I started this thread, so for the sake of completeness for anyone searching on these issues later I'm just going to add the last part of what I discovered while investigating the issue ... which is actually pretty bad for anyone wanting to use the Windows 10 Miracast ability, whether to screen mirror to a Roku or anything else. This Firewall REALLY needs sorting out by Avast in this area.
This is for information for anyone interested (which anyone who has followed the advice given to me up thread really should be, given what I've now found) - I have contacted Avast Technical Support about the issues.
To précis what has come so far up above:
Media streaming from e.g. WMP or VLC to a compatible TV or box like a Roku uses DLNA, and THAT uses the normal router network, and almost all of those use one particular one of the sets of IP addresses reserved for use in private networks. Provided you've set up your home router provided network properly, connected the PC and the TV or box to it, and told Avast Firewall it is a private network when you connected the PC to it, Avast's Firewall copes with that kind of streaming without issue. The Avast Firewall decides what IP packets are allowed into the PC based on the IP address they came from: if (profile set to Private) they come from a device with an IP address in one of the ranges defined as 'Friends' in the list you can see by going to Settings>General>Troubleshooting and clicking the 'Open old Settings' link at the bottom, then in the new screen that opens navigate through Components>Firewall Customize>Friends, then the IP packet is allowed in, otherwise (with the default settings) it is blocked. As the replies from TV or box to PC during DLNA streaming use the router supplied addresses, and almost all routers use addresses in the 192.168.1.x range that is defined in Avast as a 'Friend', there's no problem with DLNA media streaming from a media server on the PC to DLNA supporting TV or box as renderer.
Using the Connect in the Action Centre on a Windows 10 (or, I think 8 ... I went from Windows 7 to 10) to mirror the PC screen on a TV (directly, if the TV supports it, or via a box like the Roku) is completely different. It uses Miracast, not DLNA, and Miracast does not use the router based network. It will even work if you turn off the router - or don't have a router network at all. With Miracast an ad hoc WiFi Direct mini network is (or is supposed to be) set up directly between the PC and the Miracast supporting box like the Roku, or a TV directly if the TV supports Miracast itself (mine supports DLNA but not Miracast, so I have to screen mirror via the Roku) when, but only when, the Connect button is pushed and until you press disconnect - this ad hoc Wi-Fi Direct network is NOT on all the time like the router network. And in the ad hoc Wi-Fi Direct network just between PC and box or TV, they are give different IP addresses to the addresses they have in the router network; and CRUCIALLY in the Widows 10 Miracast those addresses are NOT in the 192.168.1.x range but instead in the 172.16.0.0 - 172.31.255.255 range, which is perfectly legitimate as that is another range reserved by the IETF and IANA for use in Private networks, just like the 192.168.x.x range. BUT as supplied by Avast, only the loopback (internal communications between applications within the PC but using the Internet Protocols) and the 192.168.1.x ranges are in the Friends list, NOT the 172.16.0.0 - 172.31.255.255 range or even the rest of the 192.168.x.x range other than the 192.168.1s.
So, with default settings, what happens is:
You press the Connect button in the Action Centre, and the PC tries to establish a Miracast Wi-Fi Direct network with the box or TV. But the Avast Firewall does NOT treat this as joining a network, so there is no popup to let you set it as a private network. The Firewall allows the IP packets out from the PC through the connection to the box and TV, but the replies, with an originating IP not in the Friend list, are treated as Public and blocked by one of the default packet rules (that you cannot turn off). So the connection, the Wi-Fi Direct ad hoc network and the screen mirroring fails.
So that is two strikes by the Avast firewall : it doesn't treat the Miracast ad hoc direct network AS a network, so the user is presented no option to tell Avast it is private (which would let it connect both ways and work); and the default Friends table installed with the Firewall does not contain all - or even most - of the IP ranges that are reserved for and may be used by private networks, including the addresses used by Windows 10 Miracast, whereas if it DID contain the other private ranges again the Miracast would work as the Firewall would apply the private rather than public rules and allow the return IP packets through.
Then one finds the 3rd strike, which is that although the Friends page in the old settings says you can add your own rules, so could add the range used by Miracast, in fact it does not accept any input so you can't.
And then it just gets worse. There IS a configuration option you can change that allows the Miracast to work ... while opening a hole in the firewall defence that presents a vulnerability to a known attack vector that has been used by real malware! The setting is daft in two ways, as well as dangerous. The setting is the 'Internet Connection Sharing mode'. Turn it on, and the Miracast screen mirroring suddenly works. But...
