What causes "add v4 filter: %w" in slackhq/nebula?

Run the process elevated (Administrator) - adding WFP filters requires admin rights.

add v4 filter: %w

Error message

add v4 filter: %w

What it means

PermitInterface failed to install the IPv4 WFP (Windows Filtering Platform) permit filter at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 for a specific interface LUID. The engine handle is closed and the lower-level addInterfaceFilter error (e.g. an FwpmFilterAdd0 failure) is wrapped with %w. Without this filter, inbound traffic on the target interface will not bypass Windows Defender Firewall.

Source

Thrown at wfp/wfp_windows.go:209

func (s *Session) Close() {
	if s == nil || s.engine == 0 {
		return
	}
	procFwpmEngineClose0.Call(s.engine)
	s.engine = 0
}

// PermitInterface installs PERMIT filters at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 and _V6 scoped to the given network
// interface LUID. Inbound traffic on that interface bypasses Windows Defender Firewall.
func PermitInterface(luid uint64) (*Session, error) {
	s, sublayerKey, err := newSession()
	if err != nil {
		return nil, err
	}

	if err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV4, luid); err != nil {
		s.Close()
		return nil, fmt.Errorf("add v4 filter: %w", err)
	}
	if err := addInterfaceFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV6, luid); err != nil {
		s.Close()
		return nil, fmt.Errorf("add v6 filter: %w", err)
	}
	return s, nil
}

// PermitUDPPort installs PERMIT filters at FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4 and _V6 scoped to UDP traffic with the
// given local port. Inbound UDP to that port on any interface bypasses Windows Defender Firewall.
func PermitUDPPort(port uint16) (*Session, error) {
	s, sublayerKey, err := newSession()
	if err != nil {
		return nil, err
	}

	if err := addUDPPortFilter(s.engine, sublayerKey, fwpmLayerAleAuthRecvAcceptV4, port); err != nil {
		s.Close()

View on GitHub (pinned to dd8f660c0a)

Solutions

Run the process elevated (Administrator) - adding WFP filters requires admin rights.
Verify the interface LUID is valid and the adapter exists (ipconfig / Get-NetAdapter).
Check the wrapped error for FWP_E_* codes: FWP_E_ACCESS_DENIED points to AV/GPO interference.
Retry after disabling conflicting third-party firewall filters.

Example fix

// before
s, err := wfp.PermitInterface(luid)
// after
if err != nil {
	var ce error
	if errors.As(err, &ce) { /* inspect FWSErr */ }
	if !isAdmin() { return errors.New("PermitInterface requires elevation: run as Administrator") }
}

Defensive patterns

Strategy: try-catch

Validate before calling

// require elevation before attempting WFP work
func isAdmin() bool {
	f, err := os.Open("\\\\.\\PHYSICALDRIVE0")
	if err != nil { return false }
	f.Close()
	return true
}
if !isAdmin() { return errors.New("WFP filter install requires administrator privileges") }

Type guard

func isV4FilterErr(err error) bool { return err != nil && strings.Contains(err.Error(), "add v4 filter") }

Try / catch

session, err := wfp.PermitInterface(luid)
if err != nil {
	if isV4FilterErr(err) {
		// check FWPE code: access denied -> elevate; invalid luid -> re-resolve adapter
	}
	return err
}
defer session.Close()

Prevention

Run any WFP-using service elevated (or as a service with the right privileges).
Re-resolve the interface LUID right before calling PermitInterface; adapters can change.
Check that no third-party firewall claims exclusive WFP provider rights.
Always pair PermitInterface with Close() to avoid leaking engine handles.

When it happens

Trigger: Calling wfp.PermitInterface (or installInterfaceBypass) on Windows when addInterfaceFilter for the V4 layer fails - engine open/session OK but FwpmFilterAdd0 returns an error (access denied, invalid LUID, engine session gone).

Common situations: Running without administrator privileges (WFP filter add requires elevation); the interface LUID no longer exists or refers to a virtual adapter; third-party firewall/AV replaces or locks the WFP provider; group policy restrictions on filter objects.

Related errors

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/b73abcc7c7f9fda5. Report an issue: GitHub.