{"record":{"id":"c3e78907e920809f","repo":"slackhq/nebula","slug":"fwpmfilteradd0-0x-x","errorCode":null,"errorMessage":"FwpmFilterAdd0: 0x%x","messagePattern":"FwpmFilterAdd0: 0x%x","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"wfp/wfp_windows.go","lineNumber":326,"sourceCode":"\t\t// filterKey left zero: WFP assigns one when the filter is added.\n\t\tdisplayData:         fwpmDisplayData0{name: name, description: desc},\n\t\tflags:               fwpmFilterFlagClearActionRight,\n\t\tlayerKey:            layer,\n\t\tsubLayerKey:         sublayerKey,\n\t\tweight:              fwpValue0{type_: fwpUint8, value: uintptr(15)},\n\t\tnumFilterConditions: 1,\n\t\tfilterCondition:     &cond,\n\t\taction:              fwpmAction0{actionType: fwpActionPermit},\n\t}\n\n\tr1, _, _ := procFwpmFilterAdd0.Call(\n\t\tengine,\n\t\tuintptr(unsafe.Pointer(&filter)),\n\t\t0, // sd == NULL\n\t\t0, // id == NULL\n\t)\n\tif r1 != 0 {\n\t\treturn fmt.Errorf(\"FwpmFilterAdd0: 0x%x\", r1)\n\t}\n\treturn nil\n}\n\n// addUDPPortFilter installs a PERMIT filter that matches (IP_PROTOCOL == UDP) AND (IP_LOCAL_PORT == port).\n// FWP_UINT8 and FWP_UINT16 are <= 32 bits so they live inline in the FWP_VALUE0 union.\nfunc addUDPPortFilter(engine uintptr, sublayerKey, layer windows.GUID, port uint16) error {\n\tname, _ := windows.UTF16PtrFromString(\"Nebula allow UDP port inbound\")\n\tdesc, _ := windows.UTF16PtrFromString(\"Permits inbound UDP to a nebula listener port\")\n\n\tconds := [2]fwpmFilterCondition0{\n\t\t{\n\t\t\tfieldKey:  fwpmConditionIPProtocol,\n\t\t\tmatchType: fwpMatchEqual,\n\t\t\tconditionValue: fwpValue0{\n\t\t\t\ttype_: fwpUint8,\n\t\t\t\tvalue: uintptr(ipprotoUDP),\n\t\t\t},","sourceCodeStart":308,"sourceCodeEnd":344,"githubUrl":"https://github.com/slackhq/nebula/blob/dd8f660c0ac37903ec4080ca4d3c861ba9342ceb/wfp/wfp_windows.go#L308-L344","documentation":"addInterfaceFilter installs a PERMIT filter in the ALE layer that matches inbound traffic on a specific interface LUID, letting it bypass Windows Defender Firewall. This error wraps a non-zero return from FwpmFilterAdd0 — the filter object could not be added to the engine. The call comes from the public PermitInterface API.","triggerScenarios":"Calling PermitInterface where FwpmFilterAdd0 fails: invalid/unknown interface LUID, filter conditions rejected (FWP_E_INVALID_PARAMETER), access denied on the engine handle, transaction conflict with another WFP client, or the sublayer/session was already closed via Close().","commonSituations":"Passing an LUID that no longer exists (interface unplugged/renamed between lookup and call), running without admin rights, an EDR/VPN product holding the BFE transaction, or calling after the Session was closed.","solutions":["Decode the hex win32 code for the exact FWP_E_* cause","Verify the interface LUID is current (Get-NetAdapter / netsh interface show interface) and re-fetch it immediately before calling","Run the process as Administrator","Retry — transient transaction conflicts with other WFP agents resolve on re-attempt","Ensure PermitUDPPort/newSession succeeded and the Session has not been Closed before calling PermitInterface"],"exampleFix":"// before\nluid := staleLuid // cached from long ago\nif err := w.PermitInterface(luid); err != nil { ... }\n// after — refresh LUID at call time\nadapter, _ := net.InterfaceByName(name)\nluid := uint64(adapter.Index)\nif err := w.PermitInterface(luid); err != nil {\n\treturn fmt.Errorf(\"permit interface: %w\", err)\n}","handlingStrategy":"validation","validationCode":"func interfaceExists(luid uint64) error {\n\tifaces, err := net.Interfaces()\n\tif err != nil { return err }\n\tfor _, ifc := range ifaces {\n\t\tif uint64(ifc.Index) == luid { return nil }\n\t}\n\treturn fmt.Errorf(\"interface with LUID %d not found\", luid)\n}\n// call before PermitInterface\nif err := interfaceExists(luid); err != nil { return err }","typeGuard":null,"tryCatchPattern":"if err := w.PermitInterface(luid); err != nil {\n\tvar winErr syscall.Errno\n\tif errors.As(err, &winErr) && winErr == 0x80320009 { // FWP_E_TXN_IN_PROGRESS\n\t\ttime.Sleep(200 * time.Millisecond)\n\t\treturn w.PermitInterface(luid)\n\t}\n\treturn err\n}","preventionTips":["Re-resolve the interface LUID immediately before calling PermitInterface","Verify the Session is open (not Closed) before adding interface filters","Run elevated; FwpmFilterAdd0 requires write access to the engine","Handle interface hot-unplug: re-permit after adapter changes"],"tags":["wfp","windows","firewall","filter","network-interface"],"backgroundTag":"wfp-filter-add-failed","analyzedSha":"dd8f660c0ac37903ec4080ca4d3c861ba9342ceb","analyzedAt":"2026-09-03T11:13:55.444Z","contentChangedAt":"2026-09-03T11:13:55.444Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}