Daftness 1: This setting exists in two places. One is in the Settings>General>Troubleshooting>Open old settings (small print link at the bottom of the page)> Components> firewall customise>Policies page. Seriously? A new user wants to use the PC screen mirroring (or screen extending) Connect button in the W10 Action Centre that always worked before installing any Avast version that has the firewall, and he/she is supposed to find that there? And the second place for the same setting is Settings>Click Search, type ALL of 'geek:area' (the link doesn't appear until you've typed the final a, and it is case sensitive, so not Geek:Area)>click the 'Avast Geek>Secret tech cave of advanced...' link that appears under the search box, then scroll way, way down (maybe 3/4 the way down) to find the cluster of Firewall settings, and there it is. Now, I mean, how is the average user supposed to find that setting in either place to switch it on, just to get their screen mirroring to TV, Roku etc working again? This is NUTS.
Daftness 2: How is someone supposed to realise that 'Internet Connection Sharing mode' is what you need to turn on to get screen mirroring working? Miracast screen mirroring is not Internet Connection Sharing. Windows actually has its OWN setting for 'Internet Connection sharing' called exactly that, and it has nothing to do with the Action Centre Connect button Miracast screen mirroring. The Miracast screen mirroring works when the Windows "Internet Connection Sharing" is turned OFF. How is a user supposed to realise they need to turn an option on in Avast Firewall when the same option is OFF in Windows itself on the PC? But with it off in Windows, it was turning that on in one of those hidden places in Avast that finally let the Miracast screen mirroring to the Roku work.
And then there's the dangerous bit. There's the why it works. As well as using particular IP addresses for the PC and box or TV in the ad hoc Wi-Fi direct network it tries to create, the Windows Miracast specification specifies the use of a particular port - it sets aside port 7236 in the PC for all the incoming Miracast communication through WUDFHost.exe AKA the snappily titled 'Windows Driver Foundation - User-mode Driver Framework Host Process'. Setting 'Internet Connection Sharing mode' in Avast is actually to allow the PC to be used to connect other devices to the internet rather than connecting them to a router, so it is to use the PC as the router for other devices. And those other devices might need to receive and communicate with the PC about all sorts of stuff - music streams, video streams of various kinds, all sorts. So setting that option sets new rules in the Avast firewall to open all sorts of things needed for internet connection sharing with the PC acting as router to incoming traffic, including opening port 7236 for incoming traffic for the 'Windows Driver Foundation - User-mode Driver Framework Host Process', so the Miracast screen mirroring now works. BUT that port is not the only one it opens - it opens other ports to incoming packets relating to Apple streaming, rtsp streaming and other video streaming (amongst other things), and when I went through looking up all the ports it opens to incoming traffic, a bunch of them (not the Miracast or Apple streaming ones) have been used by numerous trojan type malware.
So, the one suggestion to get the Miracast screen sharing working with the Avast firewall is not only to turn on an option without any apparent connection to the Miracast screen Mirroring, and where the matching option in Windows itself may well be turned off; and not only is buried in two very obscure places in settings, so no average user is going to even find the setting, or from the name think it is anything to do with it if they do: but the option also quite unnecessarily (for getting the screen mirroring working) opens a whole bunch of ports to incoming traffic, just to get the one needed port open, many of which have historically been used by real malicious trojan type malware. That option is like using a sledgehammer to crack a walnut, and like the sledgehammer may cause actual ancillary damage.
The ACTUAL solution, with Avast Firewall as it is, is to find out the ip address and port the Miracast screen mirroring uses, then find 'Windows Driver Foundation - User-mode Driver Framework Host Process' in the Application Rules, then open the Packet Rule interface and for that application create a custom 'IN' packet rule for the one port number in actually needs open.
And the average user who may have been using Action Centre Connect button Miracast screen mirroring from their Windows PC to their TV or Roku with no trouble for years while using another Firewall, like me with the Comodo Firewall until a couple of weeks ago, is supposed to know enough to figure this out?
This is shocking. And if the Firewall was supplied with a Friends table that included all the Private IP address ranges - or just all the main ones - NONE of this would have been an issue. It would just have connected, as it would have considered the packets from the Roku as being 'private' and friendly and let them in. Or if it treated ad Hoc Wi-Fi Direct network creation appropriately and let the user just click a pop-up option to set it to 'Private' when one is created: again, no big issue, just one obvious click for the user.
And fix the Friends table input so users CAN enter new IP addresses and ranges if they have a need to (and can find it). The heading of the table SAYS the user can add their own rules, for pity's sake.
Oh well - this has given me a prod to stir my brain to sluggish activity for the first time in around 11 years, and got me to re-learn a little bit of all the internet techie stuff I used to know in the nineties and early noughties. I guess that's something.
