Developing a firewall under Windows 2000/XP

Introduced

If you decide to develop Linux under the firewall, you will find a lot of free information and source code. But if it's difficult to develop a firewall under Windows, it's impossible to find the information and code.

So I decided to write this article about the simple way to develop a firewall under Windows 2000/XP.

Background

In Windows DDK, Microsoft includes a new network drive called the Filter-hook driver. You can use it to filter all data entering and exiting the interface.

Because there is very little or no code for this document, I write a successful method of using it to help you understand this simple method.

Filter-hook Drive

As I've just said, Filter-hook Driver is introduced in Microsoft Windows DDK, and in fact, it's not a new network driver, it just expands the functionality of IP filter-driven (IP filter Driver).

In fact, Filter-hook Driver is not a network driver, it is a kernel mode driver (Kernel mode Driver). In general, we provide a callback function (callback) in Filter-hook driver, and then use IP Filter driver to register the callback function. This allows the IP Filter driver to invoke the callback function when the packet is sent and received. So how exactly do we achieve these steps? Summarized as follows:

1 Establish Filter-hook Driver. We have to build kernel mode driver, you can choose Name, DOS name and other drive features, these are not necessary, but I recommend using the description name.

2 If we want to install the filter function, first we must get the pointer to the IP filter driver, this is the second step.

3 We have made the pointer, now we can install the filter function by sending a special IRP, the data passed by the "message" contains a pointer to the filter function.

4) Filtering Packets!!!

5 when we want to end the filter, we have to undo the filter function. This is done by passing the null pointer as the filter function pointer.

Oh, only five steps, it looks very easy, but ... How do I generate kernel-mode drivers? How to get IP Filter driver pointers, how to ... Yes, please wait a moment, I will now explain these steps and provide the source code: P