On the duplicate packets issue, I’ve been able to recreate this without calling down to the LWF driver. Calling EnableRouter (http://msdn.microsoft.com/en-us/library/aa365896%28v=vs.85%29.aspx) triggers duplicate packets on interfaces with the LWF driver attached. The following C# console app calls EnableRouter and UnenableRouter to demonstrate this.
using System;
using System.Runtime.InteropServices;
namespace TestEnableRouter
{
class Program
{
static void Main(string[] args)
{
string input="";
while (true)
{
Console.WriteLine("Press to enable router, 'q' to quit");
input= Console.ReadLine();
if (!String.IsNullOrEmpty(input)) break;
EnableRouter();
Console.WriteLine("Press to disable router, 'q' to quit");
input = Console.ReadLine();
if (!String.IsNullOrEmpty(input)) break;
UnenableRouter(ref overlapped, IntPtr.Zero);
}
}
static bool routing = false;
static OVERLAPPED overlapped;
static void EnableRouter()
{
try
{
OVERLAPPED overlapped = new OVERLAPPED();
overlapped.Internal = 0;
overlapped.InternalHigh = 0;
overlapped.Offset = 0;
overlapped.OffsetHigh = 0;
overlapped.Pointer = IntPtr.Zero;
overlapped.hEvent = CreateEvent(IntPtr.Zero, false, false, null); ;
Console.WriteLine("calling EnableRouter");
//Console.WriteLine("calling EnableRouter");
int feedback = EnableRouter(IntPtr.Zero, ref overlapped);
//Console.WriteLine("finished EnableRouter");
Console.WriteLine("finished EnableRouter");
if (feedback != 997) //ERROR_IO_PENDING means success, apparently
{
Console.WriteLine("IP FORWARDING: EnableRouter returned " + feedback);
}
}
catch (Exception e)
{
Console.WriteLine("IP FORWARDING: SetupFirewallAndRouting");
Console.WriteLine(e.ToString());
}
}
[StructLayout(LayoutKind.Explicit, Size = 20)]
public struct OVERLAPPED
{
[FieldOffset(0)]
public uint Internal;
[FieldOffset(4)]
public uint InternalHigh;
[FieldOffset(8)]
public uint Offset;
[FieldOffset(12)]
public uint OffsetHigh;
[FieldOffset(8)]
public IntPtr Pointer;
[FieldOffset(16)]
public IntPtr hEvent;
};
[DllImport("kernel32.dll")]
static extern IntPtr CreateEvent(IntPtr lpEventAttributes, bool bManualReset, bool bInitialState, string lpName);
[System.Runtime.InteropServices.DllImport("iphlpapi.dll")]
public static extern int EnableRouter(IntPtr hndref, ref OVERLAPPED pOverlapped);
[System.Runtime.InteropServices.DllImport("iphlpapi.dll")]
public static extern int UnenableRouter(ref OVERLAPPED pOverlapped, IntPtr lpdwEnableCount);
}
}
I think I can move forward without calling this function, but it does seem to be a regression from earlier driver version.
On the unable to switch from LWF to IM driver issue, it seems I still had a registry entry from an older customized IM driver with the same service name for the IM driver that was blocking it. After clearing it out (may have needed a reboot in there too) I am able to switch between IM and LWF. Thanks for the info, I’ll make sure to double check these keys are cleared out.