<p>I have an application that is installed and updated via ClickOnce.  The application downloads files via FTP, and therefore needs to be added as an exception to the windows firewall.  Because of the way that ClickOnce works, the path to the EXE changes with every update, so the exception needs to change also.  What would be the best way to have the changes made to the firewall so that it's <em>invisible</em> to the end user?</p>

<p>(The application is written in C#)</p>

Not sure if this is the best way, but running
netsh
should work:
netsh firewall add allowedprogram C:\MyApp\MyApp.exe MyApp ENABLE
I think this requires Administrator Permissions though,for obvious reasons :)
Edit: I just don't know enough about ClickOnce to know whether or not you can run external programs through it.