Struct FilterRule 

pub struct FilterRule {
    pub name: String,
    pub direction: Direction,
    pub action: Action,
    pub weight: u64,
    pub app_path: Option<PathBuf>,
    pub service_name: Option<String>,
    pub app_container_sid: Option<String>,
    pub local_ip: Option<IpAddrMask>,
    pub remote_ip: Option<IpAddrMask>,
    pub local_port: Option<u16>,
    pub remote_port: Option<u16>,
    pub protocol: Option<Protocol>,
}

A WFP filter rule definition

Describes a firewall filter to be applied via the Windows Filtering Platform. All condition fields are optional — omitting a condition means “match all” for that field.

Examples

use windows_wfp::{FilterRule, Direction, Action, FilterWeight};
use std::path::PathBuf;

// Block all outbound traffic from curl.exe
let rule = FilterRule::new("Block curl", Direction::Outbound, Action::Block)
    .with_weight(FilterWeight::UserBlock)
    .with_app_path(r"C:\Windows\System32\curl.exe");

// Allow all outbound traffic (no conditions = match all)
let allow_all = FilterRule::new("Allow all", Direction::Outbound, Action::Permit)
    .with_weight(FilterWeight::DefaultPermit);

Fields

name: String

Human-readable rule name (displayed in WFP management tools)

direction: Direction

Traffic direction

action: Action

Action to take (permit or block)

weight: u64

Filter priority (higher weight = evaluated first)

app_path: Option<PathBuf>

Application executable path (auto-converted to NT kernel path)

service_name: Option<String>

Windows service name (matched via service SID)

app_container_sid: Option<String>

AppContainer SID (for UWP/packaged apps)

local_ip: Option<IpAddrMask>

Local IP address with CIDR mask

remote_ip: Option<IpAddrMask>

Remote IP address with CIDR mask

local_port: Option<u16>

Local port number (1-65535)

remote_port: Option<u16>

Remote port number (1-65535)

protocol: Option<Protocol>

IP protocol (TCP, UDP, ICMP, etc.)

Implementations

impl FilterRule

pub fn new( name: impl Into<String>, direction: Direction, action: Action, ) -> Self

Create a new filter rule with required fields

Examples found in repository

examples/simple_block.rs (line 38)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Simple Block Demo\n");

    // Initialize WFP
    println!("Opening WFP Engine...");
    let engine = WfpEngine::new()?;
    println!("Engine opened\n");

    println!("Registering provider...");
    initialize_wfp(&engine)?;
    println!("Provider registered\n");

    // Block notepad.exe outbound connections
    println!("Adding block filter for notepad.exe...");
    let notepad_rule = FilterRule::new("Block Notepad", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(r"C:\Windows\System32\notepad.exe");

    let filter_id = FilterBuilder::add_filter(&engine, &notepad_rule)?;
    println!("Filter added (ID: {})\n", filter_id);

    println!("Filter active for 10 seconds...");
    println!("   (Try opening notepad.exe and accessing network)\n");

    for i in (1..=10).rev() {
        println!("   {} seconds remaining...", i);
        thread::sleep(Duration::from_secs(1));
    }

    println!("\nRemoving filter...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("Filter removed\n");

    println!("Demo complete!");
    Ok(())
}

examples/live_demo.rs (line 66)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Live WFP Demo");
    println!("================================\n");

    // Check for admin privileges
    if !is_elevated() {
        eprintln!("ERROR: This demo requires Administrator privileges!");
        eprintln!("   Please run: cargo run --example live_demo --release");
        eprintln!("   from an Administrator command prompt.\n");
        std::process::exit(1);
    }

    println!("Running with Administrator privileges\n");

    // Step 1: Initialize WFP Engine
    println!("Step 1: Opening WFP Engine session...");
    let engine = WfpEngine::new()?;
    println!("   Engine session opened\n");

    // Step 2: Register Provider & Sublayer
    println!("Step 2: Registering WFP provider & sublayer...");
    initialize_wfp(&engine)?;
    println!("   Provider & sublayer registered\n");

    // Step 3: Subscribe to network events
    println!("Step 3: Subscribing to network events...");
    let event_subscription = WfpEventSubscription::new(&engine)?;
    println!("   Event subscription active\n");

    // Step 4: Add blocking filter for curl.exe
    println!("Step 4: Adding block filter for curl.exe...");
    let curl_path = find_curl_path();
    println!("   Target: {}", curl_path.display());

    let block_rule = FilterRule::new("Block curl.exe", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(curl_path.clone());

    let filter_id = FilterBuilder::add_filter(&engine, &block_rule)?;
    println!("   Filter added (ID: {})\n", filter_id);

