win_firewall_add_rule -Name <string> -Port <int> [-Protocol <string>]"
|
||||
description: "Añade una regla de entrada al firewall de Windows para permitir tráfico en un puerto TCP/UDP. Si ya existe una regla con el mismo nombre, la elimina y la recrea. Requiere privilegios de Administrador."
|
||||
tags: [firewall, windows, netsh, network, infra, security, port, wsl2]
|
||||
uses_functions: []
|
||||
uses_types: []
|
||||
returns: []
|
||||
returns_optional: false
|
||||
error_type: "error_go_core"
|
||||
imports: []
|
||||
tested: false
|
||||
tests: []
|
||||
test_file_path: ""
|
||||
file_path: "powershell/functions/infra/win_firewall_add_rule.ps1"
|
||||
---
|
||||
|
||||
## Uso
|
||||
|
||||
```powershell
|
||||
# Desde PowerShell (como Administrador)
|
||||
.\win_firewall_add_rule.ps1 -Name "CDP-9222" -Port 9222
|
||||
|
||||
# Con protocolo explícito
|
||||
.\win_firewall_add_rule.ps1 -Name "MyApp-UDP-5000" -Port 5000 -Protocol UDP
|
||||
```
|
||||
|
||||
```bash
|
||||
# Desde WSL2
|
||||
powershell.exe -ExecutionPolicy Bypass -File win_firewall_add_rule.ps1 -Name "CDP-9222" -Port 9222
|
||||
```
|
||||
|
||||
## Parametros
|
||||
|
||||
| Parametro | Tipo | Obligatorio | Default | Descripcion |
|
||||
|------------|--------|-------------|---------|--------------------------------------|
|
||||
| `-Name` | string | si | — | Nombre de la regla en el firewall |
|
||||
| `-Port` | int | si | — | Puerto local (1-65535) |
|
||||
| `-Protocol`| string | no | TCP | Protocolo: TCP o UDP |
|
||||
|
||||
## Notas
|
||||
|
||||
- Requiere ejecutarse como **Administrador** en Windows. Si se llama desde WSL2, usar `powershell.exe` (que corre en Windows) o `pwsh.exe`.
|
||||
- Si ya existe una regla con el mismo nombre, la elimina primero y la recrea (idempotente respecto al nombre).
|
||||
- La regla creada es `dir=in action=allow` — solo aplica para tráfico entrante.
|
||||
- Caso de uso principal: permitir que WSL2 alcance Chrome CDP en el host Windows cuando Chrome escucha en `127.0.0.1:9222`.
|
||||
- Retorna exit code 0 si tuvo éxito, 1 si hubo error (falta de privilegios, puerto inválido, fallo de netsh).
|
||||
@@ -0,0 +1,56 @@
|
||||
# win_firewall_add_rule.ps1 - Adds a Windows Firewall inbound rule for a TCP/UDP port.
|
||||
# Requires: Administrator privileges
|
||||
# Usage: powershell.exe -ExecutionPolicy Bypass -File win_firewall_add_rule.ps1 -Name "CDP-9222" -Port 9222
|
||||
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$Name,
|
||||
|
||||
[Parameter(Mandatory = $true)]
|
||||
[int]$Port,
|
||||
|
||||
[Parameter(Mandatory = $false)]
|
||||
[string]$Protocol = "TCP"
|
||||
)
|
||||
|
||||
# Verify administrator privileges
|
||||
$currentPrincipal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
if (-not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
||||
Write-Error "ERROR: This script requires Administrator privileges. Run PowerShell as Administrator."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Validate protocol
|
||||
$validProtocols = @("TCP", "UDP")
|
||||
if ($validProtocols -notcontains $Protocol.ToUpper()) {
|
||||
Write-Error "ERROR: Protocol must be TCP or UDP, got '$Protocol'."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Validate port range
|
||||
if ($Port -lt 1 -or $Port -gt 65535) {
|
||||
Write-Error "ERROR: Port must be between 1 and 65535, got '$Port'."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Remove existing rule with the same name if it exists
|
||||
$existingRule = netsh advfirewall firewall show rule name="$Name" 2>&1
|
||||
if ($LASTEXITCODE -eq 0) {
|
||||
Write-Host "Removing existing rule '$Name'..."
|
||||
netsh advfirewall firewall delete rule name="$Name" | Out-Null
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
Write-Error "ERROR: Failed to remove existing rule '$Name'."
