FIREWALL BUILDER FOR WINDOWS 2000 INSTALL
FIREWALL BUILDER FOR WINDOWS 2000 DRIVERS

But be patient, we can learn more about it later.Īs Filter-Hook driver, Firewall-Hook driver is only a kernel mode driver used to install a callback function (but Firewall-Hook driver installs a callback in IP driver). It's more similar to the structure of packets you can find in a NDIS driver, where the total packet is composed by a chain of buffers. The structure of data received in a Firewall-Hook filter function is more complex than the one received in Filter-Hook driver. However, you can access all data with a Firewall-Hook driver.

FIREWALL BUILDER FOR WINDOWS 2000 DRIVERS

So, IP driver drops the packet and does not continue calling the next filter functions.Īnother problem you can find with Filter-Hook drivers is that for sent packets, you can't access packet content data. In this case, Filter function 2 returns ' DROP PACKET'.

Because Filter function 1 allows the packet, IP driver passes the packet to the next filter function: Filter function 2.Filter function 1 returns ' ALLOW PACKET'.First, IP driver passes the packet to the highest priority filter function and waits for the return value.IP driver has the list of filter functions ordered by priority (the function with more priority is Filter Function 1). In the figure, I represent the next process: The order of each function in the chain is given by its priority value. This chain is broken when one of them returns ' DROP PACKET'. You can imagine it as a chain of filter functions. If all functions return ' ALLOW PACKET', the packet will be allowed. Each filter function has a priority assigned, so the system will call one function after another (in priority order) until a function returns ' DROP PACKET'. You can install all filter functions you need. With Firewall-Hook driver, you don't have this problem. If one application already uses this functionality, your application doesn't work.

If you remember, Filter-Hook driver only allows one filter function installed in the system. Basically, a Firewall-Hook driver can do the same work that a Filter Hook driver can do (see my article, Developing Firewalls for Windows 2000/XP, to get more information) but with less restrictions. It's true that I never recommend it when you want to develop a complete firewall solution, but for small applications, it can be a good alternative. I don't understand why Microsoft doesn't recommend the development of Firewall-Hook drivers. However, because it's an easy method to implement firewall solutions, I think it is interesting to know how Firewall-Hook drivers work. In the next versions of DDK, Microsoft adds a few documentation about it: 'this method exists but it is not recommended to implement'. h (and its contents!) because no documentation about the existence of Firewall hook could be read. In fact, when I installed the Windows 2000 DDK, I was very surprised when I found this. Microsoft doesn't give any documentation about it, and the only place where you can learn something is in the DDK header files ( ipFirewall.h). Probably, Firewall-Hook driver is one of the most undocumented methods a developer can use to develop packet filtering applications in Windows systems.

Firewall builder for windows 2000