From 8536e23378dab04ed9f61a9115a5998d1f0eb21c Mon Sep 17 00:00:00 2001 From: Blacksheep-25 <5268409+blacksheep25@users.noreply.github.com> Date: Sat, 17 Oct 2026 21:45:10 +1000 Subject: [PATCH] Add AllowIpForwarding option to skip boot-time IPFORWARD block The boot-time filters include a block on FWPM_LAYER_IPFORWARD_V4/V6 for traffic without the pass-through flags. Because the filter is added while BFE is running, it is enforced immediately and stays active for as long as filters are enabled. simplewall never adds a permit on the forward layer, so no app, service or user rule can allow forwarded traffic, which breaks Mobile Hotspot, Internet Connection Sharing and NAT'd VM switches (#425). Add a config option (off by default, so behaviour is unchanged) that skips just these two filters while keeping the rest of the boot-time filters. Co-Authored-By: Claude Opus 5.5 --- src/wfp.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/src/wfp.c b/src/wfp.c index 6a707e51..85ed9f5f 100644 --- a/src/wfp.c +++ b/src/wfp.c @@ -1772,13 +1772,21 @@ BOOLEAN _wfp_createglobalfilters ( _wfp_createfilter (engine_handle, DATA_FILTER_GENERAL, FWN_BOOTTIME, NULL, 0, &FWPM_LAYER_OUTBOUND_ICMP_ERROR_V6, NULL, FWW_LOWEST, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, filter_ids); // win7+ boot-time features - fwfc[0].fieldKey = FWPM_CONDITION_FLAGS; - fwfc[0].matchType = FWP_MATCH_FLAGS_NONE_SET; - fwfc[0].conditionValue.type = FWP_UINT32; - fwfc[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_OUTBOUND_PASS_THRU | FWP_CONDITION_FLAG_IS_INBOUND_PASS_THRU; + // + // note: boot-time filters added while bfe is running are enforced immediately, + // so this block stays active the whole time filters are enabled. nothing else + // ever permits forwarded traffic, which breaks mobile hotspot, internet + // connection sharing and nat'd vm switches (issue #425). + if (!_r_config_getboolean (L"AllowIpForwarding", FALSE, NULL)) + { + fwfc[0].fieldKey = FWPM_CONDITION_FLAGS; + fwfc[0].matchType = FWP_MATCH_FLAGS_NONE_SET; + fwfc[0].conditionValue.type = FWP_UINT32; + fwfc[0].conditionValue.uint32 = FWP_CONDITION_FLAG_IS_OUTBOUND_PASS_THRU | FWP_CONDITION_FLAG_IS_INBOUND_PASS_THRU; - _wfp_createfilter (engine_handle, DATA_FILTER_GENERAL, FWN_BOOTTIME, fwfc, 1, &FWPM_LAYER_IPFORWARD_V4, NULL, FWW_APP, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, filter_ids); - _wfp_createfilter (engine_handle, DATA_FILTER_GENERAL, FWN_BOOTTIME, fwfc, 1, &FWPM_LAYER_IPFORWARD_V6, NULL, FWW_APP, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, filter_ids); + _wfp_createfilter (engine_handle, DATA_FILTER_GENERAL, FWN_BOOTTIME, fwfc, 1, &FWPM_LAYER_IPFORWARD_V4, NULL, FWW_APP, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, filter_ids); + _wfp_createfilter (engine_handle, DATA_FILTER_GENERAL, FWN_BOOTTIME, fwfc, 1, &FWPM_LAYER_IPFORWARD_V6, NULL, FWW_APP, FWP_ACTION_BLOCK, FWPM_FILTER_FLAG_BOOTTIME, filter_ids); + } } action = _r_config_getboolean (L"BlockOutboundConnections", TRUE, NULL) ? FWP_ACTION_BLOCK : FWP_ACTION_PERMIT;