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
# Add the new inbound rule
|
||||
Write-Host "Adding firewall rule '$Name' for $Protocol port $Port..."
|
||||
netsh advfirewall firewall add rule name="$Name" dir=in action=allow protocol=$Protocol localport=$Port
|
||||
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
Write-Error "ERROR: Failed to add firewall rule '$Name'."
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host "OK: Firewall rule '$Name' added - $Protocol inbound on port $Port."
|
||||
@@ -0,0 +1,46 @@
|
||||
---
|
||||
name: win_firewall_remove_rule
|
||||
kind: function
|
||||
lang: ps
|
||||
domain: infra
|
||||
version: "1.0.0"
|
||||
purity: impure
|
||||
signature: "win_firewall_remove_rule -Name <string>"
|
||||
description: "Elimina una regla del firewall de Windows por nombre. Si la regla no existe, termina con éxito sin hacer nada (idempotente). Requiere privilegios de Administrador."
|
||||
tags: [firewall, windows, netsh, network, infra, security, cleanup, wsl2]
|
||||
uses_functions: []
|
||||
uses_types: []
|
||||
returns: []
|
||||
returns_optional: false
|
||||
error_type: "error_go_core"
|
||||
imports: []
|
||||
tested: false
|
||||
tests: []
|
||||
test_file_path: ""
|
||||
file_path: "powershell/functions/infra/win_firewall_remove_rule.ps1"
|
||||
---
|
||||
|
||||
## Uso
|
||||
|
||||
```powershell
|
||||
# Desde PowerShell (como Administrador)
|
||||
.\win_firewall_remove_rule.ps1 -Name "CDP-9222"
|
||||
```
|
||||
|
||||
```bash
|
||||
# Desde WSL2
|
||||
powershell.exe -ExecutionPolicy Bypass -File win_firewall_remove_rule.ps1 -Name "CDP-9222"
|
||||
```
|
||||
|
||||
## Parametros
|
||||
|
||||
| Parametro | Tipo | Obligatorio | Descripcion |
|
||||
|-----------|--------|-------------|-----------------------------------|
|
||||
| `-Name` | string | si | Nombre exacto de la regla a eliminar |
|
||||
|
||||
## Notas
|
||||
|
||||
- Requiere ejecutarse como **Administrador** en Windows.
|
||||
- Idempotente: si la regla no existe, sale con exit code 0 y mensaje informativo.
|
||||
- Complementa `win_firewall_add_rule` para teardown limpio de reglas temporales.
|
||||
- Retorna exit code 0 si tuvo éxito (o la regla no existía), 1 si hubo error.
|
||||
@@ -0,0 +1,33 @@
|
||||
# win_firewall_remove_rule.ps1 - Removes a Windows Firewall rule by name.
|
||||
# Requires: Administrator privileges
|
||||
# Usage: powershell.exe -ExecutionPolicy Bypass -File win_firewall_remove_rule.ps1 -Name "CDP-9222"
|
||||
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[string]$Name
|
||||
)
|
||||
|
||||
# Verify administrator privileges
|
||||
$currentPrincipal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
if (-not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
||||
Write-Error "ERROR: This script requires Administrator privileges. Run PowerShell as Administrator."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Check if the rule exists
|
||||
$existingRule = netsh advfirewall firewall show rule name="$Name" 2>&1
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
Write-Host "INFO: Firewall rule '$Name' does not exist - nothing to remove."
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Remove the rule
|
||||
Write-Host "Removing firewall rule '$Name'..."
|
||||
netsh advfirewall firewall delete rule name="$Name"
|
||||
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
Write-Error "ERROR: Failed to remove firewall rule '$Name'."
