fix Windows firewall rules and allow to disable firewall manipulation

stack_system.go

@@ -46,6 +46,7 @@ type System struct {
 	interfaceFinder    control.InterfaceFinder
 	frontHeadroom      int
 	txChecksumOffload  bool
+	disableFirewallFix bool
 }
 
 type Session struct {
@@ -69,6 +70,7 @@ func NewSystem(options StackOptions) (Stack, error) {
 		broadcastAddr:      BroadcastAddr(options.TunOptions.Inet4Address),
 		bindInterface:      options.ForwarderBindInterface,
 		interfaceFinder:    options.InterfaceFinder,
+		disableFirewallFix: options.TunOptions.EXP_DisableFirewallFix,
 	}
 	if len(options.TunOptions.Inet4Address) > 0 {
 		if !HasNextAddress(options.TunOptions.Inet4Address[0], 1) {
@@ -107,9 +109,12 @@ func (s *System) Start() error {
 }
 
 func (s *System) start() error {
-	err := fixWindowsFirewall()
+	var err error
+	if !s.disableFirewallFix {
+		err = fixWindowsFirewall()
 		if err != nil {
-		return E.Cause(err, "fix windows firewall for system stack")
+			s.logger.Error(E.Cause(err, "fix windows firewall for system stack"))
+		}
 	}
 	var listener net.ListenConfig
 	if s.bindInterface {

stack_system_windows.go

@@ -15,15 +15,25 @@ func fixWindowsFirewall() error {
 	if err != nil {
 		return err
 	}
-	rule := winfw.FWRule{
+	_, err = winfw.FirewallRuleAddAdvanced(winfw.FWRule{
 		Name:            "sing-tun (" + absPath + ")",
 		ApplicationName: absPath,
 		Enabled:         true,
 		Protocol:        winfw.NET_FW_IP_PROTOCOL_TCP,
 		Direction:       winfw.NET_FW_RULE_DIR_IN,
 		Action:          winfw.NET_FW_ACTION_ALLOW,
+	})
+	if err != nil {
+		return err
 	}
-	_, err = winfw.FirewallRuleAddAdvanced(rule)
+	_, err = winfw.FirewallRuleAddAdvanced(winfw.FWRule{
+		Name:            "sing-tun UDP (" + absPath + ")",
+		ApplicationName: absPath,
+		Enabled:         true,
+		Protocol:        winfw.NET_FW_IP_PROTOCOL_UDP,
+		Direction:       winfw.NET_FW_RULE_DIR_IN,
+		Action:          winfw.NET_FW_ACTION_ALLOW,
+	})
 	return err
 }
 

tun.go

@@ -88,6 +88,7 @@ type Options struct {
 
 	// For library usages.
 	EXP_DisableDNSHijack   bool
+	EXP_DisableFirewallFix bool
 }
 
 func (o *Options) Inet4GatewayAddr() netip.Addr {