Guided path: Networking stack tour
Step 5 of 7
Filtering & firewalling
Where Windows observes and controls traffic with filtering layers.
Related labs
Hands-on exercises for this area — in the browser or on a Windows machine.
View all labsOfficial Microsoft docs
Closest official references related to this topic on Microsoft Learn.
Why it matters
Security products, Windows Firewall, and many observability tools depend on filtering hooks in the stack.
Mental model
Filtering layers are checkpoints where Windows or third parties can inspect, permit, block, or transform traffic.
How it works
- 1WFP exposes filtering layers and callouts across networking paths.
- 2Policy decides whether traffic is allowed or blocked.
- 3Security and diagnostics tools often build on these same hooks.
Key terms
- Callout
- A filter-driven extension point used to inspect or alter traffic.
- Firewall policy
- The rule set that decides what traffic is permitted.
Blocking an outbound connection
The firewall decision is not abstract magic; it happens inside defined filtering points within the networking stack.
Common misconception
The firewall is not a separate universe from networking internals; it is integrated into the same packet path.
You should read next
Ranked from your current topic, related links, branch depth, and any active guided path.
expert
WFP & BFE (deep dive)
How filters are stored, enforced, and hooked into the packet path.
Next step in your guided path
beginner
Security
Access tokens, privileges, integrity, and how Windows decides who can do what.
Related topic
beginner
Providers & channels
Who emits events and where those records are routed inside Windows logging.
Related topic