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host "OK: Firewall rule '$Name' removed."
|
||||
@@ -0,0 +1,73 @@
|
||||
---
|
||||
name: win_portproxy_add
|
||||
kind: function
|
||||
lang: ps
|
||||
domain: infra
|
||||
version: "1.0.0"
|
||||
purity: impure
|
||||
signature: "win_portproxy_add -ListenPort <int> [-ConnectPort <int>] [-ListenAddr <string>] [-ConnectAddr <string>]"
|
||||
description: "Añade una regla de port proxy v4tov4 con netsh para redirigir tráfico desde ListenAddr:ListenPort hacia ConnectAddr:ConnectPort. Si ya existe una regla para el mismo listenaddress:listenport, la elimina y la recrea. Requiere privilegios de Administrador."
|
||||
tags: [portproxy, netsh, windows, network, infra, wsl2, cdp, redirect, proxy]
|
||||
uses_functions: []
|
||||
uses_types: []
|
||||
returns: []
|
||||
returns_optional: false
|
||||
error_type: "error_go_core"
|
||||
imports: []
|
||||
tested: false
|
||||
tests: []
|
||||
test_file_path: ""
|
||||
file_path: "powershell/functions/infra/win_portproxy_add.ps1"
|
||||
---
|
||||
|
||||
## Uso
|
||||
|
||||
```powershell
|
||||
# Caso típico WSL2 → Chrome CDP: redirigir 0.0.0.0:9222 → 127.0.0.1:9222
|
||||
.\win_portproxy_add.ps1 -ListenPort 9222
|
||||
|
||||
# Con todos los parámetros explícitos
|
||||
.\win_portproxy_add.ps1 -ListenPort 9222 -ConnectPort 9222 -ListenAddr 0.0.0.0 -ConnectAddr 127.0.0.1
|
||||
|
||||
# Redirigir a un puerto diferente
|
||||
.\win_portproxy_add.ps1 -ListenPort 8080 -ConnectPort 3000
|
||||
```
|
||||
|
||||
```bash
|
||||
# Desde WSL2 — habilitar acceso a Chrome CDP en el host Windows
|
||||
powershell.exe -ExecutionPolicy Bypass -File win_portproxy_add.ps1 -ListenPort 9222
|
||||
```
|
||||
|
||||
## Parametros
|
||||
|
||||
| Parametro | Tipo | Obligatorio | Default | Descripcion |
|
||||
|----------------|--------|-------------|---------------|--------------------------------------------------|
|
||||
| `-ListenPort` | int | si | — | Puerto en el que escucha el proxy (1-65535) |
|
||||
| `-ConnectPort` | int | no | =ListenPort | Puerto de destino al que conectar (1-65535) |
|
||||
| `-ListenAddr` | string | no | `0.0.0.0` | Dirección IP en la que escucha el proxy |
|
||||
| `-ConnectAddr` | string | no | `127.0.0.1` | Dirección IP de destino |
|
||||
|
||||
## Notas
|
||||
|
||||
- Requiere ejecutarse como **Administrador** en Windows.
|
||||
- Caso de uso principal: WSL2 no puede alcanzar `127.0.0.1` del host Windows directamente. Esta regla hace que el host escuche en `0.0.0.0:PORT` y reenvíe al loopback donde Chrome (u otro proceso) está escuchando.
|
||||
- Idempotente respecto a listenaddress:listenport: si ya existe una regla para esa combinación, la elimina y la recrea.
|
||||
- Combinar con `win_firewall_add_rule` para que el firewall también permita el tráfico entrante.
|
||||
- Retorna exit code 0 si tuvo éxito, 1 si hubo error.
|
||||
|
||||
## Flujo completo WSL2 → Chrome CDP
|
||||
|
||||
```bash
|
||||
# 1. Abrir Puerto en firewall
|
||||
powershell.exe -ExecutionPolicy Bypass -File win_firewall_add_rule.ps1 -Name "CDP-9222" -Port 9222
|
||||
|
||||
# 2. Redirigir tráfico de red al loopback
|
||||
powershell.exe -ExecutionPolicy Bypass -File win_portproxy_add.ps1 -ListenPort 9222
