WFP Filtering Conditions Available at Each Filtering Layer (Compact 7)
3/12/2014
The Windows Filtering Platform (WFP) filter engine supports a different set of filtering conditions at each of its filtering layers.
The list of filtering conditions that are available at each layer are as follows.
| Filtering Layer | Filtering Condition |
|---|---|
FWPM_LAYER_INBOUND_IPPACKET_V4 FWPM_LAYER_INBOUND_IPPACKET_V4_DISCARD FWPM_LAYER_INBOUND_IPPACKET_V6 FWPM_LAYER_INBOUND_IPPACKET_V6_DISCARD |
FWPM_CONDITION_FLAGS FWPM_CONDITION_INTERFACE_INDEX FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_OUTBOUND_IPPACKET_V4 FWPM_LAYER_OUTBOUND_IPPACKET_V4_DISCARD FWPM_LAYER_OUTBOUND_IPPACKET_V6 FWPM_LAYER_OUTBOUND_IPPACKET_V6_DISCARD |
FWPM_CONDITION_FLAGS FWPM_CONDITION_INTERFACE_INDEX FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_IPFORWARD_V4 FWPM_LAYER_IPFORWARD_V4_DISCARD FWPM_LAYER_IPFORWARD_V6 FWPM_LAYER_IPFORWARD_V6_DISCARD |
FWPM_CONDITION_FLAGS FWPM_CONDITION_DESTINATION_INTERFACE_INDEX FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX FWPM_CONDITION_IP_DESTINATION_ADDRESS FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_CONDITION_IP_FORWARD_INTERFACE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_SOURCE_ADDRESS FWPM_CONDITION_SOURCE_INTERFACE_INDEX FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX |
FWPM_LAYER_INBOUND_TRANSPORT_V4 FWPM_LAYER_INBOUND_TRANSPORT_V4_DISCARD FWPM_LAYER_INBOUND_TRANSPORT_V6 FWPM_LAYER_INBOUND_TRANSPORT_V6_DISCARD |
FWPM_CONDITION_FLAGS FWPM_CONDITION_INTERFACE_INDEX FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_PROTOCOL FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_IP_REMOTE_PORT FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_OUTBOUND_TRANSPORT_V4 FWPM_LAYER_OUTBOUND_TRANSPORT_V4_DISCARD FWPM_LAYER_OUTBOUND_TRANSPORT_V6 FWPM_LAYER_OUTBOUND_TRANSPORT_V6_DISCARD |
FWPM_CONDITION_FLAGS FWPM_CONDITION_INTERFACE_INDEX FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_PROTOCOL FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_IP_REMOTE_PORT FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_STREAM_V4 FWPM_LAYER_STREAM_V6 |
FWPM_CONDITION_DIRECTION FWPM_CONDITION_FLAGS FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_IP_REMOTE_PORT |
FWPM_LAYER_DATAGRAM_DATA_V4 FWPM_LAYER_DATAGRAM_DATA_V4_DISCARD FWPM_LAYER_DATAGRAM_DATA_V6 FWPM_LAYER_DATAGRAM_DATA_V6_DISCARD |
FWPM_CONDITION_DIRECTION FWPM_CONDITION_FLAGS FWPM_CONDITION_INTERFACE_INDEX FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_PROTOCOL FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_IP_REMOTE_PORT FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_INBOUND_ICMP_ERROR_V4 FWPM_LAYER_INBOUND_ICMP_ERROR_V4_DISCARD FWPM_LAYER_INBOUND_ICMP_ERROR_V6 FWPM_LAYER_INBOUND_ICMP_ERROR_V6_DISCARD |
FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_CONDITION_ARRIVAL_SUB_INTERFACE_INDEX FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_CONDITION_FLAGS FWPM_CONDITION_ICMP_CODE FWPM_CONDITION_ICMP_TYPE FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE FWPM_CONDITION_EMBEDDED_LOCAL_PORT FWPM_CONDITION_EMBEDDED_PROTOCOL FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS FWPM_CONDITION_EMBEDDED_REMOTE_PORT FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_LOCAL_INTERFACE_INDEX FWPM_CONDITION_LOCAL_INTERFACE_TYPE FWPM_CONDITION_LOCAL_TUNNEL_TYPE Windows Vista:
|
FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4 FWPM_LAYER_OUTBOUND_ICMP_ERROR_V4_DISCARD FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6 FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6_DISCARD |
FWPM_CONDITION_FLAGS FWPM_CONDITION_ICMP_CODE FWPM_CONDITION_ICMP_TYPE FWPM_CONDITION_INTERFACE_INDEX FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4 FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V4_DISCARD FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6 FWPM_LAYER_ALE_RESOURCE_ASSIGNMENT_V6_DISCARD |
FWPM_CONDITION_ALE_APP_ID FWPM_CONDITION_ALE_PROMISCUOUS_MODE FWPM_CONDITION_ALE_USER_ID FWPM_CONDITION_FLAGS FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_PROTOCOL FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_ALE_AUTH_LISTEN_V4 FWPM_LAYER_ALE_AUTH_LISTEN_V4_DISCARD FWPM_LAYER_ALE_AUTH_LISTEN_V6 FWPM_LAYER_ALE_AUTH_LISTEN_V6_DISCARD |
