WFP ALE_CONNECT_REDIRECT layer block filter doesn't work - redirect

Question

I am doing some work with WFP and I have the problem with blocking filter on FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 layer. It must block trafic from local ip, but it doesn't. If I change layer to FWPM_LAYER_ALE_AUTH_CONNECT_V4 filter works properly.
So I have several questions:
1) Can I block trafic from specified local ip on FWPM_LAYER_ALE_CONNECT_REDIRECT_V4 layer (code below doesn't work)?
2) Can we create conditions with local_ip(remote_ip) on ale_connect_redirect(or ale_bind_redirect) layers?
UINT32 test_wfp_filter(HANDLE engine_handle,
FWP_V4_ADDR_AND_MASK* source_ip,
UINT8 weight)
{
UINT32 status;
FWPM_FILTER filter = { 0 };
FWPM_FILTER_CONDITION filter_conditions[1] = { 0 };
filter_conditions[0].fieldKey = FWPM_CONDITION_IP_LOCAL_ADDRESS;
filter_conditions[0].matchType = FWP_MATCH_EQUAL;
filter_conditions[0].conditionValue.type = FWP_V4_ADDR_MASK;
filter_conditions[0].conditionValue.v4AddrMask = source_ip;
status = UuidCreate(&(filter.filterKey));
if (status != NO_ERROR)
{
return status;
}
filter.layerKey = FWPM_LAYER_ALE_CONNECT_REDIRECT_V4;
//With this layerKey filter doesn't work,
//but with FWPM_LAYER_ALE_AUTH_CONNECT_V4 filter works properly
filter.displayData.name = L"Blocking filter";
filter.displayData.description = L"Blocks all trafic from current comp";
filter.action.type = FWP_ACTION_BLOCK;
filter.subLayerKey = WFP_TEST_SUBLAYER;
filter.weight.type = FWP_UINT8;
filter.weight.uint8 = weight;
filter.filterCondition = filter_conditions;
filter.numFilterConditions = 1;
status = FwpmFilterAdd(engine_handle, &filter, 0, 0);
return 0;
}
Thank you!

Answer 1

It's not 100% obvious what you are trying to achieve but:
No, the ALE_CONNECT_REDIRECT and ALE_BIND_REDIRECT layers are for modifying source/destination details associated with a flow (prior to establishment), not blocking the flow. An example usage would be writing a local proxy; you might install an ALE_CONNECT_REDIRECT callout which modifies the destination details for an attempted connection such that the connection is actually made to your own application rather than where it was originally intended.
You can definitely use source and destination IP address conditions with ALE_CONNECT_REDIRECT and ALE_BIND_REDIRECT, just remember that these layers are for redirecting not blocking.