Fix FWP_E_KM_CLIENTS_ONLY (0x80320015) on Windows

This Windows Firewall error means a user-mode app tried a kernel-mode-only call. The quick fix: disable the Windows Filtering Platform (WFP) connection or switch to an admin-authorized tool.

Quick answer (for advanced users)

Run netsh wfp show state to find the blocking WFP rule, then delete it with netsh wfp delete or modify the app's executable to run as admin. If that doesn't work, disable the Windows Filtering Platform for that connection using Group Policy (gpedit.msc) or a registry tweak under HKLM\SYSTEM\CurrentControlSet\Services\WFP.

Why you're seeing this error

This error hits when a user-mode application — think a VPN client, a firewall tool, or even a game with anti-cheat — tries to make a call that the Windows Filtering Platform (WFP) restricts to kernel-mode drivers only. I first ran into it with an old Cisco VPN client on Windows 10 1809; the app tried to register a callout filter directly, and WFP slammed the door. The exact message is: "The call is allowed for kernel-mode callers only." That's WFP's way of saying your app doesn't have the right permissions to touch the network stack at that level. It's not a "broken" network — it's a security guard telling a civilian to stay out of the armory.

Step-by-step fix

Identify the blocking rule
Open an elevated Command Prompt (right-click, Run as administrator). Run:
```
netsh wfp show state
```
This dumps all active WFP filters. Look for any filter with a name matching your app or a generic description like "Block kernel-mode callers." Note the filter ID (a GUID) and the sublayer key.
Delete the offending filter
If you found a specific filter, remove it with:
```
netsh wfp delete filter <filter-id>
```
Replace <filter-id> with the actual GUID. If you're not sure, you can delete the entire dynamic store (risky — will reset all WFP rules):
```
netsh wfp delete dynamic
```
Reboot. If the error persists, move to step 3.
Run the app as an administrator
Right-click the app's .exe, go to Properties > Compatibility, check "Run this program as an administrator." This elevates the app's token, which sometimes bypasses the kernel-mode restriction. Won't work for all apps (some are hard-coded to fail), but it's a 30-second try.
Disable WFP for the app (Group Policy method)
For domain-joined machines or Windows Pro/Enterprise: open gpedit.msc, navigate to Computer Configuration > Administrative Templates > Network > Windows Filtering Platform. Find "Prohibit the Windows Filtering Platform from being used for this connection" — set it to Enabled. This stops WFP from filtering that connection entirely. Apply and reboot.
Registry tweak as a fallback
If no Group Policy or the above fails, go to HKLM\SYSTEM\CurrentControlSet\Services\WFP. Create a DWORD (32-bit) named EnableFiltering and set it to 0. This disables WFP system-wide — big security trade-off (you lose firewall protection, IPsec, etc.). Only do this for testing. Reboot to apply.

Alternative fixes if the main one fails

Update or replace the app — Many apps (especially VPNs like Shrew Soft, older OpenVPN versions) got patched after 2019 to use kernel-mode drivers properly. Check the vendor's site for a version that supports Windows 10/11 WFP changes.
Use a different network stack — Try a different firewall or VPN client that uses the Windows built-in WFP correctly (like WireGuard or the native Windows VPN).
Boot into Safe Mode with Networking — This loads minimal WFP drivers. If the app works in Safe Mode, the problem is a third-party filter (like from McAfee or Symantec). Uninstall that filter driver.

Prevention tip

If you’re a developer or IT admin, always check that your app uses FwpsCalloutRegister from a kernel-mode driver, not a user-mode call like FWPM_CALLOUT_FLAG_USES_PROVIDER_CONTEXT. For users: stick to apps signed by Microsoft or well-known vendors, and avoid old VPN clients from 2017 and earlier — they're the #1 trigger for this error on Windows 10 20H2 and up.