vpn/netstate: add WFP leak fence for the Windows gateway client

Windows' strong host send model keeps connections established before the
gateway was enabled flowing out of the physical NIC for their whole
lifetime — the /1 routes never apply to a socket with an already-fixed
source. Browser HTTP/2/HTTP/3 keep-alive pools are the visible case: the
egress IP appears unchanged after enabling. On Linux the weak host model
routes such flows into the tunnel where they die and get re-dialled; on
Windows nothing kills them — a real leak routing cannot fix.

Install a dynamic WFP session alongside the client routes with a BLOCK on
ALE_AUTH_CONNECT_V4/V6 and permits for our own process (app ID), tunnel
egress (TUN LUID) and local destinations. Adding the filter reauthorizes
established flows so pre-gateway connections break and re-establish through
the tunnel, matching Linux. Inbound is intentionally not blocked so
enabling the gateway over an RDP session does not cut it.

Author: pymq

.github/workflows/test.yml

@@ -160,6 +160,9 @@ jobs:
           # Probe the egress IP via https://ifconfig.me
           curl4() { curl -4 -s --max-time 20 --retry 3 --retry-delay 2 https://ifconfig.me/; }
           IP_DIRECT=$(curl4); echo "egress IP (direct): $IP_DIRECT"
+          # Source IP of the physical uplink, used below to force a leak probe
+          # out of the NIC (bypassing the fwmark policy route).
+          NIC_IP=$(ip -4 route get 1.1.1.1 | grep -oP 'src \K\S+'); echo "uplink src IP: $NIC_IP"
 
           ./awl cli gateway client use --name awl-tester
           ./awl cli gateway status
@@ -183,6 +186,26 @@ jobs:
           ! echo "$RULE_OFF"  | grep -q fwmark               # policy route removed on disable
           ! echo "$ROUTE_OFF" | grep -q 'default dev awl0'   # TUN default removed on disable
 
+          # Second enable/disable cycle: a runtime re-enable after a disable is
+          # the exact flow that looked broken in manual Windows testing (it was
+          # not — browser keep-alive pools were lying). Assert the egress flips
+          # again and reverts again. Also probe for a leak: a socket forced out
+          # of the physical NIC (--interface) bypasses the fwmark policy route,
+          # but on Linux those packets are still routed by destination into the
+          # TUN and die there (their NIC source is not NATed by the exit node),
+          # so a NIC-bound curl must fail while the gateway is on. This is the
+          # weak-host-model counterpart of the Windows WFP leak fence.
+          ./awl cli gateway client use --name awl-tester
+          IP_GW2=$(curl4 || true); echo "egress IP (via gateway, cycle 2): $IP_GW2"
+          LEAK=$(curl -4 -s --max-time 8 --interface "$NIC_IP" https://ifconfig.me/ || true)
+          echo "NIC-bound egress while gateway on (must be empty): '$LEAK'"
+          ./awl cli gateway client stop
+          IP_REVERTED2=$(curl4); echo "egress IP (reverted, cycle 2): $IP_REVERTED2"
+          test -n "$IP_GW2"                                  # re-enable tunnelled again
+          test "$IP_GW2" != "$IP_DIRECT"                     # egress changed on 2nd enable too
+          test -z "$LEAK"                                     # NIC-bound egress did NOT bypass the tunnel
+          test "$IP_REVERTED2" = "$IP_DIRECT"                # 2nd disable reverted egress
+
           # Re-enable so the SIGINT shutdown path (teardownGatewayAtShutdown) is exercised.
           ./awl cli gateway client use --name awl-tester
 
@@ -253,6 +276,10 @@ jobs:
 
           curl4() { curl -4 -s --max-time 20 --retry 3 --retry-delay 2 https://ifconfig.me/; }
           IP_DIRECT=$(curl4); echo "egress IP (direct): $IP_DIRECT"
+          # Source IP of the physical uplink (captured before enable, so the
+          # best route still points at the NIC, not the TUN). Used to force a
+          # leak probe out of the NIC past the /1 routes.
+          NIC_IP=$(powershell -NoProfile -Command '(Find-NetRoute -RemoteIPAddress 1.1.1.1 | Select-Object -First 1).IPAddress' | tr -d '\r'); echo "uplink src IP: $NIC_IP"
 
