如何通过编程向Windows防火墙规则添加IPv6地址

现有VB.NET代码可正常向Windows防火墙规则添加IPv4地址，但添加IPv6地址时操作失败，原实现代码如下：

Imports NetFwTypeLib
Imports System.Net

Public Class Firewall
    Implements IDisposable
    Private _policy As INetFwPolicy2 = Nothing

    Private ReadOnly Property Policy As INetFwPolicy2
        Get
            If _policy Is Nothing Then
                _policy = DirectCast(Activator.CreateInstance(Type.GetTypeFromProgID("HNetCfg.FwPolicy2")), INetFwPolicy2)
            End If
            Return _policy
        End Get
    End Property

    Public Sub Add(ipAddress As String, ruleName As String)
        Dim firewallRule As NetFwTypeLib.INetFwRule = Policy.Rules.Item(ruleName)
        'Dim NewAddress As String = ipAddress.ToString & "/255.255.255.255"
        Dim NewAddress As String = ipAddress.ToString
        If Not firewallRule.RemoteAddresses.Contains(NewAddress) Then
            firewallRule.RemoteAddresses += "," & NewAddress
        End If
    End Sub
End Class

• Windows防火墙INetFwRule接口对IPv6地址有严格格式要求：单IPv6主机必须明确指定128位前缀长度（等价于IPv4的255.255.255.255主机掩码），直接传入裸IPv6地址会被判定为无效格式，无法写入规则。
• 带区域ID的链路本地IPv6地址（格式类似fe80::xxxx%网卡索引）包含%特殊字符，防火墙规则不识别该后缀，直接传入会触发解析错误。
• 原逻辑用字符串Contains做地址去重不可靠：IPv6存在多种等价表达（零压缩、全写、省略前导零等），简单字符串匹配会出现重复添加、误判已存在的问题；同时未处理原有地址列表为空的场景，会在地址开头写入多余逗号导致规则损坏。
• 若规则本身仅配置为IPv4协议生效，即使地址写入成功，IPv6规则也不会触发。

以下代码可同时兼容IPv4、IPv6地址添加，包含格式校验、自动适配地址格式、去重、COM对象释放逻辑：

Imports NetFwTypeLib
Imports System.Net
Imports System.Runtime.InteropServices

Public Class Firewall
    Implements IDisposable
    Private _policy As INetFwPolicy2 = Nothing

    Private ReadOnly Property Policy As INetFwPolicy2
        Get
            If _policy Is Nothing Then
                _policy = DirectCast(Activator.CreateInstance(Type.GetTypeFromProgID("HNetCfg.FwPolicy2")), INetFwPolicy2)
            End If
            Return _policy
        End Get
    End Property

    Public Sub Add(ipAddress As String, ruleName As String)
        ' 校验IP格式合法性
        Dim parsedIp As IPAddress = Nothing
        If Not IPAddress.TryParse(ipAddress, parsedIp) Then
            Throw New ArgumentException("IP地址格式非法", NameOf(ipAddress))
        End If

        ' 生成符合防火墙要求的标准地址字符串
        Dim ruleFmtAddress As String
        If parsedIp.AddressFamily = Sockets.AddressFamily.InterNetwork Then
            ' IPv4单主机指定全掩码
            ruleFmtAddress = $"{parsedIp}/255.255.255.255"
        Else
            ' IPv6单主机指定/128前缀，剥离区域ID后缀
            Dim ipv6NoScope = parsedIp.ToString().Split("%"c)(0)
            ruleFmtAddress = $"{ipv6NoScope}/128"
        End If

        Dim targetRule As INetFwRule = Policy.Rules.Item(ruleName)
        ' 拆分现有地址列表做精确去重
        Dim existAddrList = targetRule.RemoteAddresses.
            Split(","c, StringSplitOptions.RemoveEmptyEntries).
            Select(Function(addr) addr.Trim()).
            ToList()

        If Not existAddrList.Contains(ruleFmtAddress, StringComparer.OrdinalIgnoreCase) Then
            targetRule.RemoteAddresses = If(
                String.IsNullOrWhiteSpace(targetRule.RemoteAddresses),
                ruleFmtAddress,
                $"{targetRule.RemoteAddresses.TrimEnd(","c)},{ruleFmtAddress}"
            )
        End If
    End Sub

    Public Sub Dispose() Implements IDisposable.Dispose
        If _policy IsNot Nothing Then
            Marshal.ReleaseComObject(_policy)
            _policy = Nothing
        End If
    End Sub
End Class

操作Windows防火墙规则需要程序持有管理员权限，否则会抛出权限不足异常。

• 若需添加IPv6网段，直接修改前缀长度即可，例如本地链路网段写法为fe80::/10，唯一本地地址段写法为fd00::/8，禁止给IPv6地址使用IPv4格式的点分十进制子网掩码。
• 需确认目标规则的协议配置同时启用IPv4、IPv6生效，否则添加的IPv6地址不会匹配流量。
• 不要在地址字符串中加入多余空格，否则会被防火墙判定为无效地址。

内容的提问来源于stack exchange，提问作者chandan singh