Windows Vista contains a completely new and improved packet filtering engine called Windows Filtering Platform (WFP). Till now, Windows 2000/XP/2003 gave us the packet filtering APIs for implementing simple firewalls or packet filtering applications. However, these packet filtering APIs are discontinued in Vista in favor of WFP. So, here’s an article which shows how to use WFP APIs to write a firewall!
Windows Filtering Platform APIs
These are some of the WFP APIs that we will be using to write our firewall:
FwpmEngineOpen0 - This API is used to create a session with the Windows packet filtering engine.
FwpmSubLayerAdd0 - This API adds a new sub-layer to the packet filtering engine.
FwpmFilterAdd0 - This API adds filters (rules) to a sub-layer. This is analogous to
FwpmFilterDeleteById0 - This API removes existing filters from a sub-layer.
FwpmSubLayerDeleteByKey0 - This API deletes the sub-layer which was added by
FwpmEngineClose0 - This API closes the session opened by
Here are the steps to write a firewall using the above mentioned APIs:
- Create a session using
- Add a sub-layer using
- Now, add filters using
FwpmFilterAdd0. If you have "
n" filters, then this API needs to be called "
That's it! Now, check whether you are able to access the blocked IP address via the Web browser.
Using the Code
This article contains a sample class (
PacketFilter class) which encapsulates the WFP APIs. The class declaration is as shown below:
bool ParseIPAddrString( char* szIpAddr, UINT nStrLen,
BYTE* pbHostOrdr, UINT nByteLen, ULONG& uHexAddr );
DWORD CreateDeleteInterface( bool bCreate );
DWORD BindUnbindInterface( bool bBind );
DWORD AddRemoveFilter( bool bAdd );
void AddToBlockList( char* szIpAddrToBlock );
Follow these steps to use the
PacketFilter class in your application:
- Instantiate an object of
- Add IP addresses to be blocked using the
- Start the firewall using
PacketFilter::StartFirewall public method.
- Finally, terminate the firewall by calling
PacketFilter::Stopfirewall public method.
Points to Note
You need Windows SDK 2008 (available here) to develop applications using Windows Filtering Platform.
Visual C++ 6.0 is incompatible with Windows SDK 2008.
- 31st August, 2008: Initial post