Edit

Filtering condition identifiers

  • Article

The filtering condition identifiers are each represented by a GUID. These identifiers are described in the following table.

Filtering condition identifier Description
FWPM_CONDITION_ARRIVAL_INTERFACE_INDEX The index of the arrival network interface, as enumerated by the network stack.
WFP uses the Arrival interface to match this condition. The Arrival Interface is the first interface the packet sees before entering the IP stack inbound from the network, before weak-host or forwarding are performed.
This condition is asymmetric for reauthorization purposes, as it is intrinsically an inbound condition. This means that WFP will use an empty value on this condition when reauthorizing an inbound connection on a response outbound packet.
To handle reauthorization a second filter must be used. This second filter can either permit or block the empty values, or use a different condition that will have a valid value for such circumstance. In the case of arrival interface conditions, the next hop class of interface conditions will have a valid interface on outbound packets.
Note that this is available only in Windows Server 2008 R2, Windows 7, and later versions of Windows.
FWPM_CONDITION_ARRIVAL_INTERFACE_TYPE The type of the arrival network interface, as defined by the Internet Assigned Numbers Authority (IANA). For more information, see IANAifType-MIB Definitions.
WFP uses the Arrival interface to match this condition. The Arrival Interface is the first interface the packet sees before entering the IP stack inbound from the network, before weak-host or forwarding are performed.
This condition is asymmetric for reauthorization purposes, as it is intrinsically an inbound condition. This means that WFP will use an empty value on this condition when reauthorizing an inbound connection on a response outbound packet.
To handle reauthorization a second filter must be used. This second filter can either permit or block the empty values, or use a different condition that will have a valid value for such circumstance. In the case of arrival interface conditions, the next hop class of interface conditions will have a valid interface on outbound packets.
Note that this is vailable only in Windows Server 2008 R2, Windows 7, and later versions of Windows.
FWPM_CONDITION_ARRIVAL_TUNNEL_TYPE The encapsulation method used by a tunnel if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by the IANA. For more information, see IANAifType-MIB Definitions and the Windows SDK IP Helper documentation.
WFP uses the Arrival interface to match this condition. The Arrival Interface is the first interface the packet sees before entering the IP stack inbound from the network, before weak-host or forwarding are performed.
This condition is asymmetric for reauthorization purposes, as it is intrinsically an inbound condition. This means that WFP will use an empty value on this condition when reauthorizing an inbound connection on a response outbound packet.
To handle reauthorization a second filter must be used. This second filter can either permit or block the empty values, or use a different condition that will have a valid value for such circumstance. In the case of arrival interface conditions, the next hop class of interface conditions will have a valid interface on outbound packets.
Note that this is available only in Windows Server 2008 R2, Windows 7, and later versions of Windows.
FWPM_CONDITION_IP_ARRIVAL_INTERFACE The LUID for the network interface that is associated with the arrival IP address.
WFP uses the Arrival interface to match this condition. The Arrival Interface is the first interface the packet sees before entering the IP stack inbound from the network, before weak-host or forwarding are performed.
This condition is asymmetric for reauthorization purposes, as it is intrinsically an inbound condition. This means that WFP will use an empty value on this condition when reauthorizing an inbound connection on a response outbound packet.
To handle reauthorization a second filter must be used. This second filter can either permit or block the empty values, or use a different condition that will have a valid value for such circumstance. In the case of arrival interface conditions, the next hop class of interface conditions will have a valid interface on outbound packets.
Note that this is available only in Windows Server 2008 R2, Windows 7, and later versions of Windows.
FWPM_CONDITION_NEXTHOP_INTERFACE_INDEX The index of the arrival network interface, as enumerated by the network stack.
WFP uses the Next Hop interface to match this condition. The Next Hop Interface is the last interface the packet sees before leaving the IP stack outbound towards the network, after weak-host or forwarding are performed.
This condition is asymmetric for reauthorization purposes, as it is intrinsically an outbound condition. This means that WFP will use an empty value on this condition when reauthorizing an outbound connection on a response inbound packet.
To handle reauthorization a second filter must be used. This second filter can either permit or block the empty values, or use a different condition that will have a valid value for such circumstance. In the case of next hop interface conditions, the arrival class of interface conditions will have a valid interface on inbound packets.
Note that this is available only in Windows Server 2008 R2, Windows 7, and later versions of Windows.
FWPM_CONDITION_NEXTHOP_INTERFACE_TYPE The type of the arrival network interface, as defined by the Internet Assigned Numbers Authority (IANA). For more information, see IANAifType-MIB Definitions.
WFP uses the Next Hop interface to match this condition. The Next Hop Interface is the last interface the packet sees before leaving the IP stack outbound towards the network, after weak-host or forwarding are performed.
