windows filtering platform wfp established rule

Question

windows filtering platform wfp established rule

mikle shild 1

Hi.
I'm new in WFP (Windows filtering platform) and I have some questions. Any body can help me?

I want to block all packets and permit established connection which permit every packet related to established connection. but i didn't know which filters make this rule?
for example I create two filters with layer: FWPM_LAYER_OUTBOUND_TRANSPORT_V4 and FWPM_LAYER_INBOUND_TRANSPORT_V4 which Block packets and create 3rd filter with layer: FWPM_LAYER_ALE_AUTH_CONNECT_V4 and FWPM_LAYER_ALE_AUTH_RECV_V4 with Permit action! but all packets blocked.
any body know how to create this rule?

Jeanine Zhang-MSFT 11,356 Reputation points Microsoft External Staff

2022-09-27T02:27:28.797+00:00

@mikle shild

What do you mean"block all packets and permit established connection which permit every packet related to established connection."?

According to the Doc: Filter Arbitration

Configurable Override Policy:

1,Actions are evaluated in priority order of sub-layers from highest priority to lowest priority.
2,"Block" overrides "Permit".
3,"Block" is final (cannot be overridden) and stops the evaluation. The packet is discarded.
mikle shild 1 Reputation point

2022-09-27T05:53:17.3+00:00

In another words, I want to create iptables new, established and related rules in windows.

iptables document:

NEW -- meaning that the packet has started a new connection, or otherwise associated with a connection which has not seen packets in both directions, and

ESTABLISHED -- meaning that the packet is associated with a connection which has seen packets in both directions,

RELATED -- meaning that the packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer, or an ICMP error.

Do you know which filters can implement this states?
Jeanine Zhang-MSFT 11,356 Reputation points Microsoft External Staff

2022-09-28T06:08:50.247+00:00

According to you description, whether you want to only allow packets that have already established connection to pass? If so.

Each filter layer is divided into sub-layers ordered by priority (also called weight). Network traffic traverses sub-layers from the highest priority to the lowest priority.

You could try to create highest priority with FWPM_LAYER_ALE_AUTH_CONNECT_V4 and FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 to check connection. And then create lowest priority with FWPM_LAYER_OUTBOUND_TRANSPORT_V4 and FWPM_LAYER_INBOUND_TRANSPORT_V4 to block packets.

I suggest you could refer to the Doc: Filter Weight Assignment

Your answer

Jeanine Zhang-MSFT 11,356 Reputation points Microsoft External Staff

2022-09-27T02:27:28.797+00:00

@mikle shild

What do you mean"block all packets and permit established connection which permit every packet related to established connection."?

According to the Doc: Filter Arbitration

Configurable Override Policy:

1,Actions are evaluated in priority order of sub-layers from highest priority to lowest priority.
2,"Block" overrides "Permit".
3,"Block" is final (cannot be overridden) and stops the evaluation. The packet is discarded.
mikle shild 1 Reputation point

2022-09-27T05:53:17.3+00:00

In another words, I want to create iptables new, established and related rules in windows.

iptables document:

NEW -- meaning that the packet has started a new connection, or otherwise associated with a connection which has not seen packets in both directions, and

ESTABLISHED -- meaning that the packet is associated with a connection which has seen packets in both directions,

RELATED -- meaning that the packet is starting a new connection, but is associated with an existing connection, such as an FTP data transfer, or an ICMP error.

Do you know which filters can implement this states?
Jeanine Zhang-MSFT 11,356 Reputation points Microsoft External Staff

2022-09-28T06:08:50.247+00:00

According to you description, whether you want to only allow packets that have already established connection to pass? If so.

Each filter layer is divided into sub-layers ordered by priority (also called weight). Network traffic traverses sub-layers from the highest priority to the lowest priority.

You could try to create highest priority with FWPM_LAYER_ALE_AUTH_CONNECT_V4 and FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 to check connection. And then create lowest priority with FWPM_LAYER_OUTBOUND_TRANSPORT_V4 and FWPM_LAYER_INBOUND_TRANSPORT_V4 to block packets.

I suggest you could refer to the Doc: Filter Weight Assignment

Share via

windows filtering platform wfp established rule

Your answer