Best practice for adding a firewall exception: program or port exception?

Question

For a distributed production client / server WCF application (self-service as a Windows service with NetTcpBinding), I add logic to add a temptation to the Windows firewall during installation using the netsh command.

I noticed that remoting seems to work just fine, whether a firewall exception is for the program (executable) or port. In our case, the port will very rarely be something other than the default, and if so, then the user can manually change the configuration files and firewalls, respectively.

My question is: is it better to add an exception for the OR or OR or . Are there any security considerations that make one approach more desirable than another? Almost all WCF examples show port exceptions.

Any insight would be appreciated, thanks.

Answer 1

Here is my summary of how I think they work:

Application Exception → provides the specified application to open any ports

Port Exception → provides any application to open a specified port

, , . , . , , Windows ( ) , , .

MSDN : "[ ] , , , ".

MSDN: http://technet.microsoft.com/en-us/network/bb545423.aspx

/ , . , , , . , , , .