While searching data(Firewall), I visited http://ntdev.h1.ru/ndis_fw.html.
I found NDIS Hooking based Firewall named ndis_fw.
I installed ndis_fw.
But ndis_fw seems that it don’t work.
ndis_flt and ndis_hk drivers are loaded successfully, of course.
Then, i edited ndis_fw.conf(configuration file), but packets are not
filtered.
In my memory, when i installed ndis_fw in former days(February, 2003),
ndis_fw worked well.
So i checked LOGS of former days.
— begin —
0000000001 2003.02.28 16:05:25.433 RULES applied
0000000002 2003.02.28 16:05:25.433 ADAPTER if:1 NDISWANIP
0000000003 2003.02.28 16:05:25.433 ADAPTER if:2 Intel 8255x-based PCI
Ethernet Adapter (10/100)
0000000004 2003.02.28 16:05:25.433 DRIVER started OK
0000000005 2003.02.28 16:06:23.046 DENY(101) tcp in
0000000006 2003.02.28 16:06:26.130 DENY(101) tcp in
0000000007 2003.02.28 16:06:32.029 DENY(101) tcp in
0000000008 2003.02.28 16:06:40.861 ALLOW(112) udp out
0000000009 2003.02.28 16:06:41.883 ALLOW(112) udp out
And following is current LOGS.
— begin —
0000000001 2003.04.29 19:35:21.521 RULES applied
0000000002 2003.04.29 19:35:21.521 DRIVER started OK
0000000003 2003.04.29 19:43:27.120 RULES applied
0000000004 2003.04.29 19:44:37.191 RULES applied
Compare to LOGS of former days, ADAPTER list is not found.
I think that ndis_fw couldn’t get ADAPTER list.
Only these are logged.
means that i edited ndis_fw.conf.
I checked registry and registry key and value was correct.
I checked ndis_hk is loaded before tcpip and ndis_flt is loaded after
tcpip(by using loadord from sysinternals).
That is, load order was correct.
What’s the problems?
I’m feeling difficulty in solving these problems.
I really want you help me, please.