           # NRPT diagnostics before enable (split-DNS rules for the awl zone)
           powershell -NoProfile -Command 'Get-DnsClientNrptPolicy | Format-List Namespace,NameServers'
@@ -270,6 +297,11 @@ jobs:
           # (a broken tunnel must not leave the runner black-holed); the
           # `test -n "$IP_GW"` assertion after teardown turns it into a clean failure.
           IP_GW=$(curl4 || true); echo "egress IP (via gateway): $IP_GW"
+          # Leak probe: a socket forced out of the physical NIC (--interface)
+          # bypasses the /1 routes via the strong host model — exactly the leak
+          # the WFP fence exists to close. Must fail while the gateway is on.
+          LEAK=$(curl.exe --interface "$NIC_IP" -4 -s --max-time 8 https://ifconfig.me/ || true)
+          echo "NIC-bound egress while gateway on (must be empty): '$LEAK'"
 
           ./awl.exe cli gateway client stop
           ROUTES_OFF=$(powershell -NoProfile -Command '(Get-NetRoute -DestinationPrefix 0.0.0.0/1,128.0.0.0/1 -ErrorAction SilentlyContinue | Measure-Object).Count' | tr -d '\r')
@@ -279,14 +311,28 @@ jobs:
           # Assertions run with the gateway already disabled, so a failure here
           # can't leave the runner's egress black-holed. Values are echoed
           # first so a failed assertion is attributable from the log alone.
-          echo "ROUTES_ON=$ROUTES_ON NRPT_ON=$NRPT_ON ROUTES_OFF=$ROUTES_OFF NRPT_OFF=$NRPT_OFF"
+          echo "ROUTES_ON=$ROUTES_ON NRPT_ON=$NRPT_ON ROUTES_OFF=$ROUTES_OFF NRPT_OFF=$NRPT_OFF LEAK='$LEAK'"
           test "$ROUTES_ON" -eq 2                            # /1 pair installed while gateway is on
           test "$NRPT_ON" -ge 1                              # full-capture NRPT rule while gateway is on
           test -n "$IP_GW"                                   # traffic really flowed through the exit node
           test "$IP_GW" != "$IP_DIRECT"                      # egress changed => full-tunnel works
           test "$IP_REVERTED" = "$IP_DIRECT"                 # runtime disable reverted egress
           test "$ROUTES_OFF" -eq 0                           # /1 routes removed on disable
           test "$NRPT_OFF" -eq 0                             # full-capture NRPT rule removed on disable
+          test -z "$LEAK"                                     # WFP fence blocked NIC-bound egress bypass
+
+          # Second enable/disable cycle: a runtime re-enable after a disable is
+          # the exact flow that looked broken in manual testing (it was not —
+          # browser keep-alive pools were lying). Assert egress flips again and
+          # reverts again; the gateway is already off at each assertion so a
+          # failure can't black-hole the runner.
+          ./awl.exe cli gateway client use --name awl-tester
+          IP_GW2=$(curl4 || true); echo "egress IP (via gateway, cycle 2): $IP_GW2"
+          ./awl.exe cli gateway client stop
+          IP_REVERTED2=$(curl4); echo "egress IP (reverted, cycle 2): $IP_REVERTED2"
+          test -n "$IP_GW2"                                  # re-enable tunnelled again
+          test "$IP_GW2" != "$IP_DIRECT"                     # egress changed on 2nd enable too
+          test "$IP_REVERTED2" = "$IP_DIRECT"                # 2nd disable reverted egress
 
           # Re-enable the gateway and hard-kill awl. A graceful-shutdown test is
           # not possible here: Git-Bash `kill -SIGINT` cannot deliver a console

README.md

@@ -250,18 +250,18 @@ In short: reach for SOCKS5 to send a single app through a peer, and for the VPN
 | --- | --- | --- | --- |
 | Linux | ✅ | ✅ | fully supported |
 | Android | ✅ | ❌ | exit-node role needs root — not planned |
-| Windows | ⏳ | ⏳ | coming next |
+| Windows | ✅ | ✅ | fully supported |
 | macOS | ❌ | ❌ | needs volunteers for testing |
 
-On macOS and Windows awl currently refuses to start with VPN gateway enabled.
+On macOS awl currently refuses to start with VPN gateway enabled.
 