    // Step 5: Monitor events
    println!("Step 5: Monitoring network events...");
    println!("   Press Ctrl+C to stop\n");
    println!("TIP: In another terminal, run:");
    println!("   > curl https://google.com");
    println!("   You should see the connection BLOCKED below!\n");
    println!("===================================================\n");

    let start_time = std::time::Instant::now();
    let mut event_count = 0;

    loop {
        match event_subscription.try_recv() {
            Ok(event) => {
                event_count += 1;
                print_event(&event, event_count);
            }
            Err(std::sync::mpsc::TryRecvError::Empty) => {
                thread::sleep(Duration::from_millis(100));
            }
            Err(std::sync::mpsc::TryRecvError::Disconnected) => {
                println!("\nEvent channel disconnected!");
                break;
            }
        }

        // Auto-stop after 60 seconds for demo
        if start_time.elapsed() > Duration::from_secs(60) {
            println!("\nDemo timeout (60s) - stopping...");
            break;
        }
    }

    // Cleanup
    println!("\nCleaning up...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("   Filter removed");
    drop(event_subscription);
    println!("   Event subscription closed");
    drop(engine);
    println!("   Engine session closed\n");

    println!("Demo complete! {} events captured.", event_count);
    Ok(())
}

pub fn with_weight(self, weight: FilterWeight) -> Self

Set the filter weight (priority)

Examples found in repository

examples/simple_block.rs (line 39)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Simple Block Demo\n");

    // Initialize WFP
    println!("Opening WFP Engine...");
    let engine = WfpEngine::new()?;
    println!("Engine opened\n");

    println!("Registering provider...");
    initialize_wfp(&engine)?;
    println!("Provider registered\n");

    // Block notepad.exe outbound connections
    println!("Adding block filter for notepad.exe...");
    let notepad_rule = FilterRule::new("Block Notepad", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(r"C:\Windows\System32\notepad.exe");

    let filter_id = FilterBuilder::add_filter(&engine, &notepad_rule)?;
    println!("Filter added (ID: {})\n", filter_id);

    println!("Filter active for 10 seconds...");
    println!("   (Try opening notepad.exe and accessing network)\n");

    for i in (1..=10).rev() {
        println!("   {} seconds remaining...", i);
        thread::sleep(Duration::from_secs(1));
    }

    println!("\nRemoving filter...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("Filter removed\n");

    println!("Demo complete!");
    Ok(())
}

examples/live_demo.rs (line 67)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Live WFP Demo");
    println!("================================\n");

    // Check for admin privileges
    if !is_elevated() {
        eprintln!("ERROR: This demo requires Administrator privileges!");
        eprintln!("   Please run: cargo run --example live_demo --release");
        eprintln!("   from an Administrator command prompt.\n");
        std::process::exit(1);
    }

    println!("Running with Administrator privileges\n");

    // Step 1: Initialize WFP Engine
    println!("Step 1: Opening WFP Engine session...");
    let engine = WfpEngine::new()?;
    println!("   Engine session opened\n");

    // Step 2: Register Provider & Sublayer
    println!("Step 2: Registering WFP provider & sublayer...");
    initialize_wfp(&engine)?;
    println!("   Provider & sublayer registered\n");

    // Step 3: Subscribe to network events
    println!("Step 3: Subscribing to network events...");
    let event_subscription = WfpEventSubscription::new(&engine)?;
    println!("   Event subscription active\n");

    // Step 4: Add blocking filter for curl.exe
    println!("Step 4: Adding block filter for curl.exe...");
    let curl_path = find_curl_path();
    println!("   Target: {}", curl_path.display());

    let block_rule = FilterRule::new("Block curl.exe", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(curl_path.clone());

    let filter_id = FilterBuilder::add_filter(&engine, &block_rule)?;
    println!("   Filter added (ID: {})\n", filter_id);

    // Step 5: Monitor events
    println!("Step 5: Monitoring network events...");
    println!("   Press Ctrl+C to stop\n");
    println!("TIP: In another terminal, run:");
    println!("   > curl https://google.com");
    println!("   You should see the connection BLOCKED below!\n");
    println!("===================================================\n");

    let start_time = std::time::Instant::now();
    let mut event_count = 0;

    loop {
        match event_subscription.try_recv() {
            Ok(event) => {
                event_count += 1;
                print_event(&event, event_count);
            }
            Err(std::sync::mpsc::TryRecvError::Empty) => {
                thread::sleep(Duration::from_millis(100));
            }
            Err(std::sync::mpsc::TryRecvError::Disconnected) => {
                println!("\nEvent channel disconnected!");
                break;
            }
        }

        // Auto-stop after 60 seconds for demo
        if start_time.elapsed() > Duration::from_secs(60) {
            println!("\nDemo timeout (60s) - stopping...");
            break;
        }
    }

    // Cleanup
    println!("\nCleaning up...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("   Filter removed");
    drop(event_subscription);
    println!("   Event subscription closed");
    drop(engine);
    println!("   Engine session closed\n");

    println!("Demo complete! {} events captured.", event_count);
    Ok(())
}

pub fn with_raw_weight(self, weight: u64) -> Self

Set a raw weight value

pub fn with_app_path(self, path: impl Into<PathBuf>) -> Self

Set the application path to filter

Examples found in repository

examples/simple_block.rs (line 40)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Simple Block Demo\n");