This condition is asymmetric for reauthorization purposes, as it is intrinsically an outbound condition. This means that WFP will use an empty value on this condition when reauthorizing an outbound connection on a response inbound packet.
To handle reauthorization a second filter must be used. This second filter can either permit or block the empty values, or use a different condition that will have a valid value for such circumstance. In the case of next hop interface conditions, the arrival class of interface conditions will have a valid interface on inbound packets.
Note that this is available only in Windows Server 2008 R2, Windows 7, and later versions of Windows.
FWPM_CONDITION_NEXTHOP_TUNNEL_TYPE The encapsulation method used by a tunnel if the IfType member of the IP_ADAPTER_ADDRESSES structure is IF_TYPE_TUNNEL. The tunnel type is defined by the IANA. For more information, see IANAifType-MIB Definitions and the Windows SDK IP Helper documentation.
WFP uses the Next Hop interface to match this condition. The Next Hop Interface is the last interface the packet sees before leaving the IP stack outbound towards the network, after weak-host or forwarding are performed.
This condition is asymmetric for reauthorization purposes, as it is intrinsically an outbound condition. This means that WFP will use an empty value on this condition when reauthorizing an outbound connection on a response inbound packet.
To handle reauthorization a second filter must be used. This second filter can either permit or block the empty values, or use a different condition that will have a valid value for such circumstance. In the case of next hop interface conditions, the arrival class of interface conditions will have a valid interface on inbound packets.
Note that this is available only in Windows Server 2008 R2, Windows 7, and later versions of Windows.
FWPM_CONDITION_IP_NEXTHOP_INTERFACE The LUID for the network interface that is associated with the arrival IP addres
WFP uses the Next Hop interface to match this condition. The Next Hop Interface is the last interface the packet sees before leaving the IP stack outbound towards the network, after weak-host or forwarding are performed.
This condition is asymmetric for reauthorization purposes, as it is intrinsically an outbound condition. This means that WFP will use an empty value on this condition when reauthorizing an outbound connection on a response inbound packet.
To handle reauthorization a second filter must be used. This second filter can either permit or block the empty values, or use a different condition that will have a valid value for such circumstance. In the case of next hop interface conditions, the arrival class of interface conditions will have a valid interface on inbound packets.
Note that this is available only in Windows Server 2008 R2, Windows 7, and later versions of Windows.
FWPM_CONDITION_IP_LOCAL_ADDRESS The local IP address.
FWPM_CONDITION_IP_REMOTE_ADDRESS The remote IP address.
FWPM_CONDITION_IP_SOURCE_ADDRESS The source IP address for forwarded packets.
FWPM_CONDITION_IP_DESTINATION_ADDRESS The destination IP address for forwarded packets.
FWPM_CONDITION_IP_LOCAL_ADDRESS_TYPE The local IP address type. The possible condition values are:
- NlatUnspecified
- NlatUnicast
- NlatAnycast
- NlatMulticast
- NlatBroadcast
FWPM_CONDITION_IP_DESTINATION_ADDRESS_TYPE The destination IP address type. The possible condition values are:
- NlatUnspecified
- NlatUnicast
- NlatAnycast
- NlatMulticast
- NlatBroadcast
FWPM_CONDITION_IP_LOCAL_INTERFACE The LUID for the network interface associated with the local IP address.
FWPM_CONDITION_IP_FORWARD_INTERFACE The LUID for the network interface on which the packet being forwarded is to be sent out.
FWPM_CONDITION_IP_PROTOCOL The IP protocol number, as specified in RFC 1700.
FWPM_CONDITION_IP_LOCAL_PORT The local transport protocol port number.
FWPM_CONDITION_IP_REMOTE_PORT The remote transport protocol port number.
FWPM_CONDITION_ICMP_TYPE The ICMP type field, as specified in RFC 792.
FWPM_CONDITION_ICMP_CODE The ICMP code field, as specified in RFC 792.
FWPM_CONDITION_EMBEDDED_LOCAL_ADDRESS_TYPE The local IP address type that is embedded in the ICMP packet. The possible condition values are:
- NlatUnspecified
- NlatUnicast
- NlatAnycast
- NlatMulticast
- NlatBroadcast
FWPM_CONDITION_EMBEDDED_REMOTE_ADDRESS The remote IP address that is embedded in the ICMP packet.
FWPM_CONDITION_EMBEDDED_PROTOCOL The IP protocol number that is embedded in the ICMP packet, as specified in RFC 1700.
FWPM_CONDITION_EMBEDDED_LOCAL_PORT The local transport protocol port number that is embedded in the ICMP packet.
FWPM_CONDITION_EMBEDDED_REMOTE_PORT The remote transport protocol port number that is embedded in the ICMP packet.
FWPM_CONDITION_FLAGS A bitwise OR of a combination of filtering condition flags. For information about the possible flags, see Filtering Condition Flags.
