Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,170 questions
windows filtering platform wfp established rule
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(214.4, 46%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMS%3C/text%3E%3C/svg%3E)
mikle shild
1
Reputation point
Hi.
I'm new in WFP (Windows filtering platform) and I have some questions. Any body can help me?
- I want to block all packets and permit established connection which permit every packet related to established connection. but i didn't know which filters make this rule?
for example I create two filters with layer: FWPM_LAYER_OUTBOUND_TRANSPORT_V4 and FWPM_LAYER_INBOUND_TRANSPORT_V4 which Block packets and create 3rd filter with layer: FWPM_LAYER_ALE_AUTH_CONNECT_V4 and FWPM_LAYER_ALE_AUTH_RECV_V4 with Permit action! but all packets blocked.
any body know how to create this rule?
Windows Server
Windows API - Win32
Windows API - Win32
A core set of Windows application programming interfaces (APIs) for desktop and server applications. Previously known as Win32 API.
2,426 questions
Windows Network
Windows Network
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.Network: A group of devices that communicate either wirelessly or via a physical connection.
653 questions
{count} votes
-
Jeanine Zhang-MSFT 9,181 Reputation points Microsoft Vendor2022-09-27T02:27:28.797+00:00 What do you mean"block all packets and permit established connection which permit every packet related to established connection."?
According to the Doc: Filter Arbitration
Configurable Override Policy:
1,Actions are evaluated in priority order of sub-layers from highest priority to lowest priority.
2,"Block" overrides "Permit".
3,"Block" is final (cannot be overridden) and stops the evaluation. The packet is discarded. -
mikle shild 1 Reputation point
2022-09-27T05:53:17.3+00:00 In another words, I want to create iptables new, established and related rules in windows.
iptables document:
NEW -- meaning that the packet has started a new connection, or otherwise associated with a connection which has not seen packets in both directions, and
ESTABLISHED -- meaning that the packet is associated with a connection which has seen packets in both directions,
RELATED -- meaning that the packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer, or an ICMP error.
Do you know which filters can implement this states?
-
Jeanine Zhang-MSFT 9,181 Reputation points Microsoft Vendor
2022-09-28T06:08:50.247+00:00 According to you description, whether you want to only allow packets that have already established connection to pass? If so.
Each filter layer is divided into sub-layers ordered by priority (also called weight). Network traffic traverses sub-layers from the highest priority to the lowest priority.
You could try to create highest priority with FWPM_LAYER_ALE_AUTH_CONNECT_V4 and FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 to check connection. And then create lowest priority with FWPM_LAYER_OUTBOUND_TRANSPORT_V4 and FWPM_LAYER_INBOUND_TRANSPORT_V4 to block packets.
I suggest you could refer to the Doc: Filter Weight Assignment
Sign in to comment