BB Eco firewall rules for IT administrators

BB Eco discovers and upgrades Brainboxes devices over inbound UDP. On unmanaged Windows machines the installer and app manage the necessary firewall rules automatically. On machines managed by Group Policy or Intune, locally-created rules may be suppressed or ignored — this page gives your IT team everything needed to push the rules centrally.

Keep in sync: the values on this page mirror FirewallRuleDefinitions.cs in the BB Eco source. If you are reading this next to a newer release, trust the app's own bb-eco firewall status output.

What BB Eco does on its own (unmanaged machines)

• Installer: BB Eco installs per Windows user and updates without administrator rights. A first install asks once — the standard Windows administrator prompt — for permission to add the rule below; the rule is created for that user's copy of the app and survives every update.
• In the app: if the prompt was declined, the rule was removed later, or a Windows Security Alert left a block rule behind, BB Eco shows an Add firewall rule banner (also offered in the firmware-upgrade dialog). One click performs the same one-time registration, removing stale local block rules first. On machines managed by Group Policy or Intune the banner points here instead.
• CLI: bb-eco firewall status reports the effective state (including whether Group Policy is ignoring local rules); bb-eco firewall register (elevated) creates the CLI's own rule wherever you unzipped it.

Recommended rules (program-scoped)

One inbound UDP allow rule per executable, all profiles. Program scoping means only Brainboxes-signed binaries receive the traffic:

Rule name	Program	Protocol	Direction	Profiles
Brainboxes BB Eco Sidecar	C:\Users\<user>\AppData\Local\Programs\bb-eco\resources\sidecar\bb-eco-sidecar.exe	UDP (any local port)	Inbound allow	All
Brainboxes BB Eco CLI	<your install path>\bb-eco.exe	UDP (any local port)	Inbound allow	All

BB Eco installs per user, so the program path lives inside each Windows user's profile. Windows Firewall stores the literal path (it does not expand %LOCALAPPDATA% per user in a machine-wide rule), so a central deployment creates one rule per profile — the same pattern Microsoft documents for per-user Teams installs. PowerShell equivalent, run in an elevated context such as a Group Policy computer startup script or a scheduled task:

Get-ChildItem 'C:\Users' -Directory | ForEach-Object {
  $exe = Join-Path $_.FullName 'AppData\Local\Programs\bb-eco\resources\sidecar\bb-eco-sidecar.exe'
  if ((Test-Path $exe) -and -not (Get-NetFirewallApplicationFilter -Program $exe -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -DisplayName "Brainboxes BB Eco Sidecar" `
      -Direction Inbound -Action Allow -Protocol UDP -Profile Any -Program $exe
  }
}

The install path is stable across app updates (the updater replaces files in place), so a rule does not need re-pushing per release — only when a new user installs BB Eco on the machine. Where one rule for every user is preferred, use the port-scoped alternative below without a -Program filter.

All profiles matters: Windows classifies unidentified networks — which includes most plant-floor wired segments — as Public. A rule scoped to Domain/Private silently does nothing on the network where the devices actually live.

Strict alternative (port-scoped)

If policy forbids any-port program rules — or you want one machine-wide rule regardless of which users install BB Eco — scope to these inbound UDP ports:

UDP port(s)	Used for
67, 68, 69	BOOTP/TFTP firmware upgrade + stuck-device recovery
1900	SSDP discovery announcements + post-upgrade reboot detection
3702	WS-Discovery
5353	mDNS
32768–40959	TFTP data socket (randomly chosen per upgrade)

Note the trade-offs: SSDP search replies arrive on an ephemeral port (they usually work rule-less thanks to Windows' 3-second unicast-response window, but late device replies are dropped), and the TFTP data range is wide. The program-scoped rule avoids both problems.

Managed-environment specifics

• Local rule merge disabled (Computer Configuration → Windows Defender Firewall → Domain/Private/Public Profile → Settings → "Apply local firewall rules": No): everything BB Eco creates locally is ignored — the rules must come from GPO/Intune. BB Eco detects this, reports LocalRulesIgnored, and its banner points users at this page instead of offering the one-click registration.
• Intune: Endpoint security → Firewall → Firewall rules; create the program-scoped rule with the table values above.
• Standard-user block artifacts: when a non-administrator clicks through the Windows Security Alert, Windows silently creates block rules for the exe, and block beats allow. BB Eco purges these local artifacts during registration (installer prompt, Add firewall rule, or bb-eco firewall register); it never touches block rules deployed via GPO/MDM — if you have deliberately blocked BB Eco, it will report that and stop.

Windows Server

Firewall notifications are typically suppressed on Server: with no rule, inbound UDP is dropped silently — no prompt ever appears, and a headless bb-eco upgrade just times out. Check and fix with:

bb-eco firewall status     # explains the effective state, scriptable exit codes
bb-eco firewall register   # elevated: creates the rule for this bb-eco.exe

What still works without any rule

Outbound traffic is never blocked by default, and Windows briefly (≈3 s) accepts unicast replies to outbound multicast/broadcast — so basic SSDP discovery often works rule-less. What does not work without a rule: device announcements (SSDP NOTIFY), mDNS/WS-Discovery listening, BOOTP broadcasts from a device stuck in its bootloader, and the firmware upgrade's BOOTP/TFTP exchange. A missing rule also delays each upgrade stage by ~2 s (the first BOOTP broadcast per stage is dropped before the socket sees it).

Port conflicts are a different problem

The firewall permits traffic; it cannot free a port another service owns. If UDP 67/69 is held by Internet Connection Sharing (svchost — active while WSL2, Hyper-V, Docker Desktop or Mobile Hotspot runs), Docker, or another DHCP/TFTP server, BB Eco's pre-flight names the owning process and the remedy (e.g. wsl --shutdown). bb-eco firewall status performs the same check.