Fix STATUS_FWP_INVALID_WEIGHT (0XC0220025) - Reset WFP

Quick answer

Run netsh winsock reset and netsh int ip reset in an elevated command prompt, then restart. That clears the invalid filter weight in most cases. If that fails, you'll need to reset the Windows Filtering Platform base filtering engine.

Why this happens

Windows Firewall and other network security tools rely on something called the Windows Filtering Platform (WFP). Every rule you add—whether it's from a third-party antivirus, a VPN client, or even Windows itself—gets a weight value. That weight tells the system how to prioritize rules when multiple ones match the same traffic. If a program writes a weight that's out of the allowed range, or corrupts an existing rule, you get this error. I've seen it most often after a failed antivirus uninstall or a botched VPN driver update. Last month, a client's machine started throwing this after they force-closed a firewall management tool mid-save. The rule was half-written, and the weight field was garbage.

This error usually pops up when you try to start a service that depends on WFP, like BFE (Base Filtering Engine) or MpsSvc (Windows Firewall). You'll see it in Event Viewer as a service failure, or directly in a command line when you run net start. It's not a hardware issue, and it's not a virus. It's just a corrupted filter rule that needs to be flushed.

Fix steps

Open an elevated command prompt. Press Win, type cmd, right-click Command Prompt, and select Run as administrator.
Reset Winsock and TCP/IP stack. Type these commands one at a time, pressing Enter after each:
```
netsh winsock reset
netsh int ip reset
```
This reinitializes the network stack and clears most filter-related corruption. It won't remove your firewall rules, just the internal state.
Restart your computer. This is required. The reset won't fully take effect until the system reloads the network stack.
Check if the error is gone. After reboot, try starting the service that was failing. For example:
```
net start bfe
```
If it starts without error, you're done.

If the main fix doesn't work

Sometimes the corruption is deeper. Here's what else you can try.

Reset the Windows Firewall rules

This is more aggressive—it will delete all custom firewall rules you've created manually. But it's often the only way to clear a bad weight. Run this in an elevated command prompt:

netsh advfirewall reset

Then restart. This resets all firewall policies back to defaults. If you had custom port openings or app rules, you'll need to recreate them. I once had to do this for a client whose third-party VPN had left a dozen orphaned rules with invalid weights.

Delete the specific bad rule

If you know which rule is causing the issue, you can delete it directly. Open PowerShell as admin and list all filters:

Get-NetFirewallFilter | Where-Object { $_.Status -eq 'Invalid' }

That's not a real cmdlet—you won't find it. The honest way is to export your firewall rules, delete them all, and re-import the ones you need. But that's overkill for most people. Try the reset first.

Use System Restore

If you have a restore point from before the error started, roll back. That's the fastest way to undo whatever wrote the bad rule. I've seen this error happen after a Windows Update that partially failed, and a restore fixed it cleanly.

Prevention tip

The main culprit is usually third-party security software that doesn't uninstall cleanly. When you remove an antivirus or firewall tool, use the vendor's dedicated removal tool, not just the built-in uninstaller. Also, avoid force-closing any program that modifies firewall rules. If you're updating a VPN or firewall, let it finish. I know it's tempting to close that stuck dialog, but that's how you get half-written rules and this exact error.

Another tip: keep a backup of your firewall rules. You can export them before major changes with:

netsh advfirewall export "C:\firewall-backup.wfw"

If things go sideways, you can import it back with netsh advfirewall import. It's saved me more than once.