IP Firewall Application Development
Other versions of this page are also available for the following:
.gif "A hyphen indicates that the information in this topic is not relevant for this platform, or that the platform does not support the API that is listed.")
.gif "A checkmark indicates that the information in this topic is relevant for this platform, and that any API listed is also supported on this platform.")
8/28/2008
The IP firewall is typically used on an Internet gateway device. It can also be used as a host firewall. The firewall helps protect the device on which it runs and helps to protect devices on the private side of the gateway. The firewall blocks IP traffic at the IP and transport layers.
This firewall uses rules to determine whether to block, allow, or log inbound or outbound traffic. Inbound traffic originates from a host on the public side of the firewall. Outbound traffic originates from either a host on the private side or the device that is running the firewall. The firewall implements stateful traversal for inbound traffic that was initiated from the private network.
The following illustration shows the public and private side of the firewall.
.gif "Aa924904.4872fc69-fee1-463c-934a-f9e7e764155a(en-us,MSDN.10).gif")
The following list shows the default settings for the firewall rules when no overriding registry entries are set:
- Block all inbound traffic, including IPSec traffic, except when the firewall is running with NAT and the inbound packet has been translated by a NAT port mapping.
- Allow all outbound traffic.
You can change the default settings by configuring the firewall. The common.reg file contains a number of default rules that override the default firewall state. For more information about the default firewall rules, see Default IP Firewall Rules.
You can enable or disable the firewall, create a new rule, change a rule, or disable a rule by using functions or registry keys.
Note
Disabled rules do not affect packet filtering or logging.
The following table shows some of the functions that perform each task.
| Rule task | Programming element |
|---|---|
Enable or disable the firewall |
|
Create a new firewall rule |
|
Delete a rule |
|
Get information about rules |
For a list of all of the firewall functions, see IP Firewall Reference.
Code samples of the IP firewall and firewall log are located in the %_WINCEROOT%\Public\Common\Sdk\Samples\Firewall directory.
When a host on the private side of the firewall tries to contact a host on the public side, the IP Firewall enables some types of ICMP protocol packets. This allows ICMP error messages to reach the private host in the event that an error occurs during delivery, if for example, a packet is dropped or the destination is unreachable. The IP Firewall sets a rule to enable this error message feedback. The following table shows the ICMP types that the firewall allows inbound.
| ICMP version | ICMP types allowed |
|---|---|
ICMPv4 |
|
ICMPv6 |
|
Although you can disable the ICMP messages, before doing so, you should consider the security implications: Debugging is more difficult, and you cannot detect that a packet delivery error has occurred. This may result in the inability to use tools, such as Ping and Tracert, or in the inability to reach some remote hosts.
If you want to disable ICMP, you can create a blocking rule that drops inbound ICMP packets of a specific type, or that drops all inbound ICMP packets.
For information about the firewall and security, see IP Firewall Security.
See Also
Reference
IP Firewall Reference
IP Firewall Logging Reference