BB Eco firewall rules for IT administrators

BB Eco discovers and upgrades Brainboxes devices over inbound UDP. On unmanaged Windows machines the installer and app manage the necessary firewall rules automatically. On machines managed by Group Policy or Intune, locally-created rules may be suppressed or ignored — this page gives your IT team everything needed to push the rules centrally.

Keep in sync: the values on this page mirror FirewallRuleDefinitions.cs in the BB Eco source. If you are reading this next to a newer release, trust the app's own bb-eco firewall status output.

What BB Eco does on its own (unmanaged machines)

• Installer (0.8.0+): the per-machine installer (one UAC prompt) creates the rule below for the sidecar and removes rules left by older versions. It resets local firewall rules for BB Eco's executables on every install/update — persistent custom rules for BB Eco belong in Group Policy, not the local store.
• At upgrade time: if the rule is missing, the app re-creates it during the same UAC elevation used for the firmware upgrade.
• CLI: bb-eco firewall status reports the effective state (including whether Group Policy is ignoring local rules); bb-eco firewall register (elevated) creates the CLI's own rule wherever you unzipped it.

Recommended rules (program-scoped)

One inbound UDP allow rule per executable, all profiles. Program scoping means only Brainboxes-signed binaries receive the traffic:

Rule name	Program	Protocol	Direction	Profiles
Brainboxes BB Eco Sidecar	C:\Program Files\BB Eco\resources\sidecar\bb-eco-sidecar.exe	UDP (any local port)	Inbound allow	All
Brainboxes BB Eco CLI	<your install path>\bb-eco.exe	UDP (any local port)	Inbound allow	All

PowerShell equivalent (run in an elevated / GPO startup context):

New-NetFirewallRule -DisplayName "Brainboxes BB Eco Sidecar" `
  -Direction Inbound -Action Allow -Protocol UDP -Profile Any `
  -Program "C:\Program Files\BB Eco\resources\sidecar\bb-eco-sidecar.exe"

The install path is stable across app updates (the updater replaces files in place), so the rule does not need re-pushing per release.

All profiles matters: Windows classifies unidentified networks — which includes most plant-floor wired segments — as Public. A rule scoped to Domain/Private silently does nothing on the network where the devices actually live.

Strict alternative (port-scoped)

If policy forbids any-port program rules, scope to these inbound UDP ports (still program-scoped, please):

UDP port(s)	Used for
67, 68, 69	BOOTP/TFTP firmware upgrade + stuck-device recovery
1900	SSDP discovery announcements + post-upgrade reboot detection
3702	WS-Discovery
5353	mDNS
32768–40959	TFTP data socket (randomly chosen per upgrade)

Note the trade-offs: SSDP search replies arrive on an ephemeral port (they usually work rule-less thanks to Windows' 3-second unicast-response window, but late device replies are dropped), and the TFTP data range is wide. The program-scoped rule avoids both problems.

Managed-environment specifics

• Local rule merge disabled (Computer Configuration → Windows Defender Firewall → Domain/Private/Public Profile → Settings → "Apply local firewall rules": No): everything BB Eco creates locally is ignored — the rules must come from GPO/Intune. BB Eco detects this and reports LocalRulesIgnored, pointing users at this page.
• Intune: Endpoint security → Firewall → Firewall rules; create the program-scoped rule with the table values above.
• Standard-user block artifacts: when a non-administrator clicks through the Windows Security Alert, Windows silently creates block rules for the exe, and block beats allow. BB Eco purges these local artifacts during elevated registration; it never touches block rules deployed via GPO/MDM — if you have deliberately blocked BB Eco, it will report that and stop.

Windows Server

Firewall notifications are typically suppressed on Server: with no rule, inbound UDP is dropped silently — no prompt ever appears, and a headless bb-eco upgrade just times out. Check and fix with:

bb-eco firewall status     # explains the effective state, scriptable exit codes
bb-eco firewall register   # elevated: creates the rule for this bb-eco.exe

What still works without any rule

Outbound traffic is never blocked by default, and Windows briefly (≈3 s) accepts unicast replies to outbound multicast/broadcast — so basic SSDP discovery often works rule-less. What does not work without a rule: device announcements (SSDP NOTIFY), mDNS/WS-Discovery listening, BOOTP broadcasts from a device stuck in its bootloader, and the firmware upgrade's BOOTP/TFTP exchange. A missing rule also delays each upgrade stage by ~2 s (the first BOOTP broadcast per stage is dropped before the socket sees it).

Port conflicts are a different problem

The firewall permits traffic; it cannot free a port another service owns. If UDP 67/69 is held by Internet Connection Sharing (svchost — active while WSL2, Hyper-V, Docker Desktop or Mobile Hotspot runs), Docker, or another DHCP/TFTP server, BB Eco's pre-flight names the owning process and the remedy (e.g. wsl --shutdown). bb-eco firewall status performs the same check.