|
||||
|
||||
# 3. Arrancar Chrome con CDP en Windows
|
||||
# chrome.exe --remote-debugging-port=9222 --headless
|
||||
|
||||
# 4. Desde WSL2 conectar al host Windows
|
||||
# WSL2_HOST=$(cat /etc/resolv.conf | grep nameserver | awk '{print $2}')
|
||||
# curl http://$WSL2_HOST:9222/json
|
||||
```
|
||||
@@ -0,0 +1,62 @@
|
||||
# win_portproxy_add.ps1 - Adds a netsh portproxy rule (v4tov4) to forward traffic.
|
||||
# Requires: Administrator privileges
|
||||
# Usage: powershell.exe -ExecutionPolicy Bypass -File win_portproxy_add.ps1 -ListenPort 9222
|
||||
# powershell.exe -ExecutionPolicy Bypass -File win_portproxy_add.ps1 -ListenPort 9222 -ConnectPort 9222 -ListenAddr 0.0.0.0 -ConnectAddr 127.0.0.1
|
||||
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[int]$ListenPort,
|
||||
|
||||
[Parameter(Mandatory = $false)]
|
||||
[int]$ConnectPort = 0, # 0 means use ListenPort
|
||||
|
||||
[Parameter(Mandatory = $false)]
|
||||
[string]$ListenAddr = "0.0.0.0",
|
||||
|
||||
[Parameter(Mandatory = $false)]
|
||||
[string]$ConnectAddr = "127.0.0.1"
|
||||
)
|
||||
|
||||
# Verify administrator privileges
|
||||
$currentPrincipal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
if (-not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
||||
Write-Error "ERROR: This script requires Administrator privileges. Run PowerShell as Administrator."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Default ConnectPort to ListenPort if not specified
|
||||
if ($ConnectPort -eq 0) {
|
||||
$ConnectPort = $ListenPort
|
||||
}
|
||||
|
||||
# Validate ports
|
||||
if ($ListenPort -lt 1 -or $ListenPort -gt 65535) {
|
||||
Write-Error "ERROR: ListenPort must be between 1 and 65535, got '$ListenPort'."
|
||||
exit 1
|
||||
}
|
||||
if ($ConnectPort -lt 1 -or $ConnectPort -gt 65535) {
|
||||
Write-Error "ERROR: ConnectPort must be between 1 and 65535, got '$ConnectPort'."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Remove existing portproxy for the same listenaddress:listenport if it exists
|
||||
$existing = netsh interface portproxy show v4tov4 2>&1 | Select-String "$ListenAddr\s+$ListenPort"
|
||||
if ($existing) {
|
||||
Write-Host "Removing existing portproxy for ${ListenAddr}:${ListenPort}..."
|
||||
netsh interface portproxy delete v4tov4 listenaddress=$ListenAddr listenport=$ListenPort | Out-Null
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
Write-Error "ERROR: Failed to remove existing portproxy for ${ListenAddr}:${ListenPort}."
|
||||
exit 1
|
||||
}
|
||||
}
|
||||
|
||||
# Add the portproxy rule
|
||||
Write-Host "Adding portproxy: ${ListenAddr}:${ListenPort} -> ${ConnectAddr}:${ConnectPort}..."
|
||||
netsh interface portproxy add v4tov4 listenaddress=$ListenAddr listenport=$ListenPort connectaddress=$ConnectAddr connectport=$ConnectPort
|
||||
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
Write-Error "ERROR: Failed to add portproxy ${ListenAddr}:${ListenPort} -> ${ConnectAddr}:${ConnectPort}."
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host "OK: Portproxy added - ${ListenAddr}:${ListenPort} -> ${ConnectAddr}:${ConnectPort}."
|
||||
@@ -0,0 +1,61 @@
|
||||
---
|
||||
name: win_portproxy_remove
|
||||
kind: function
|
||||
lang: ps
|
||||
domain: infra
|
||||
version: "1.0.0"
|
||||
purity: impure
|
||||
signature: "win_portproxy_remove -ListenPort <int> [-ListenAddr <string>]"
|
||||
description: "Elimina una regla de port proxy v4tov4 de netsh identificada por ListenAddr:ListenPort. Si la regla no existe, termina con éxito sin hacer nada (idempotente). Requiere privilegios de Administrador."