    // Initialize WFP
    println!("Opening WFP Engine...");
    let engine = WfpEngine::new()?;
    println!("Engine opened\n");

    println!("Registering provider...");
    initialize_wfp(&engine)?;
    println!("Provider registered\n");

    // Block notepad.exe outbound connections
    println!("Adding block filter for notepad.exe...");
    let notepad_rule = FilterRule::new("Block Notepad", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(r"C:\Windows\System32\notepad.exe");

    let filter_id = FilterBuilder::add_filter(&engine, &notepad_rule)?;
    println!("Filter added (ID: {})\n", filter_id);

    println!("Filter active for 10 seconds...");
    println!("   (Try opening notepad.exe and accessing network)\n");

    for i in (1..=10).rev() {
        println!("   {} seconds remaining...", i);
        thread::sleep(Duration::from_secs(1));
    }

    println!("\nRemoving filter...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("Filter removed\n");

    println!("Demo complete!");
    Ok(())
}

examples/live_demo.rs (line 68)

fn main() -> WfpResult<()> {
    println!("windows-wfp - Live WFP Demo");
    println!("================================\n");

    // Check for admin privileges
    if !is_elevated() {
        eprintln!("ERROR: This demo requires Administrator privileges!");
        eprintln!("   Please run: cargo run --example live_demo --release");
        eprintln!("   from an Administrator command prompt.\n");
        std::process::exit(1);
    }

    println!("Running with Administrator privileges\n");

    // Step 1: Initialize WFP Engine
    println!("Step 1: Opening WFP Engine session...");
    let engine = WfpEngine::new()?;
    println!("   Engine session opened\n");

    // Step 2: Register Provider & Sublayer
    println!("Step 2: Registering WFP provider & sublayer...");
    initialize_wfp(&engine)?;
    println!("   Provider & sublayer registered\n");

    // Step 3: Subscribe to network events
    println!("Step 3: Subscribing to network events...");
    let event_subscription = WfpEventSubscription::new(&engine)?;
    println!("   Event subscription active\n");

    // Step 4: Add blocking filter for curl.exe
    println!("Step 4: Adding block filter for curl.exe...");
    let curl_path = find_curl_path();
    println!("   Target: {}", curl_path.display());

    let block_rule = FilterRule::new("Block curl.exe", Direction::Outbound, Action::Block)
        .with_weight(FilterWeight::UserBlock)
        .with_app_path(curl_path.clone());

    let filter_id = FilterBuilder::add_filter(&engine, &block_rule)?;
    println!("   Filter added (ID: {})\n", filter_id);

    // Step 5: Monitor events
    println!("Step 5: Monitoring network events...");
    println!("   Press Ctrl+C to stop\n");
    println!("TIP: In another terminal, run:");
    println!("   > curl https://google.com");
    println!("   You should see the connection BLOCKED below!\n");
    println!("===================================================\n");

    let start_time = std::time::Instant::now();
    let mut event_count = 0;

    loop {
        match event_subscription.try_recv() {
            Ok(event) => {
                event_count += 1;
                print_event(&event, event_count);
            }
            Err(std::sync::mpsc::TryRecvError::Empty) => {
                thread::sleep(Duration::from_millis(100));
            }
            Err(std::sync::mpsc::TryRecvError::Disconnected) => {
                println!("\nEvent channel disconnected!");
                break;
            }
        }

        // Auto-stop after 60 seconds for demo
        if start_time.elapsed() > Duration::from_secs(60) {
            println!("\nDemo timeout (60s) - stopping...");
            break;
        }
    }

    // Cleanup
    println!("\nCleaning up...");
    FilterBuilder::delete_filter(&engine, filter_id)?;
    println!("   Filter removed");
    drop(event_subscription);
    println!("   Event subscription closed");
    drop(engine);
    println!("   Engine session closed\n");

    println!("Demo complete! {} events captured.", event_count);
    Ok(())
}

pub fn with_protocol(self, protocol: Protocol) -> Self

Set the protocol to filter

pub fn with_remote_port(self, port: u16) -> Self

Set the remote port to filter

pub fn with_local_port(self, port: u16) -> Self

Set the local port to filter

pub fn with_remote_ip(self, ip: IpAddrMask) -> Self

Set the remote IP address with CIDR mask

pub fn with_local_ip(self, ip: IpAddrMask) -> Self

Set the local IP address with CIDR mask

pub fn with_service_name(self, name: impl Into<String>) -> Self

Set the Windows service name

pub fn with_app_container_sid(self, sid: impl Into<String>) -> Self

Set the AppContainer SID

pub fn block_all_outbound() -> Self

Block all outbound traffic (no conditions)

pub fn allow_all_outbound() -> Self

Allow all outbound traffic (no conditions)

pub fn block_all_inbound() -> Self

Block all inbound traffic (no conditions)

pub fn default_block() -> Self

Default block rule (lowest priority catch-all)

Trait Implementations

impl Clone for FilterRule

fn clone(&self) -> FilterRule

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for FilterRule

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.