STATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER (0XC022002D) Fix

Quick answer for pros

Run netsh wfp show filters in an admin command prompt, find the filter with action type 0 (callout) on a sublayer that only allows action type 1 (block) or 2 (permit), then delete it with the matching netsh wfp delete filter command. Or just reset the whole firewall with netsh advfirewall reset if you don't care about custom rules.

What this error actually means

You're seeing STATUS_FWP_ACTION_INCOMPATIBLE_WITH_SUBLAYER (0XC022002D) when Windows Firewall or the Windows Filtering Platform (WFP) tries to apply a rule but the rule's action — like block, permit, or callout — doesn't match what the sublayer expects. Think of a sublayer like a rulebook that only allows certain actions. If your rule says "callout" (action type 0) but the sublayer only supports "block" (action type 1) or "permit" (action type 2), you get this error.

I've seen this most often after installing or updating a VPN client (like NordVPN, ExpressVPN, or Cisco AnyConnect) that adds its own filters, or after a Windows 10 feature update (e.g., 22H2) that breaks existing third-party firewall rules. Antivirus programs with built-in firewalls — looking at you, Norton and McAfee — are also common culprits. The error usually pops up when trying to connect to a VPN or when launching a network-intensive app, and it might crash the app or leave you offline.

Fix steps

1. Open an elevated command prompt. Press Windows key, type cmd, right-click Command Prompt, select Run as administrator. Click Yes on the UAC prompt.
2. List all WFP filters. Type netsh wfp show filters and press Enter. Wait 10–30 seconds — it generates a lot of output. After it finishes, you'll see a file path like C:\Users\YourName\AppData\Local\Temp\wfpstate.xml. That's your filter list.
3. Open the XML file. Open that file in Notepad or any text editor. Press Ctrl+F and search for 0XC022002D or incompatible. You might not find the exact error code in the file, but you're looking for filters where the sublayer's allowed actions don't match the filter's action. Look for a sublayer with allowedActions showing only FWP_ACTION_BLOCK and FWP_ACTION_PERMIT, but the filter under it has action set to FWP_ACTION_CALLOUT. That's the mismatch.
4. Note the filter ID. Inside the XML, each filter has a filterId attribute. Write that number down. Example: filterId="123456".
5. Delete the bad filter. Back in the command prompt, type netsh wfp delete filter id=123456 (replace 123456 with your actual ID). Press Enter. You should see Deleted 1 filter. If you get an error, make sure you're running as administrator.
6. Check if the error is gone. Try connecting to your VPN or launching the app that was failing. If it works, you're done. If not, there might be more bad filters — repeat steps 2–5 for each one you find.

Alternative fixes if the main steps don't work

Reset the Windows Firewall

If you have too many bad filters to delete one by one, or you can't find the right one, nuke it all. In an admin command prompt, run netsh advfirewall reset. This removes every custom firewall rule — your VPN's rules, your antivirus's rules, everything. After the reset, you'll have a clean, default firewall. Then reinstall your VPN or security software to let it recreate its rules from scratch.

Uninstall the offending software

If the error started after you installed something specific, uninstall it. Go to Settings > Apps > Apps & features, find the program (like your VPN or antivirus), click Uninstall, and follow the prompts. Reboot. Check if the error returns. If it doesn't, reinstall a newer version of the software or contact their support about the sublayer mismatch.

Use System Restore

If you have a restore point from before the error started, roll back. Type rstrui in the Start menu, open System Restore, choose a point from before the problem, and follow the wizard. This reverts system files and registry, including WFP filters, to an earlier state.

Prevention tip

Stop letting VPN and antivirus apps mess with your firewall without checking compatibility. When you install these programs, they often inject their own WFP filters, and if they don't match the sublayer, boom — error. Before installing, check the software's release notes for Windows 10/11 version support. Also, keep a backup of your firewall rules with netsh advfirewall export "C:\backup\firewall.wfw" after you get everything working. If something breaks later, you can restore with netsh advfirewall import "C:\backup\firewall.wfw".