PyInstaller编译exe执行netsh防火墙命令报错：CalledProcessError

问题场景 #

我通过Python脚本执行netsh命令添加Windows防火墙规则，脚本直接运行或通过CMD执行Python时一切正常，但用PyInstaller编译为exe后，抛出错误：

subprocess.CalledProcessError: Command 'netsh advfirewall...." returned non-zero exit status 1

使用的代码片段：

command = "netsh advfirewall firewall add rule name=dupa8 action=allow profile=any localip=192.162.250.0/24 remoteip=192.162.250.0/24 dir=in"
encoding = "cp949"

out = str(subprocess.check_output(command).decode(encoding=encoding, errors="ignore"))
print(f'Out result {out}')

解决方法 #

1. 确保以管理员权限运行 #

添加防火墙规则需要管理员权限：

• 测试时右键exe选择「以管理员身份运行」；
• 打包时强制添加UAC权限：
  命令行打包：pyinstaller --uac-admin your_script.py
  或在spec文件中配置：

  a = Analysis(..., uac_admin=True)
  

2. 修改subprocess调用方式 #

直接传递字符串命令在打包后可能出现解析问题，建议拆分命令为列表形式（无需shell解析）：

import subprocess

command = [
    "netsh", "advfirewall", "firewall", "add", "rule",
    "name=dupa8", "action=allow", "profile=any",
    "localip=192.162.250.0/24", "remoteip=192.162.250.0/24", "dir=in"
]
encoding = "cp949"

out = subprocess.check_output(command, encoding=encoding, errors="ignore")
print(f'Out result {out}')

3. 捕获错误输出定位问题 #

修改代码捕获错误输出，明确具体失败原因（如规则重复、权限不足等）：

import subprocess

try:
    command = [
        "netsh", "advfirewall", "firewall", "add", "rule",
        "name=dupa8", "action=allow", "profile=any",
        "localip=192.162.250.0/24", "remoteip=192.162.250.0/24", "dir=in"
    ]
    encoding = "cp949"
    out = subprocess.check_output(
        command, 
        encoding=encoding, 
        errors="ignore",
        stderr=subprocess.STDOUT
    )
    print(f'Out result {out}')
except subprocess.CalledProcessError as e:
    print(f'错误输出: {e.output}')
    print(f'返回码: {e.returncode}')

4. 处理规则重复问题 #

如果同名规则dupa8已存在，再次执行添加命令会报错。可先检查并处理：

import subprocess

encoding = "cp949"
# 检查规则是否存在
check_command = ["netsh", "advfirewall", "firewall", "show", "rule", "name=dupa8"]
try:
    subprocess.check_output(check_command, encoding=encoding, errors="ignore")
    # 规则存在则删除
    subprocess.run(["netsh", "advfirewall", "firewall", "delete", "rule", "name=dupa8"])
except subprocess.CalledProcessError:
    # 规则不存在，直接跳过
    pass

# 执行添加规则命令
add_command = [
    "netsh", "advfirewall", "firewall", "add", "rule",
    "name=dupa8", "action=allow", "profile=any",
    "localip=192.162.250.0/24", "remoteip=192.162.250.0/24", "dir=in"
]
out = subprocess.check_output(add_command, encoding=encoding, errors="ignore")
print(f'Out result {out}')

内容的提问来源于stack exchange，提问作者rafaelHTML