FWPM_CONDITION_ALE_APP_ID FWPM_CONDITION_ALE_USER_ID FWPM_CONDITION_FLAGS FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4_DISCARD FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6 FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6_DISCARD |
FWPM_CONDITION_ALE_APP_ID FWPM_CONDITION_ALE_NAP_CONTEXT FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT FWPM_CONDITION_ALE_USER_ID FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE FWPM_CONDITION_ARRIVAL_SUB_INTERFACE_INDEX FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE FWPM_CONDITION_FLAGS FWPM_CONDITION_IP_ARRIVAL_INTERFACE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_PROTOCOL FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_IP_REMOTE_PORT FWPM_CONDITION_LOCAL_INTERFACE_INDEX FWPM_CONDITION_LOCAL_INTERFACE_TYPE FWPM_CONDITION_LOCAL_TUNNEL_TYPE Windows Vista:
|
FWPM_LAYER_ALE_AUTH_CONNECT_V4 FWPM_LAYER_ALE_AUTH_CONNECT_V4_DISCARD FWPM_LAYER_ALE_AUTH_CONNECT_V6 FWPM_LAYER_ALE_AUTH_CONNECT_V6_DISCARD |
FWPM_CONDITION_ALE_APP_ID FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_CONDITION_ALE_USER_ID FWPM_CONDITION_FLAGS FWPM_CONDITION_INTERFACE_INDEX FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_PROTOCOL FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_IP_REMOTE_PORT FWPM_CONDITION_SUB_INTERFACE_INDEX FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4 FWPM_LAYER_ALE_FLOW_ESTABLISHED_V4_DISCARD FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6 FWPM_LAYER_ALE_FLOW_ESTABLISHED_V6_DISCARD |
FWPM_CONDITION_ALE_APP_ID FWPM_CONDITION_ALE_REMOTE_MACHINE_ID FWPM_CONDITION_ALE_REMOTE_USER_ID FWPM_CONDITION_ALE_USER_ID FWPM_CONDITION_DIRECTION FWPM_CONDITION_FLAGS FWPM_CONDITION_INTERFACE_TYPE FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE FWPM_CONDITION_IP_LOCAL_INTERFACE FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_PROTOCOL FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_IP_REMOTE_PORT FWPM_CONDITION_TUNNEL_TYPE |
FWPM_LAYER_IPSEC_KM_DEMUX_V4 FWPM_LAYER_IPSEC_KM_DEMUX_V6 |
FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_REMOTE_ADDRESS |
FWPM_LAYER_IPSEC_V4 FWPM_LAYER_IPSEC_V6 |
FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_PROTOCOL FWPM_CONDITION_IP_REMOTE_ADDRESS FWPM_CONDITION_IP_REMOTE_PORT |
FWPM_LAYER_IKEEXT_V4 FWPM_LAYER_IKEEXT_V6 |
FWPM_CONDITION_IP_LOCAL_ADDRESS FWPM_CONDITION_IP_REMOTE_ADDRESS |
FWPM_LAYER_RPC_UM |
FWPM_CONDITION_DCOM_APP_ID FWPM_CONDITION_IMAGE_NAME FWPM_CONDITION_IP_LOCAL_ADDRESS_V4 FWPM_CONDITION_IP_LOCAL_ADDRESS_V6 FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_REMOTE_ADDRESS_V4 FWPM_CONDITION_IP_REMOTE_ADDRESS_V6 FWPM_CONDITION_PIPE FWPM_CONDITION_REMOTE_USER_TOKEN FWPM_CONDITION_RPC_AUTH_LEVEL FWPM_CONDITION_RPC_AUTH_TYPE FWPM_CONDITION_RPC_IF_FLAG FWPM_CONDITION_RPC_IF_UUID FWPM_CONDITION_RPC_IF_VERSION FWPM_CONDITION_RPC_PROTOCOL FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM FWPM_CONDITION_SEC_KEY_SIZE |
FWPM_LAYER_RPC_EPMAP |
FWPM_CONDITION_IP_LOCAL_ADDRESS_V4 FWPM_CONDITION_IP_LOCAL_ADDRESS_V6 FWPM_CONDITION_IP_LOCAL_PORT FWPM_CONDITION_IP_REMOTE_ADDRESS_V4 FWPM_CONDITION_IP_REMOTE_ADDRESS_V6 FWPM_CONDITION_PIPE FWPM_CONDITION_REMOTE_USER_TOKEN FWPM_CONDITION_RPC_AUTH_LEVEL FWPM_CONDITION_RPC_AUTH_TYPE FWPM_CONDITION_RPC_IF_UUID FWPM_CONDITION_RPC_IF_VERSION FWPM_CONDITION_RPC_PROTOCOL FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM FWPM_CONDITION_SEC_KEY_SIZE |
FWPM_LAYER_RPC_EP_ADD |
FWPM_CONDITION_PROCESS_WITH_RPC_IF_UUID FWPM_CONDITION_RPC_EP_FLAGS FWPM_CONDITION_RPC_EP_VALUE FWPM_CONDITION_RPC_PROTOCOL |
FWPM_LAYER_RPC_PROXY_CONN |
FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH FWPM_CONDITION_CLIENT_CERT_OID FWPM_CONDITION_CLIENT_TOKEN FWPM_CONDITION_RPC_PROXY_AUTH_TYPE FWPM_CONDITION_RPC_SERVER_NAME FWPM_CONDITION_RPC_SERVER_PORT |
FWPM_LAYER_RPC_PROXY_IF |
FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH FWPM_CONDITION_CLIENT_CERT_OID FWPM_CONDITION_CLIENT_TOKEN FWPM_CONDITION_RPC_IF_UUID FWPM_CONDITION_RPC_IF_VERSION FWPM_CONDITION_RPC_PROXY_AUTH_TYPE FWPM_CONDITION_RPC_SERVER_NAME FWPM_CONDITION_RPC_SERVER_PORT |
Remarks
The V4 and V6 suffixes at the end of the layer identifiers indicate whether the layer is located in the IPv4 network stack or in the IPv6 network stack.