Install ToutWAF on Windows
The PowerShell installer for Windows 10, 11 and Windows Server: a Windows service for the data plane, a startup task for the console, firewall rules, check, upgrade and uninstall.
Which version you install
The public version is a development version, named 0.3.0-dev. Its name stays the same: each publication replaces the previous one, and a build identifier tells two builds apart. No stable version exists yet: it will only be published once every system and package has been tested end to end. The commands on this page therefore install from the dev channel. A development version can contain bugs: try it on a test site before relying on it.
At a glance
- Windows Server 2016 and later, Windows 10 version 1809 and later, Windows 11, amd64 and arm64. 32-bit Windows is not supported.
- Run it in an elevated PowerShell (Run as Administrator), version 5.1 or later.
- The data plane runs as the Windows service “ToutWAF”; the control plane as a startup scheduled task “ToutWAF-ControlPlane”.
- The script verifies the SHA-256, installs in Program Files, keeps everything mutable in ProgramData, opens the firewall and starts; run again it upgrades in place and goes back to the previous binary if the new one fails the health check.
The commands, step by step
Open PowerShell as Administrator and run the installer
Installs the native binaries, registers the ToutWAF Windows service for the data plane and a startup task for the console, and opens the firewall ports. The installer has not been run on a real Windows host yet.
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1 | iexOpen the firewall
The installer opens these ports by default when firewalld or ufw is active: 80 and 443, and the console port 9443 (restrict it to your admin network with --console-from). The agent port 9444 is never opened publicly. These commands are only needed with --no-firewall, with another firewall, or to do it by hand.
New-NetFirewallRule -DisplayName "ToutWAF Web" -Direction Inbound -Protocol TCP -LocalPort 80,443 -Action Allow
New-NetFirewallRule -DisplayName "ToutWAF Console" -Direction Inbound -Protocol TCP -LocalPort 9443 -RemoteAddress 203.0.113.0/24 -Action AllowCheck the services
Get-Service ToutWAF
toutwafctl doctor
Test-NetConnection 127.0.0.1 -Port 9443Upgrade
Back up the configuration and the data, then run the installer again: it keeps your settings and rolls back by itself if the new version does not become healthy. The paths shown are those of a new installation (/var/toutwaf); an older installation keeps /etc/toutwaf and /var/lib/toutwaf. You can also update from the console, on the Updates page.
Copy-Item "$env:ProgramData\ToutWAF" "$env:ProgramData\ToutWAF.bak" -Recurse
& ([scriptblock]::Create((irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1))) -Update -YesUninstall
The first block removes the services, the binaries and the firewall rules added by ToutWAF, and keeps your data. The second one also deletes configuration, data and logs.
& ([scriptblock]::Create((irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1))) -Uninstall& ([scriptblock]::Create((irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1))) -Uninstall -PurgeWhat is not verified
We prefer to say it plainly.
- The installer has not been run on a real Windows host: every version has the status “expected”, not “tested”. The arm64 build was only cross-compiled, never run, not even under emulation.
- Differences from Linux: one accept loop per listener, no systemd watchdog (the service recovery replaces it), and SELinux, firewalld, sysctl and logrotate do not apply.