|
||||
tags: [portproxy, netsh, windows, network, infra, wsl2, cleanup, proxy]
|
||||
uses_functions: []
|
||||
uses_types: []
|
||||
returns: []
|
||||
returns_optional: false
|
||||
error_type: "error_go_core"
|
||||
imports: []
|
||||
tested: false
|
||||
tests: []
|
||||
test_file_path: ""
|
||||
file_path: "powershell/functions/infra/win_portproxy_remove.ps1"
|
||||
---
|
||||
|
||||
## Uso
|
||||
|
||||
```powershell
|
||||
# Eliminar portproxy en puerto 9222 (listenaddr por defecto: 0.0.0.0)
|
||||
.\win_portproxy_remove.ps1 -ListenPort 9222
|
||||
|
||||
# Con listenaddr explícito
|
||||
.\win_portproxy_remove.ps1 -ListenAddr 0.0.0.0 -ListenPort 9222
|
||||
```
|
||||
|
||||
```bash
|
||||
# Desde WSL2
|
||||
powershell.exe -ExecutionPolicy Bypass -File win_portproxy_remove.ps1 -ListenPort 9222
|
||||
```
|
||||
|
||||
## Parametros
|
||||
|
||||
| Parametro | Tipo | Obligatorio | Default | Descripcion |
|
||||
|---------------|--------|-------------|-------------|------------------------------------------------------|
|
||||
| `-ListenPort` | int | si | — | Puerto de escucha de la regla a eliminar (1-65535) |
|
||||
| `-ListenAddr` | string | no | `0.0.0.0` | Dirección IP de escucha de la regla a eliminar |
|
||||
|
||||
## Notas
|
||||
|
||||
- Requiere ejecutarse como **Administrador** en Windows.
|
||||
- Idempotente: si la regla no existe, sale con exit code 0 y mensaje informativo.
|
||||
- Complementa `win_portproxy_add` para teardown limpio.
|
||||
- La regla se identifica por la combinación `listenaddress:listenport` — debe coincidir exactamente con la usada en `win_portproxy_add`.
|
||||
- Retorna exit code 0 si tuvo éxito (o la regla no existía), 1 si hubo error.
|
||||
|
||||
## Teardown completo WSL2 → Chrome CDP
|
||||
|
||||
```bash
|
||||
# 1. Eliminar portproxy
|
||||
powershell.exe -ExecutionPolicy Bypass -File win_portproxy_remove.ps1 -ListenPort 9222
|
||||
|
||||
# 2. Eliminar regla de firewall
|
||||
powershell.exe -ExecutionPolicy Bypass -File win_firewall_remove_rule.ps1 -Name "CDP-9222"
|
||||
```
|
||||
@@ -0,0 +1,43 @@
|
||||
# win_portproxy_remove.ps1 - Removes a netsh portproxy v4tov4 rule.
|
||||
# Requires: Administrator privileges
|
||||
# Usage: powershell.exe -ExecutionPolicy Bypass -File win_portproxy_remove.ps1 -ListenPort 9222
|
||||
# powershell.exe -ExecutionPolicy Bypass -File win_portproxy_remove.ps1 -ListenAddr 0.0.0.0 -ListenPort 9222
|
||||
|
||||
param(
|
||||
[Parameter(Mandatory = $true)]
|
||||
[int]$ListenPort,
|
||||
|
||||
[Parameter(Mandatory = $false)]
|
||||
[string]$ListenAddr = "0.0.0.0"
|
||||
)
|
||||
|
||||
# Verify administrator privileges
|
||||
$currentPrincipal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
|
||||
if (-not $currentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
||||
Write-Error "ERROR: This script requires Administrator privileges. Run PowerShell as Administrator."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Validate port
|
||||
if ($ListenPort -lt 1 -or $ListenPort -gt 65535) {
|
||||
Write-Error "ERROR: ListenPort must be between 1 and 65535, got '$ListenPort'."
|
||||
exit 1
|
||||
}
|
||||
|
||||
# Check if the portproxy rule exists
|
||||
$existing = netsh interface portproxy show v4tov4 2>&1 | Select-String "$ListenAddr\s+$ListenPort"
|
||||
if (-not $existing) {
|
||||
Write-Host "INFO: Portproxy for ${ListenAddr}:${ListenPort} does not exist - nothing to remove."
|
||||
exit 0
|
||||
}
|
||||
|
||||
# Remove the portproxy rule
|
||||
Write-Host "Removing portproxy for ${ListenAddr}:${ListenPort}..."
|
||||
netsh interface portproxy delete v4tov4 listenaddress=$ListenAddr listenport=$ListenPort
|
||||
|
||||
if ($LASTEXITCODE -ne 0) {
|
||||
Write-Error "ERROR: Failed to remove portproxy for ${ListenAddr}:${ListenPort}."
|
||||
exit 1
|
||||
}
|
||||
|
||||
Write-Host "OK: Portproxy for ${ListenAddr}:${ListenPort} removed."
|
||||
Reference in New Issue
Block a user