Network Firewall

What is it?

The firewall decides which network packets the system accepts and which it sends. This roadmap builds a stateful packet filter: an ordered table of up to 64 rules where the first match wins, hooks in the IPv4 and IPv6 send and receive paths, automatic acceptance of replies to connections the machine opened, a default policy of allow outbound and block inbound, a fw command, rules saved in the Registry, a Control Panel applet and per-rule hit counters. Impossible OS has no firewall today, so every packet the stack understands is processed. All nine sections are unstarted.

How does it work?

Today. Nothing filters traffic. What the stack accepts is limited only by what it implements: ipv4_handle() in ip.c passes ICMP and UDP up and drops TCP because TCP does not exist, and udp_handle() in udp.c delivers only port 68 to the DHCP client. That narrow surface is the whole of today's exposure, and it has gaps a firewall would not close on its own: ipv4_handle() accepts packets addressed to any IP and does not verify the header checksum, and the DHCP client in dhcp.c uses a fixed transaction ID, so any host on the local network can answer it.

Planned design.

1. The engine. A fw_rule holds direction, protocol, source and destination address with prefix length, port ranges and an allow or block action. fw_check() walks the table in order and returns the first match, or the default policy.
2. IPv4 hooks. fw_check() runs on every packet in ipv4_handle() and ipv4_send(). Blocked inbound packets are dropped silently rather than rejected, so a scan sees nothing. ipv4_send() returns nothing today, so the outbound hook also needs a way to report the block to its caller.
3. Connection tracking. Before the rule scan, inbound packets are checked against the connection table from TCP and Network Infrastructure; a reply to an outbound connection is allowed without a rule.
4. Default rules. Inbound is blocked and outbound allowed, with explicit exceptions for ICMP, DHCP, DHCPv6, DNS and NTP replies.
5. IPv6. The same engine with IPv6 address fields, hooked into the IPv6 send and receive paths.
6. Command line. fw list, add, remove, flush, enable, disable and status.
7. Persistence. Rules saved under HKEY_LOCAL_MACHINE\SYSTEM\Network\Firewall\Rules and loaded at boot, using the Registry API in registry.h.
8. Control Panel. A firewall.cpl applet with an on and off switch, rule editing and a 100-entry log of blocked packets.
9. Counters. An atomic hit count on every rule, readable from /sys/firewall and shown by fw list.

flowchart LR
    IN[inbound packet] --> CT{tracked connection?}
    CT -- yes --> OK[accept]
    CT -- no --> R[rule scan, first match]
    R -- allow --> OK
    R -- block --> DROP[silent drop + counter]
    OUT[outbound packet] --> R2[rule scan] --> SEND[send + track]

What are its interfaces?

All planned:

How do I use it?

It cannot be used yet.

What is not implemented yet?

• Engine and hooks: Packet Filter Engine, IP Layer Hooks and Stateful Connection Tracking Integration.
• Policy: Default Ruleset and IPv6 Firewall.
• Management: Firewall CLI, Registry Persistence, firewall.cpl Control Panel Applet and Per-Rule Hit Counters.
• Not planned: per-application rules, network profiles (domain, private and public) and NAT.

How does it compare with Windows 11 and Linux?

Windows 11 has Windows Defender Firewall on top of the Windows Filtering Platform, with per-application rules, network profiles and netsh advfirewall. Linux has nftables (and the older iptables) on the netfilter hooks, with nf_conntrack for state and front ends such as firewalld and ufw. The planned design is closer to a simple nftables table than to Windows' profile model; its distinctive feature is atomic per-rule hit counters readable as a plain file.

See also

• Firewall roadmap
• TCP and Network Infrastructure
• IPv6 Dual Stack
• Registry
• Networking