Core Concepts of Windows Filtering Platform (WFP)

WFP Layers: Where to Hook In

WFP is layered to reflect the OSI model:

WFP exposes dozens of filtering points called filtering layers – each associated with a part of the network stack.

Some key ones:

Each filter you install must bind to a specific layer. Choosing the wrong one = no filtering or delayed detection.

Filters, Callouts, and Actions

Filters

A filter in WFP is like a rule:

"If traffic matches these conditions, then apply this action."

Each filter:

• Has a layer (e.g., FWPM_LAYER_ALE_AUTH_CONNECT_V4)
• Lives inside a sublayer
• Can match on:
  • Protocol (TCP/UDP)
  • IP addresses
  • Ports
  • Application (path or SID)
  • Packet size, direction, etc.

Example (in plain English):

Block all outbound TCP connections on port 25 unless from smtp.exe.

Actions

Actions determine what happens when a filter is matched:

You use callouts when you want to inspect, modify, log, or analyze data in detail.

Callouts

A callout is a kernel-mode function (registered with FwpsCalloutRegister) that gives you direct access to the packet or stream data.

Use a callout if:

• You need to scan content (DLP)
• You want to redirect traffic (VPN/tunneling)
• You want full control over permit/block decision

Filters can exists without callouts, but callouts cannot exist without filters.

Sublayers and Prioritization

Filters are grouped into sublayers, which:

• Organize filters by purpose or ownership
• Assign priority (lower number = higher priority)
• Enable/disable groups of filters together

You should:

• Create a sublayer for your product (e.g., "MyDLP_Sublayer")
• Use priorities to ensure your filters run before/after Windows Firewall or other apps

Example:

FWPM_SUBLAYER mySublayer = {0};
mySublayer.subLayerKey = MY_SUBLAYER_GUID;
mySublayer.displayData.name = L"My DLP Sublayer";
mySublayer.flags = 0;
mySublayer.weight = FWP_EMPTY; // dynamic priority

FwpmSubLayerAdd(engineHandle, &mySublayer, NULL);

Traffic Flow Through WFP

Let's say an app tries to open a TCP connection:

1. App calls connect() → triggers FWPM_LAYER_ALE_AUTH_CONNECT_V4
2. Filter checks if destination IP/port is allowed
3. If permitted, TCP handshake begins
4. Data is sent → triggers FWPM_LAYER_STREAM_V4
5. Your callout inspects content of stream
6. WFP returns permit/block result

This layered processing allows:

• Early rejection (e.g., block before handshake)
• Deep content scanning (e.g., DLP/antivirus)
• Real-time analytics (e.g., IDS/monitoring)

Choosing the Right Layer

Choosing the wrong layer is the most common WFP mistake.