FWPM_CONDITION_DIRECTION The direction of the datagram traffic or data flow. The possible condition values are:
- FWP_DIRECTION_INBOUND
- FWP_DIRECTION_OUTBOUND

In datagram data layers and stream packet layers, this condition specifies the direction of the packet.
In stream layers and ALE flow established layers, this condition specifies the direction of the connection (for example, when a local application initiates the connection, an inbound packet has FWPM_CONDITION_DIRECTION set to FWP_DIRECTION_OUTBOUND).
FWPM_CONDITION_INTERFACE_INDEX The index of the network interface, as enumerated by the network stack.
FWPM_CONDITION_INTERFACE_TYPE The bus type of the network interface.
FWPM_CONDITION_SUB_INTERFACE_INDEX The index of the logical network interface, as enumerated by the network stack.
FWPM_CONDITION_SOURCE_INTERFACE_INDEX The index of the source network interface for forwarded packets, as enumerated by the network stack.
FWPM_CONDITION_SOURCE_SUB_INTERFACE_INDEX The index of the source logical network interface for forwarded packets, as enumerated by the network stack.
FWPM_CONDITION_DESTINATION_INTERFACE_INDEX The index of the destination network interface for forwarded packets, as enumerated by the network stack.
FWPM_CONDITION_DESTINATION_SUB_INTERFACE_INDEX The index of the destination logical network interface for forwarded packets, as enumerated by the network stack.
FWPM_CONDITION_ALE_APP_ID The full path of the application.
FWPM_CONDITION_ALE_USER_ID The identification of the local user.
FWPM_CONDITION_ALE_REMOTE_USER_ID The identification of the remote user.
FWPM_CONDITION_ALE_REMOTE_MACHINE_ID The identification of the remote machine.
FWPM_CONDITION_ALE_PROMISCUOUS_MODE The raw socket mode that is allowed or denied. The possible condition values are:
- SIO_RCVALL
- SIO_RCVALL_IGMPMCAST
- SIO_RCVALL_MCAST
For a description of these raw socket modes, see WSAIoctl in the Microsoft Windows SDK documentation.
FWPM_CONDITION_ALE_SIO_FIREWALL_SYSTEM_PORT Reserved for internal use.
FWPM_CONDITION_ALE_NAP_CONTEXT Reserved for internal use.
FWPM_CONDITION_REMOTE_USER_TOKEN The identification of the remote user.
FWPM_CONDITION_RPC_IF_UUID The UUID of the RPC interface.
FWPM_CONDITION_RPC_IF_VERSION The version of the RPC interface.
FWPM_CONDITION_RCP_IF_FLAG Reserved for internal use.
FWPM_CONDITION_DCOM_APP_ID The identification of the COM application.
FWPM_CONDITION_IMAGE_NAME The name of the application.
FWPM_CONDITION_RPC_PROTOCOL The RPC protocol. The possible condition values are:
- RPC_PROTSEQ_TCP
- RPC_PROTSEQ_HTTP
- RPC_PROTSEQ_NMP
FWPM_CONDITION_RPC_AUTH_TYPE The authentication service type. For more information about authentication service types, see Authentication-Service Constants in the RPC section of the Windows SDK documentation.
FWPM_CONDITION_RPC_AUTH_LEVEL The authentication service level. For more information about authentication service levels, see Authentication-Level Constants in the RPC section of the Windows SDK documentation.
FWPM_CONDITION_SEC_ENCRYPT_ALGORITHM The certificate based security service provider interface (SSPI) encryption algorithm.
FWPM_CONDITION_SEC_KEY_SIZE The certificate based security service provider interface (SSPI) encryption key size.
FWPM_CONDITION_IP_LOCAL_ADDRESS_V4 The local IPv4 address.
FWPM_CONDITION_IP_LOCAL_ADDRESS_V6 The local IPv6 address.
FWPM_CONDITION_PIPE The name of the remote named pipe.
FWPM_CONDITION_IP_REMOTE_ADDRESS_V4 The remote IPv4 address.
FWPM_CONDITION_IP_REMOTE_ADDRESS_V6 The remote IPv6 address.
FWPM_CONDITION_PROCESS_WITH_RPC_IF_UUID The UUID of the process with the RPC interface.
FWPM_CONDITION_RPC_EP_VALUE Reserved for internal use.
FWPM_CONDITION_RPC_EP_FLAGS Reserved for internal use.
FWPM_CONDITION_CLIENT_TOKEN The identification of the client when using RpcProxy.
FWPM_CONDITION_RPC_SERVER_NAME The name of the RPC server when using RpcProxy.
FWPM_CONDITION_RPC_SERVER_PORT The port on the RPC server when using RpcProxy.
FWPM_CONDITION_RPC_PROXY_AUTH_TYPE The RPC proxy authentication service type. For more information about authentication service types, see Authentication-Service Constants in the RPC section of the Windows SDK documentation.
