Click here to Skip to main content
Click here to Skip to main content

Firewall using Vista's Windows Filtering Platform APIs

, 2 Sep 2008 CPOL
Rate this:
Please Sign up or sign in to vote.
An article on using Windows Filtering Platform of Vista to write a simple firewall

Introduction

Windows Vista contains a completely new and improved packet filtering engine called Windows Filtering Platform (WFP). Till now, Windows 2000/XP/2003 gave us the packet filtering APIs for implementing simple firewalls or packet filtering applications. However, these packet filtering APIs are discontinued in Vista in favor of WFP. So, here’s an article which shows how to use WFP APIs to write a firewall!

Windows Filtering Platform APIs

These are some of the WFP APIs that we will be using to write our firewall:

  • FwpmEngineOpen0 - This API is used to create a session with the Windows packet filtering engine.
  • FwpmSubLayerAdd0 - This API adds a new sub-layer to the packet filtering engine.
  • FwpmFilterAdd0 - This API adds filters (rules) to a sub-layer. This is analogous to PfAddFiltersToInterface API.
  • FwpmFilterDeleteById0 - This API removes existing filters from a sub-layer.
  • FwpmSubLayerDeleteByKey0 - This API deletes the sub-layer which was added by FwpmSubLayerAdd0.
  • FwpmEngineClose0 - This API closes the session opened by FwpmEngineOpen0.

Here are the steps to write a firewall using the above mentioned APIs:

  • Create a session using FwpmEngineOpen0.
  • Add a sub-layer using FwpmSubLayerAdd0.
  • Now, add filters using FwpmFilterAdd0. If you have "n" filters, then this API needs to be called "n" times.

That's it! Now, check whether you are able to access the blocked IP address via the Web browser.

Using the Code

This article contains a sample class (PacketFilter class) which encapsulates the WFP APIs. The class declaration is as shown below:

class PacketFilter
{
private:
    // Firewall engine handle.
    HANDLE m_hEngineHandle;

    // Firewall sublayer GUID.
    GUID m_subLayerGUID;

    // List of filters.
    IPFILTERINFOLIST m_lstFilters;

    // Method to get byte array format and hex format IP address from string format.
    bool ParseIPAddrString( char* szIpAddr, UINT nStrLen, 
        BYTE* pbHostOrdr, UINT nByteLen, ULONG& uHexAddr );

    // Method to create/delete packet filter interface.
    DWORD CreateDeleteInterface( bool bCreate );

    // Method to bind/unbind to/from packet filter interface.
    DWORD BindUnbindInterface( bool bBind );

    // Method to add/remove filter.
    DWORD AddRemoveFilter( bool bAdd );

public:
    // Constructor.
    PacketFilter();

    // Destructor.
    ~PacketFilter();

    // Method to add IP addresses to m_lstFilters list.
    void AddToBlockList( char* szIpAddrToBlock );

    // Method to start packet filter.
    BOOL StartFirewall();

    // Method to stop packet filter.
    BOOL StopFirewall();
};

Follow these steps to use the PacketFilter class in your application:

  • Instantiate an object of PacketFilter class.
  • Add IP addresses to be blocked using the public method PacketFilter::AddToBlockList.
  • Start the firewall using PacketFilter::StartFirewall public method.
  • Finally, terminate the firewall by calling PacketFilter::Stopfirewall public method.

Points to Note

You need Windows SDK 2008 (available here) to develop applications using Windows Filtering Platform.
Visual C++ 6.0 is incompatible with Windows SDK 2008.

History

  • 31st August, 2008: Initial post

License

This article, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Share

About the Author

MaheshSatya
Software Developer
India India
No Biography provided

Comments and Discussions

 
QuestionWili not releasing all IPs. PinmemberMable John27-Mar-13 6:18 
GeneralMy vote of 1 PinmemberLavrekho17-Aug-12 3:29 
QuestionWFP, Wireless Hosted Network and ICS Pinmemberjcgalveza6-Apr-12 8:44 
QuestionAccess Denied error for FwpmFilterAdd0 function Pinmemberchathura66631-Mar-12 2:44 
QuestionHow to implement firewall for windows XP and newer windows using win32 sdk Pinmemberamityadav4a3-Mar-12 23:54 
Questionneed help Pinmemberlianayizu016-Feb-12 20:15 
QuestionIt dosen't work at all??? Why??? PinmemberDavidChuBuaa24-Oct-10 5:30 
GeneralComplete project. Pinmemberbx35-Aug-10 19:19 
GeneralWhitelist Pinmemberbx33-Aug-10 10:51 
GeneralDoes not seem to work Pinmemberkrieg383-Mar-10 5:46 
GeneralRe: Does not seem to work Pinmemberkrieg384-Mar-10 2:06 
Questionkernel mode v/s usr mode Pinmemberhardik_suri25-Feb-10 7:01 
AnswerRe: kernel mode v/s usr mode PinmemberMember 814623625-Feb-12 22:56 
GeneralError starting firewall. GetLastError() Pinmembersireeshaj3-Dec-09 22:58 
GeneralRe: Error starting firewall. GetLastError() PinmemberYaniv Mesika25-Dec-09 10:13 
GeneralRe: Error starting firewall. GetLastError() Pinmembericl777-Apr-10 3:20 
GeneralMy vote of 1 Pinmemberasdasdasdasasd13-Sep-09 14:09 
GeneralMy vote of 1 Pinmembernnm10-Sep-09 13:43 
Questionhelp needed Pinmembericehottopes6-Aug-09 4:12 
QuestionHow Can i make a managed wrapper to the PacketFilter class to use in C# Pinmemberg k h srinivas21-Sep-08 21:26 
AnswerRe: How Can i make a managed wrapper to the PacketFilter class to use in C# PinmemberMaheshSatya22-Sep-08 2:18 
GeneralRe: How Can i make a managed wrapper to the PacketFilter class to use in C# [modified] Pinmemberg k h srinivas23-Sep-08 23:48 
GeneralRe: How Can i make a managed wrapper to the PacketFilter class to use in C# PinmemberMohammed Abed31-Mar-09 11:56 
QuestionOpposite? Pinmembersidrol18-Sep-08 8:13 
AnswerRe: Opposite? Pinmembersuren_hisxlnc8-Sep-09 21:13 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Mobile
Web03 | 2.8.141022.2 | Last Updated 2 Sep 2008
Article Copyright 2008 by MaheshSatya
Everything else Copyright © CodeProject, 1999-2014
Terms of Service
Layout: fixed | fluid