Basic firewall using Win32

Question

Previous to my earlier post, wishing to prevent SYN+ACK packets leaving the computer im looking at writing a basic firewall in c#. As i understand it, there's no .NET functions to do this. Am i right in thinking i just need to use the Win32 API?

 

So something like:

 

[DllImport("<something.dll>")]

public static extern something etc......

If i can find the correct methods and use the win32 like any other win32, i should be fine?

Any pointers (no pun intended) towards where in the win32 library would be most welcome

Answer 1

A firewall can only be implemented in kernal mode. That means writing a driver, and that means no managed code.

Here is a simple firewall implementation I found with google:
http://www.codeproject.com/KB/IP/smfirewall.aspx

Answer 2

A firewall can only be implemented in kernal mode. That means writing a driver, and that means no managed code.

Here is a simple firewall implementation I found with google:
http://www.codeproject.com/KB/IP/smfirewall.aspx

I had already found that, but i wasn't sure how similar it would be because c++ can integrate with Win32 much better than C#.

What would be the difference where they use a win32 function, compared with c# calling one?

Answer 3

Let me repeat myself: Writing a firewall for Windows requires kernel mode code.

You cannot write kernel mode code (a driver) in C#. Period.

Now you might be able to take the driver that was written for that article and make calls to it for your own purpose. It depends on if the API for the driver contains sufficient code for your use.

This subject is way beyond the scope of these forums. If, after learning how the driver works, learning how to install it and communicate with it (in native code), you have a specific p/invoke question, feel free to ask.

 

Answer 4

You would probably be interesting in a project I've been heading up for a while.  While C# can't be used to write a driver, as has been so explicitly stated, there is no reason that a firewall can't be written in C#.  What is required is a driver that passes the packets to usermode, where the C# can control the flow of the packets.  http://firebwall.com uses a method like this, and allows for developers to create modules for this interface in any .net 2.0 supported language.  Here is the Visual Studio Template for creating fireBwall modules.  Make sure to have fireBwall installed before trying to debug your module.  
You can also submit modules to fireBwall.com, and we'll host them for you on our soon to come Download Center integrated into fireBwall.
http://code.google.com/p/firebwall/downloads/detail?name=fireBwall%200.3.10.0%20Module.zip&can=2&q=