I believe that WIPFW uses the IP Filter-Hook driver method. This is basically a Kernel Mode driver that registers a callback function with the IP Filter Driver. Most products don't use this method because only one app can register to be the callback function. If another app registers, this no longer works.

Using this method you can filter IP traffic and above but you don't have access to any lower-level headers.

It's really not the best method for developing firewalls, but I have to admit the tool is still very cool and it does have some promise. Ultimately, the problem is with the way Windows limits the how you can build stable, full-featured, and high-performance firewalls.

This column is a somewhat simplified view of the problem. There are many other details and idiosyncrasies that I just couldn't cover.

Mark

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/307/30960#30960