Windows
The PowerShell installer for Windows 10, 11 and Windows Server: a Windows service for the data plane, a startup task for the console, firewall rules, check, upgrade and uninstall.
您安装的是哪个版本
目前公开的是名为 0.3.0-dev 的开发版。名称保持不变：每次发布都会替换上一次，并用构建编号区分两个构建。尚无稳定版：只有在每个系统和每个软件包都完成端到端测试之后，才会发布稳定版。因此本页的命令从 dev 通道安装。开发版可能存在缺陷：在依赖它之前，请先在测试站点上试用。
At a glance
- Windows Server 2016 and later, Windows 10 version 1809 and later, Windows 11, amd64 and arm64. 32-bit Windows is not supported.
- Run it in an elevated PowerShell (Run as Administrator), version 5.1 or later.
- The data plane runs as the Windows service “ToutWAF”; the control plane as a startup scheduled task “ToutWAF-ControlPlane”.
- The script verifies the SHA-256, installs in Program Files, keeps everything mutable in ProgramData, opens the firewall and starts; run again it upgrades in place and goes back to the previous binary if the new one fails the health check.
The commands, step by step
以管理员身份打开 PowerShell 并运行安装程序
安装原生二进制文件，为数据平面注册 Windows 服务 ToutWAF，为控制台注册开机任务，并开放防火墙端口。安装程序尚未在真实的 Windows 主机上运行过。
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1 | iex开放防火墙
当 firewalld 或 ufw 处于启用状态时，安装程序默认会开放这些端口：80 和 443，以及控制台端口 9443（可用 --console-from 限制为管理网络）。代理端口 9444 绝不会对公网开放。只有在使用 --no-firewall、使用其他防火墙或想手动操作时才需要下面的命令。
New-NetFirewallRule -DisplayName "ToutWAF Web" -Direction Inbound -Protocol TCP -LocalPort 80,443 -Action Allow
New-NetFirewallRule -DisplayName "ToutWAF Console" -Direction Inbound -Protocol TCP -LocalPort 9443 -RemoteAddress 203.0.113.0/24 -Action Allow检查服务
Get-Service ToutWAF
toutwafctl doctor
Test-NetConnection 127.0.0.1 -Port 9443升级
先备份配置和数据，再重新运行安装程序：它会保留您的设置，如果新版本未能恢复正常会自动回滚。这里显示的是新安装的路径（/var/toutwaf）；较早的安装仍使用 /etc/toutwaf 和 /var/lib/toutwaf。您也可以在控制台的“更新”页面中升级。
Copy-Item "$env:ProgramData\ToutWAF" "$env:ProgramData\ToutWAF.bak" -Recurse
& ([scriptblock]::Create((irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1))) -Update -Yes卸载
第一段命令移除服务、二进制文件以及 ToutWAF 添加的防火墙规则，并保留您的数据。第二段还会删除配置、数据和日志。
& ([scriptblock]::Create((irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1))) -Uninstall& ([scriptblock]::Create((irm https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.ps1))) -Uninstall -PurgeWhat is not verified
We prefer to say it plainly.
- The installer has not been run on a real Windows host: every version has the status “expected”, not “tested”. The arm64 build was only cross-compiled, never run, not even under emulation.
- Differences from Linux: one accept loop per listener, no systemd watchdog (the service recovery replaces it), and SELinux, firewalld, sysctl and logrotate do not apply.