{"record":{"id":"b73abcc7c7f9fda5","repo":"slackhq/nebula","slug":"add-v4-filter-w","errorCode":null,"errorMessage":"add v4 filter: %w","messagePattern":"add v4 filter: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wfp/wfp_windows.go","lineNumber":209,"sourceCode":"func (s *Session) Close() {\n\tif s == nil || s.engine == 0 {\n\t\treturn\n\t}\n\tprocFwpmEngineClose0.Call(s.engine)\n\ts.engine = 0\n}\n\n// PermitInterface installs PERMIT filters at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 and _V6 scoped to the given network\n// interface LUID. Inbound traffic on that interface bypasses Windows Defender Firewall.\nfunc PermitInterface(luid uint64) (*Session, error) {\n\ts, sublayerKey, err := newSession()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV4, luid); err != nil {\n\t\ts.Close()\n\t\treturn nil, fmt.Errorf(\"add v4 filter: %w\", err)\n\t}\n\tif err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, luid); err != nil {\n\t\ts.Close()\n\t\treturn nil, fmt.Errorf(\"add v6 filter: %w\", err)\n\t}\n\treturn s, nil\n}\n\n// PermitUDPPort installs PERMIT filters at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 and _V6 scoped to UDP traffic with the\n// given local port. Inbound UDP to that port on any interface bypasses Windows Defender Firewall.\nfunc PermitUDPPort(port uint16) (*Session, error) {\n\ts, sublayerKey, err := newSession()\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\tif err := addUDPPortFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV4, port); err != nil {\n\t\ts.Close()","sourceCodeStart":191,"sourceCodeEnd":227,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/wfp/wfp_windows.go#L191-L227","documentation":"PermitInterface failed to install the IPv4 WFP (Windows Filtering Platform) permit filter at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 for a specific interface LUID. The engine handle is closed and the lower-level addInterfaceFilter error (e.g. an FwpmFilterAdd0 failure) is wrapped with %w. Without this filter, inbound traffic on the target interface will not bypass Windows Defender Firewall.","triggerScenarios":"Calling wfp.PermitInterface (or installInterfaceBypass) on Windows when addInterfaceFilter for the V4 layer fails - engine open/session OK but FwpmFilterAdd0 returns an error (access denied, invalid LUID, engine session gone).","commonSituations":"Running without administrator privileges (WFP filter add requires elevation); the interface LUID no longer exists or refers to a virtual adapter; third-party firewall/AV replaces or locks the WFP provider; group policy restrictions on filter objects.","solutions":["Run the process elevated (Administrator) - adding WFP filters requires admin rights.","Verify the interface LUID is valid and the adapter exists (ipconfig / Get-NetAdapter).","Check the wrapped error for FWP_E_* codes: FWP_E_ACCESS_DENIED points to AV/GPO interference.","Retry after disabling conflicting third-party firewall filters."],"exampleFix":"// before\ns, err := wfp.PermitInterface(luid)\n// after\nif err != nil {\n\tvar ce error\n\tif errors.As(err, &ce) { /* inspect FWSErr */ }\n\tif !isAdmin() { return errors.New(\"PermitInterface requires elevation: run as Administrator\") }\n}","handlingStrategy":"try-catch","validationCode":"// require elevation before attempting WFP work\nfunc isAdmin() bool {\n\tf, err := os.Open(\"\\\\\\\\.\\\\PHYSICALDRIVE0\")\n\tif err != nil { return false }\n\tf.Close()\n\treturn true\n}\nif !isAdmin() { return errors.New(\"WFP filter install requires administrator privileges\") }","typeGuard":"func isV4FilterErr(err error) bool { return err != nil && strings.Contains(err.Error(), \"add v4 filter\") }","tryCatchPattern":"session, err := wfp.PermitInterface(luid)\nif err != nil {\n\tif isV4FilterErr(err) {\n\t\t// check FWPE code: access denied -> elevate; invalid luid -> re-resolve adapter\n\t}\n\treturn err\n}\ndefer session.Close()","preventionTips":["Run any WFP-using service elevated (or as a service with the right privileges).","Re-resolve the interface LUID right before calling PermitInterface; adapters can change.","Check that no third-party firewall claims exclusive WFP provider rights.","Always pair PermitInterface with Close() to avoid leaking engine handles."],"tags":["windows","wfp","firewall","network"],"backgroundTag":"firewall-filter-install-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}