IPFilter

IPFilter is a thin C++ wrapper for Windows Filtering Platform (WFP).

IPFilter is supported on clients running Windows 7 and later.

NOTE: Requires elevated user permissions at run time.

Features

• IP packets filtering by layer.
• IP packets filtering by remote IPv4 address.
• IP packets filtering by remote TCP/UDP ports.
• IP packets filtering by application.
• IP packets filtering by remote IPv4 network address.
• IP packets filtering by network interface.

Filter Arbitration

Each layer is divided into sub-layers ordered by weight. The filter arbitration algorithm is applied to all sub-layers within a layer.

Below is an example how filter arbitration works:

+---------------------------------------------------+
|                                                   |
|    Filter   | Weight |   Action    |   Sublayer   |
| ------------------------------------------------- |
| Filter (A)  |    2   | Soft Block  | Sublayer (A) |
| Filter (B)  |    1   | Permit      | Sublayer (A) |
| Filter (C)  |    1   | Permit      | Sublayer (B) |
|                                                   |
+---------------------------------------------------+

                          |  #1 Select one matching filter
                          |     from each sublayer which
                          |     has the highest weight
                          |
                          v

+-------------------------------------------+
|                                           |
|    Filter  | Sublayer Weight |   Action   |
| ----------------------------------------- |
| Filter (A) |        5        | Soft Block |
| Filter (C) |        4        | Permit     |
|                                           |
+-------------------------------------------+

                          |  #2 Make a final decision
                          |     depending on sublayer weight
                          |     and action type
                          |
                          v

                        Permit

Filter arbitration within a sub-layer

1. Computes the list of matching filters ordered by weight. Higher the weight higher the priority.
2. Returns filter with a highest weight.

Filter arbitration within a layer

1. Performs filter arbitration at every sub-layer.
2. Returns resulting action based on the policy rules:
   • Actions are evaluated in priority order of sub-layers from highest priority to lowest.
   • Action Block overrides action Permit.
   • Soft version of Block or Permit actions allows lower priority sub-layer override it's action.