FWPM_CONDITION_TUNNEL_TYPE The encapsulation method used by a tunnel.
FWPM_CONDITION_CLIENT_CERT_KEY_LENGTH The secure socket layer (SSL) key length in the client certificate.
FWPM_CONDITION_CLIENT_CERT_OID The object identifier (OID) in the client certificate.
FWPM_CONDITION_INTERFACE_MAC_ADDRESS The physical address of the sending or receiving network interface.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_MAC_LOCAL_ADDRESS The physical address of the local network interface. For inbound traffic this is the destination MAC address in the frame. For outbound traffic this is the source MAC address of the frame.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_MAC_REMOTE_ADDRESS The physical address of the remote network interface. For inbound traffic this is the source MAC address in the frame. For outbound traffic this is the destination MAC address of the frame.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_ETHER_TYPE The type indicated in the MAC frame. This value is 0x800 for IPv4 traffic, 0x86DD for IPv6 traffic or, 0x806 for ARP traffic. All of the possible values are defined as NDIS_ETH_TYPE_Xxx in ntddndis.h.
FWPM_CONDITION_VLAN_ID The identifier of the VLAN in the ETHERNET SNAP header.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_NDIS_PORT The port number identifying a miniport adapter port.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_NDIS_MEDIA_TYPE The type of the NDIS medium specified as one of the NDIS_MEDIUM enumeration values.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_NDIS_PHYSICAL_MEDIA_TYPE The type of the physical medium for the communicating interface specified as one of the NDIS_PHYSICAL_MEDIUM enumeration values.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_L2_FLAGS A bitwise OR of a combination of filtering condition flags for the MAC layers. For information about the possible flags, see Filtering Condition L2 Flags.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_MAC_LOCAL_ADDRESS_TYPE The Datalink type of the local MAC address. This is one of the values that are defined in the DL_ADDRESS_TYPE enumeration in FwpmTypes.h.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_MAC_REMOTE_ADDRESS_TYPE The Datalink type of the remote MAC address. This is one of the values that are defined in the DL_ADDRESS_TYPE enumeration in FwpmTypes.h.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_INTERFACE The LUID for the network interface that is associated with the local MAC address.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_ALE_PACKAGE_ID The security identifier (SID) of the AppContainer restricted package.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_MAC_SOURCE_ADDRESS The physical address of the network interface that created the MAC frame.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_MAC_DESTINATION_ADDRESS The physical address of the network interface to which the frame is destined.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_MAC_SOURCE_ADDRESS_TYPE The Datalink type of the MAC Address for the interface that created the frame. This is one of the values that are defined in the DL_ADDRESS_TYPE enumeration in FwpmTypes.h.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_MAC_DESTINATION_ADDRESS_TYPE The Datalink type of the MAC Address for the interface to which the frame is destined. This is one of the values that are defined in the DL_ADDRESS_TYPE enumeration in FwpmTypes.h.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_IP_SOURCE_PORT The transport protocol source port number.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_IP_DESTINATION_PORT The transport protocol destination port number.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_VSWITCH_ID The GUID of the virtual switch.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_VSWITCH_NETWORK_TYPE The type of network that is associated with the virtual switch. This is one of the values that are defined in the FWP_VSWITCH_NETWORK_TYPE enumeration in FwpTypes.h.
Note Supported in Windows 8 and later versions of Windows.
FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_ID The GUID of the interface of the virtual switch that created the frame.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_ID The GUID of the interface of the virtual switch to which the frame is destined.
Note Supported in Windows 8 and later versions of Windows.
FWPM_CONDITION_VSWITCH_SOURCE_INTERFACE_TYPE The type of the virtual switch interface that created the frame. This is one of the values that are defined in the NDIS_NIC_SWITCH_TYPE enumeration in Ntddndis.h.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_VSWITCH_DESTINATION_INTERFACE_TYPE The type of the virtual switch interface to which the frame is destined. This is one of the values that are defined in the NDIS_NIC_SWITCH_TYPE enumeration in Ntddndis.h.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_VSWITCH_SOURCE_VM_ID Unique identifier of the vSwitch source virtual machine.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_VSWITCH_DESTINATION_VM_ID Unique identifier of the vSwitch destination virtual machine.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_VSWITCH_TENANT_NETWORK_ID Unique identifier for the vSwitch network. Cannot be used in conjunction with VLAN_IDs.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_ALE_PACKAGE_ID The security identifier (SID) of an app container.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_ALE_ORIGINAL_APP_ID The original full path of the application before alteration from proxying. Note that if proxying is not involved, then this will be the same as the FWPM_CONDITION_ALE_APP_ID.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.
FWPM_CONDITION_QM_MODE The quick mode (QM) mode.
Note Supported in Windows 8, Windows Server 2012, and later versions of Windows.