 > ⚠️ **IPv6 is not tunnelled.** The gateway only carries IPv4. While it's on, all IPv6 traffic is dropped so that your real IPv6 address is never exposed past the exit node:
 > - **Dual-stack (IPv4 + IPv6):** everything automatically uses IPv4 through the tunnel.
 > - **IPv6-only network:** you'll have no internet connectivity until you turn the gateway off.
 
 ### Serve as an exit node
 
-This lets your other devices route their internet traffic out through this one. It is **off by default** — see [Why serving as an exit node is opt-in](#why-serving-as-an-exit-node-is-opt-in) below. Two things need to be set: turn the gateway service on, then allow each specific device to use it. Serving as an exit node is Linux-only (see the status table above).
+This lets your other devices route their internet traffic out through this one. It is **off by default** — see [Why serving as an exit node is opt-in](#why-serving-as-an-exit-node-is-opt-in) below. Two things need to be set: turn the gateway service on, then allow each specific device to use it.
 
 **Desktop (web UI):** open http://admin.awl, go to **Settings** (the gear icon, top-right) and turn on **Serve as VPN Gateway**. Then, for each device you want to permit, open its card on the Overview page, click **Settings**, and set **Allow as exit node** to *Allowed*. On `awl-tray` you can also toggle the service from the tray menu under **VPN Gateway → Serve as VPN Gateway**.
 
@@ -305,7 +305,7 @@ awl cli gateway client stop
 
 ### Why serving as an exit node is opt-in
 
-Unlike the SOCKS5 proxy, serving as a VPN gateway changes global system state on the host: awl turns on `net.ipv4.ip_forward` and installs iptables rules. That can interfere with the host's existing networking or firewall setup, and it isn't something awl can sandbox — so we don't enable it on a routine install. You opt in explicitly, the same way every mainstream VPN (ZeroTier, WireGuard, OpenVPN, ...) keeps exit-node mode opt-in.
+Unlike the SOCKS5 proxy, serving as a VPN gateway changes global system state on the host: on Linux awl turns on `net.ipv4.ip_forward` and installs iptables rules; on Windows it creates a WinNAT instance, enables per-interface IP forwarding and installs a WFP firewall filter. That can interfere with the host's existing networking or firewall setup, and it isn't something awl can sandbox — so we don't enable it on a routine install. You opt in explicitly, the same way every mainstream VPN (ZeroTier, WireGuard, OpenVPN, ...) keeps exit-node mode opt-in.
 
 The privacy exposure — your IP appearing as the source of another device's traffic — is *not* what this toggle gates: it is the same for SOCKS5 and the VPN gateway, and it's controlled by the per-device **Use as exit** permission (see [Security and privacy notes](#security-and-privacy-notes) below). This toggle only governs the host-level networking changes above.
 
@@ -314,12 +314,16 @@ The privacy exposure — your IP appearing as the source of another device's tra
 - **A device isn't available as an exit node.** It hasn't turned on **Serve as VPN Gateway**, or hasn't set **Allow as exit node** to *Allowed* for you, or the status exchange hasn't propagated yet — wait up to ~5 minutes or until the next reconnect.
 - **A "what's my IP" site still shows your own IP after enabling.** Check the gateway status (the **VPN Gateway** card, or `awl cli gateway status`): if it's not connected, awl can't reach the exit node, so nothing is being tunnelled.
 - **A site works over IPv6 but not through the gateway.** Expected — IPv6 isn't tunnelled (see the note above). Dual-stack hosts fall back to IPv4 automatically; anything IPv6-only won't work while the gateway is on.
+- **Turning on *Serve as VPN Gateway* fails on Windows.** Windows effectively allows one NAT instance per host, and it may already be taken by Docker (Windows containers), WSL2 or Internet Connection Sharing — the error message lists the current holders. Free it up, or share this device over SOCKS5 instead: the SOCKS5 exit node doesn't need NAT.
+- **No IPv6 connectivity after awl crashed (Linux).** If awl is killed (not shut down) with the gateway client on, its IPv6 block stays behind. It is removed automatically on the next awl start (and stop).
+- **Devices are reachable only via relay from a Windows machine with multiple network interfaces.** awl on Windows pins its peer-to-peer traffic to the interface that holds the default route, so peers reachable only through a secondary network card may fall back to relayed connections.
 
