Windows Firewall Software to Filter Transit Traffic

Question

I need to test my networking code for Nintendo Wii under the conditions when some specific Internet server is not available.

Wii is connected to my PC with crossover ethernet cable. PC has 2 NICs. PC is connected to hardware router with ethernet cable. The hardware router serves as NAT and has an internet connected to its uplink.

I set the Wii to be in the same lan as PC by using Windows XP Network bridge. I can observe the WII network traffic using e.g. Wireshark sniffer.

Is there a software firewall that can selectively filter out transit traffic? (e.g. block outgoing TCP connections to 123.45.67.89 to port 443)

I tried Outpost Pro 2009 and Comodo.

Outpost firewall blocks all transit traffic with it's implicit "block transit packet" rule. If the transit traffic is explicitly allowed by creating the system-wide low level rule, then it's allowed completely and no other filter can selectively block it.

Comodo firewall only process rules when the packet has localhost's IP as either source or destination, allowing the rest of the traffic.

Any ideas?

Thanks in advance!

P.S. Platform is Windows XP 32 bit, no other OSes is allowed, Windows ICS (Internet Connection Sharing) doesnt work since the Wii is unable to connect, becides I don't like the idea of adding one more level of NAT.

Answer 1

Since you are using a bridge, routing and/or network-layer filtering tricks will not work.

I'm curious as to why ICS does not work. If the Wii can connect behind one layer of NAT, it should be able behind two (and in fact, I do have one behind double nat - I don't like it either, but over a 3G uplink it's the only way - and it works fine). Maybe this is specific to windows ?

What you could try is to make the windows box a layer 3 router. It depends on how much control you do have over your router. Say you Router has address 192.168.1.1, windows pc is 192.168.1.2, Wii is 192.168.1.3. If you can, set up the Wii to use 192.168.1.2 as its default gateway. Or, if you are able to, remove the bridge, and use two different private networks (192.168.1.x for router-pc and 192.168.2.x for pc-wii), but without NAT (but this requires that you are able to fiddle with the router routing table)

In both cases, once the wii depends on layer 3 routing on the windows box, you can easily add null-routes for the IP addresses you want to block. (For instance, to block 10.0.0.1, use cmd ROUTE ADD 10.0.0.1 MASK 255.255.255.255 0.0.0.0)