FirewallEventHandler Method of the IFWXSessionFilter Interface

The FirewallEventHandler method notifies the filter that the Microsoft Firewall service detected an event related to the user session to which the session filter is attached.


HRESULT FirewallEventHandler(
  [in]  const FirewallEvent* pFirewallEvent



Pointer to a FwxFirewallEvent structure that describes the event for which this method is called and that receives information about the event. For more information, see the documentation for each event type.

Return Value

Implementations of this method should return S_OK if the call is successful; otherwise, they should return an error code.

Example Code

The following is an example implementation of the FirewallEventHandler method.

HRESULT STDMETHODCALLTYPE CMySessionFilter::FwxFirewallEventHandler(
						FirewallEvent *pEvent)
	switch (pEvent->EventType) {
	case fwx_Connect_Tcp:
		// Handle connect event.
	case fwx_Accept:
		// Handle accept event
		return E_NOTIMPL;


This method is called by the Firewall service when an event occurs for which the filter is registered after the user session has been attached to an instance of the filter's session filter object. The implementation of this method should select the appropriate action for each event based on the value of the EventType member of the FwxFirewallEvent structure provided by the Firewall service.

For an event of the fwx_AcceptedConnection, fwx_Bind_Udp, fwx_Connect_Tcp, or fwx_Udp_Destination type, the implementation of this method can create an instance of the filter's data filter object, obtain a pointer to the applicable IFWXConnection interface from the FwxFirewallEvent structure provided in the pFirewallEvent parameter, and then call the AttachDataFilter method on this interface to attach the data filter to it. The Firewall service responds by providing two sockets that implement the IFWXSocket interface in a call to the IFWXDataFilter::SetSockets method, and the filter can start pumping data and filtering for the specific connection.


Server Requires Windows Server 2008.
Version Requires Forefront Threat Management Gateway (TMG).

Declared in Wspfwext.idl.

See Also


Send comments about this topic to Microsoft

Build date: 11/30/2009

© 2008 Microsoft Corporation. All rights reserved.