NetFilter SDK

Client side components

NetFilter SDK is a framework for transparent filtering of data packets transmitted via network. This is a high-performance proxy-less solution, compatible with all antiviruses, firewalls and other network filters. It allows filtering the transmitted packets without redirecting connections to a proxy. The SDK is suitable for developing the content filters, basic application level firewalls, traffic analyzers/shapers, other software that requires viewing and modifying TCP/UDP traffic on Windows.

SDK consists of kernel-mode and user-mode parts. SockFilter and WFP-level kernel drivers are used to filter the transmitted packets. The drivers have a simple user-level API, which can be used in C/C++/.NET/Delphi code. The drivers work on Windows 7 and later.

Key features:
  • The solution allows filtering incoming/outgoing TCP connections and UDP datagrams in a user-mode application. It is possible to filter the specified subset of connections/datagrams, restricted by filtering rules. The outgoing TCP connections can be redirected to a different address.
  • The filtering is fully transparent, because the driver allows viewing and changing TCP/UDP data without redirecting traffic to a proxy or modifying the addresses. There are no conflicts with antiviruses, firewalls and other filters.
  • The filtering driver operates at the transport level, in front of the TCP/IP stack. In effect, it automatically supports all kinds of TCP/IP capable network adapters: Ethernet, Dial-up/DSL/Cable modems, wireless adapters including Wi-Fi and Bluetooth, virtual adapters like loopback or VPN.
  • Both IPv6 and IPv4 are supported.
  • The process context (as a process identifier) is available for all network activity.
  • The driver user-level interface (API) is easy to use, but powerful. There is no need to deal with the packet headers (like in NDIS-level packet filters) or complicated WinSock interfaces.
  • There are no problems with the high-speed connections, because the driver operates at the transport level, between applications and the TCP/IP stack. It is possible to control the speed of data transmission.
  • SockFilter and WFP drivers work similarly on 32-bit and 64-bit Windows operating systems starting with Windows 7.
  • It is possible to use the 32-bit API with 32-bit or 64-bit drivers.
  • WFP driver allows filtering of any IP-based protocols (e.g. ICMP).

System requirements:
Windows 7/8/10/11, x86/x64/arm64.

Server-side components

nfsrvfilter is a server-side driver, allowing control of access and filtering of IP traffic on a gateway host. TCP connections and UDP packets directed to other hosts via a gateway with the driver installed can be filtered by redirecting them to a local proxy using network address translation. When the filtering is enabled for TCP and UDP, the solution works as a transparent proxy for the filtered traffic.

Key features:
  • The solution allows filtering (modifying) incoming/outgoing TCP connections and UDP datagrams. It is possible to filter the specified subset of connections/datagrams, restricted by filtering rules.
  • The filtering driver is implemented as a WFP filter on top of the TCP/IP stack.
  • Both IPv6 and IPv4 are supported.
  • It is possible to control the speed of data transmission and count the traffic using flow control contexts.
  • The driver works the same way on all 32-bit and 64-bit Windows operating systems starting with Windows 8. It is possible to use the 32-bit API with a 64-bit driver.
System requirements:
Windows 8/10/11 x86/x64