Microsoft Internet Security and Acceleration Server 2000

IFWXIpFilter

IFWXIpFilter is the application filter interface that represents an IP Filter: a range of IP addresses for which a connection or socket is allowed to function. Use this interface to ensure that secondary and emulated connections are secure.

Methods in Vtable Order

IUnknown Methods	Description
QueryInterface	Returns pointers to supported interfaces.
AddRef	Increments the reference count.
Release	Decrements the reference count.

IFWXIpFilter Methods	Description
IncludeRange	Includes a range of IP addresses in the IP filter.
ExcludeRange	Excludes a range of IP addresses from the IP filter.
IncludeFilter	Includes in the IP filter a range of IP addresses represented by an existing IP filter.
ExcludeFilter	Excludes from the IP filter a range of IP addresses represented by an existing IP filter.
IsIncluded	Checks if a particular IP address is allowed by the IP filter.
Compare	Compares the IP ranges of two IP filters.
Clone	Returns a copy of an IP filter.

Implementation

This interface is implemented by the Firewall service.

Remarks

There are situations in which an application filter is responsible for limiting what IP addresses are allowed access, including:

The case of a secondary inbound connection, as occurs in use of the FTP protocol. Use IFWXIpFilter in the FTP scenario to restrict the access to the inbound socket of the secondary connection. For example, an FTP application filter opens a secondary connection with a range that includes only the IP address of the FTP server. All IP packets with a source address that isn't the IP address of the FTP server will be ejected by the packet filter driver if they are addressed to the socket that FTP application filter created for the secondary connection.
The case of a secondary or emulated connection in a publishing scenario.

For security purposes, the application filter has to define an IP filter: a range of IP addresses for which a particular connection or socket is allowed. The IFWXIpFilter interface is where you define that range of IP addresses.

An IP filter created by using the IFWXIpFilter interface is no more than a definition of IP ranges. The mechanism that provides the filtering functionality is the ISA server packet filtering mechanism. Therefore, an IP filter defined by using IFWXIpFilter will not function unless IP packet filtering is enabled in ISA. For more information about packet filtering, see IP Packet Filtering or the ISA Server product documentation.

Note If you set the range of IP addresses equal to NULL, you are allowing all addresses to connect.

Requirements

  Windows NT/2000: Requires Windows 2000.
  Version: Requires ISA Server 2000.
  Header: Wspfwext.idl.

IFWXIpFilter

Methods in Vtable Order

Implementation

Remarks

Requirements

See Also