 ### Security and privacy notes
 
 - **Your IP is exposed.** Once you serve as an exit node, the public IPs that those devices reach see your IP, not theirs.
-- **Your LAN is not.** awl drops forwarded traffic to RFC 1918 / RFC 6598 / RFC 3927 ranges (`10/8`, `172.16/12`, `192.168/16`, `100.64/10`, `169.254/16`) so a gateway client cannot reach the exit node's home network.
+- **Your LAN is not.** awl drops forwarded traffic to RFC 1918 / RFC 6598 / RFC 3927 ranges (`10/8`, `172.16/12`, `192.168/16`, `100.64/10`, `169.254/16`) so a gateway client cannot reach the exit node's home network. On Linux this is an iptables chain; on Windows, a WFP forward-layer BLOCK filter with the same subnet list.
 - **DNS:** in client gateway mode awl forces upstream DNS to a public resolver (`1.1.1.1` by default) so the LAN resolver can't leak queries past the tunnel. If you'd rather use a different resolver, you can change it by hand in the config file (`dns.upstreamDNSAddress`) while awl is stopped.
+- **Connections open before you enable the gateway are cut, not leaked.** When you turn client gateway mode on, existing outbound connections (a browser's keep-alive pools are the common case) are forced to break so applications re-establish them through the tunnel — otherwise, on Windows, they would keep flowing directly through your physical network card and expose your real IP. On Linux this happens naturally (the tunnel routing kills them); on Windows awl installs a WFP firewall to force it. One deliberate exception on Windows: if this device is *hosting* a service (e.g. an RDP or SMB server) and someone is already connected to it, that inbound connection keeps answering directly, so that enabling the gateway over a remote session does not disconnect you. Fresh inbound connections while the gateway is on are still limited to the tunnel path.
 
 ## Configuration
 

vpn/netstate/nat_windows.go

@@ -20,11 +20,22 @@ import (
 )
 
 const (
-	wfpSublayerName = "awl-gateway"
-	wfpRuleName     = "awl-gateway: block forwarded LAN/CGNAT egress from TUN"
+	wfpSublayerName = "awl-gateway-server"
+	wfpRuleName     = "awl-gateway-server: block forwarded LAN/CGNAT egress from TUN"
 
 	// winNATName is the name of the WinNAT instance owned by awl.
 	winNATName = "awl-gateway"
+
+	// wfpSublayerWeight is the weight of both awl WFP sublayers (the server
+	// forward-layer filter and the client leak fence). 0x8000 is the midpoint
+	// of the uint16 range: sublayers arbitrate high-to-low, and our BLOCK
+	// rules lose only to a hard permit (FWPM_FILTER_FLAG_CLEAR_ACTION_RIGHT)
+	// from a higher-weight sublayer. The midpoint deliberately does NOT claim
+	// the top: these filters fence awl's own traffic, they are not a host
+	// kill-switch, so a security product that outranks us on purpose (EDR,
+	// corporate firewall) is allowed to win. Contrast wireguard-windows,
+	// whose firewall takes 0xFFFF exactly because it IS a kill-switch.
+	wfpSublayerWeight = 0x8000
 )
 
