slackhq/nebula · error

FwpmEngineOpen0: 0x%x

Error message

FwpmEngineOpen0: 0x%x

What it means

openDynamicEngine calls the Win32 FwpmEngineOpen0 API to open a handle to the Windows Filtering Platform Base Filtering Engine with WinNT authentication and an explicit session. This error is thrown when FwpmEngineOpen0 returns a non-zero win32 error code, formatted as hex (e.g. 0x800706d9 = FWP_E_... / RPC unavailable). No engine handle is returned, so no session can be created.

Source

Thrown at wfp/wfp_windows.go:261

	if err != nil {
		procFwpmEngineClose0.Call(engine)
		return nil, windows.GUID{}, err
	}
	return &Session{engine: engine}, sublayerKey, nil
}

func openDynamicEngine() (uintptr, error) {
	session := fwpmSession0{flags: fwpmSessionFlagDynamic}
	var engine uintptr
	r1, _, _ := procFwpmEngineOpen0.Call(
		0, // serverName == NULL (local)
		uintptr(rpcCAuthnWinNT),
		0, // authIdentity == NULL
		uintptr(unsafe.Pointer(&session)),
		uintptr(unsafe.Pointer(&engine)),
	)
	if r1 != 0 {
		return 0, fmt.Errorf("FwpmEngineOpen0: 0x%x", r1)
	}
	return engine, nil
}

// registerSublayer adds a session-scoped sublayer with a freshly generated GUID, weight 0xFFFF so its filters arbitrate
// above WDF's default sublayer. The sublayer is dynamic (no PERSISTENT flag) and goes away when the engine handle closes.
func registerSublayer(engine uintptr) (windows.GUID, error) {
	key, err := windows.GenerateGUID()
	if err != nil {
		return windows.GUID{}, fmt.Errorf("GenerateGUID for sublayer: %w", err)
	}

	name, _ := windows.UTF16PtrFromString("Nebula WDF bypass sublayer")
	desc, _ := windows.UTF16PtrFromString("Permit filters bypassing Windows Defender Firewall")
	sl := fwpmSublayer0{
		subLayerKey: key,
		displayData: fwpmDisplayData0{name: name, description: desc},
		weight:      0xFFFF,

View on GitHub (pinned to dd8f660c0a)

Solutions

1. Run the process as Administrator — FwpmEngineOpen0 requires elevation
2. Check the BFE service: sc query BFE and net start BFE if stopped (mpssvc too)
3. Decode the hex code (e.g. net helpmsg or err.exe) to identify the exact FWP_E_* failure
4. Verify no third-party security product is blocking WFP engine connections
5. Confirm the session 0/RPC environment is available if running as a service

Example fix

// before (diagnosing)
engine, err := openDynamicEngine()
// err: FwpmEngineOpen0: 0x80070005
// after — check BFE + elevation first
func canOpenEngine() error {
	if !isAdmin() { return errors.New("requires elevation") }
	return exec.Command("net", "start", "BFE").Run() // ensure service running
}

func preflightEngine() error {
	if !isAdmin() { return errors.New("must run elevated") }
	if err := exec.Command("sc", "query", "BFE").Run(); err != nil {
		return errors.New("BFE service not available")
	}
	return nil
}

if err := preflightEngine(); err != nil { log.Fatal(err) }
if err := w.PermitUDPPort(port); err != nil {
	if strings.Contains(err.Error(), "FwpmEngineOpen0") {
		log.Fatalf("WFP engine unavailable: %v", err) // fail fast, service-level issue
	}
}

When it happens

Trigger: Any call chain ending in newSession → openDynamicEngine where FwpmEngineOpen0 fails: the Windows Firewall service (mpssvc/BFE) is not running, the process lacks admin rights (FWP_E_ACCESS_DENIED), or the BFE RPC endpoint is unreachable.

Common situations: Running the program without an elevated prompt, BFE service stopped or crashed, group policy blocking engine access, running in a service/session without the required privileges, or on hardened hosts where third-party firewalls deny additional clients.

Related errors

• FwpmSubLayerAdd0: 0x%x
• add v4 filter: %w
• add v6 filter: %w
• FwpmFilterAdd0: 0x%x
• INetwork.SetCategory: %s

AI-assisted analysis of slackhq/nebula@dd8f660c0a (2026-09-03). Data as JSON: /api/errors/70fbc428457f0740. Report an issue: GitHub.