 // natState holds the state needed to teardown NAT on Windows.
@@ -266,41 +277,20 @@ func resyncForwarding(state *natState, route uplinkRoute, ok bool, enable func(w
 // when the session closes or the process dies, so there is no stale-WFP
 // recovery path.
 func setupWFP(state *natState, tunIfIndex uint32, awlPrefix netip.Prefix) error {
-	session, err := wf.New(&wf.Options{
-		Name:        "Anywherelan VPN gateway",
-		Description: "Blocks forwarded traffic from awl devices to the exit node's private networks",
-		Dynamic:     true,
-	})
+	session, sublayerID, err := openDynamicWFPSession(
+		"Anywherelan VPN gateway",
+		"Blocks forwarded traffic from awl devices to the exit node's private networks",
+		wfpSublayerName,
+	)
 	if err != nil {
-		return fmt.Errorf("open WFP session: %w", err)
+		return err
 	}
 	// Parked in state immediately, so on any later failure the caller's
 	// rollback (teardownNAT) closes the session — the same idiom as the
 	// forwarding and WinNAT steps. A dangling dynamic session would otherwise
 	// outlive its guarantees until process exit.
 	state.wfpSession = session
 
-	sublayerID, err := newWFPGUID()
-	if err != nil {
-		return err
-	}
-	// Weight 0x8000 = the midpoint of the uint16 sublayer range. Sublayers
-	// arbitrate high-to-low, and our BLOCK loses only to a hard permit
-	// (CLEAR_ACTION_RIGHT) from a higher-weight sublayer — see the rule
-	// comment below. The midpoint deliberately does NOT claim the top:
-	// this filter fences awl's forwarded transit, it is not a host
-	// kill-switch, so a security product that outranks us on purpose (EDR,
-	// corporate firewall) is allowed to win. Contrast wireguard-windows,
-	// whose firewall takes 0xFFFF exactly because it IS a kill-switch.
-	err = session.AddSublayer(&wf.Sublayer{
-		ID:     wf.SublayerID(sublayerID),
-		Name:   wfpSublayerName,
-		Weight: 0x8000,
-	})
-	if err != nil {
-		return fmt.Errorf("add WFP sublayer: %w", err)
-	}
-
 	ruleID, err := newWFPGUID()
 	if err != nil {
 		return err
@@ -321,7 +311,7 @@ func setupWFP(state *natState, tunIfIndex uint32, awlPrefix netip.Prefix) error
 		ID:         wf.RuleID(ruleID),
 		Name:       wfpRuleName,
 		Layer:      wf.LayerIPForwardV4,
-		Sublayer:   wf.SublayerID(sublayerID),
+		Sublayer:   sublayerID,
 		Weight:     1000,
 		Conditions: conditions,
 		Action:     wf.ActionBlock,
@@ -333,6 +323,40 @@ func setupWFP(state *natState, tunIfIndex uint32, awlPrefix netip.Prefix) error
 	return nil
 }
 
+// openDynamicWFPSession opens a dynamic WFP session and creates one sublayer
+// in it at wfpSublayerWeight, returning both. Shared by the server
+// forward-layer filter (setupWFP) and the client leak fence
+// (setupClientFence). Dynamic: the kernel removes the sublayer and every rule
+// under it when the session closes or the process dies, so there is no
+// stale-WFP recovery path on either side. On failure the session is closed
+// here; on success the caller must park it where its teardown can close it.
+func openDynamicWFPSession(name, description, sublayerName string) (*wf.Session, wf.SublayerID, error) {
+	session, err := wf.New(&wf.Options{
+		Name:        name,
+		Description: description,
+		Dynamic:     true,
+	})
+	if err != nil {
+		return nil, wf.SublayerID{}, fmt.Errorf("open WFP session: %w", err)
+	}
+
+	sublayerGUID, err := newWFPGUID()
+	if err != nil {
+		_ = session.Close()
+		return nil, wf.SublayerID{}, err
+	}
+	sublayerID := wf.SublayerID(sublayerGUID)
+	if err := session.AddSublayer(&wf.Sublayer{
+		ID:     sublayerID,
+		Name:   sublayerName,
+		Weight: wfpSublayerWeight,
+	}); err != nil {
+		_ = session.Close()
+		return nil, wf.SublayerID{}, fmt.Errorf("add WFP sublayer: %w", err)
+	}
+	return session, sublayerID, nil
+}
+
 func newWFPGUID() (windows.GUID, error) {
 	guid, err := windows.GenerateGUID()
 	if err != nil {