STATUS_FWP_INVALID_NET_MASK (0XC022001F) - Fix Invalid Network Mask Error

1. Typo in a firewall rule (most common)

I know this error is infuriating. It pops up when you're trying to set up a firewall rule or VPN and suddenly everything breaks. The most common cause? A simple typo in the network mask. You might have typed 255.255.255.0 instead of 255.255.255.0 (see, even I just did that — it's easy).

This error often shows when you're using Windows Defender Firewall with Advanced Security or a third-party firewall like Norton or McAfee. It can also happen if you're editing rules via Group Policy or a script.

How to fix it:

1. Open Windows Defender Firewall with Advanced Security (press Win + R, type wf.msc, hit Enter).
2. Go to Inbound Rules or Outbound Rules — whichever rule you were editing.
3. Look for a rule you recently created or modified. Right-click it and choose Properties.
4. Go to the Scope tab. Under Remote IP address or Local IP address, check the network mask.
5. The mask should be a valid subnet mask. Common ones:

Fix it: If you see something like 255.255.255.256 or 255.255.0 (missing octet), correct it. Save the rule and apply. The error should disappear.

Example scenario: You're setting up a VPN split tunnel and you wrote 192.168.1.0/255.255.255.0 but accidentally typed 255.255.255.256 — that's the trigger.

Pro tip: Always use CIDR notation (like 192.168.1.0/24) in modern Windows. It's less error-prone.

2. Corrupted or misconfigured Windows Filtering Platform (WFP)

Sometimes the error isn't your fault. The Windows Filtering Platform (WFP) — the system that manages firewall rules — can get confused. This happens after a Windows update (especially on Windows 10 22H2 or Windows 11 23H2) or after installing a VPN client that messes with the network stack.

How to fix it:

1. Reset the Windows Firewall — but this is a nuclear option. It deletes all custom rules.
2. Open Command Prompt as Administrator (right-click Start > Windows Terminal (Admin)).
3. Run this command:

   netsh advfirewall reset

4. Restart your PC. The error might be gone, but you'll need to re-add any custom firewall rules.

Alternative: Repair WFP without losing rules:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

Run both commands. Then restart. This fixes corrupted system files.

If still broken: Check the Windows Firewall service is running. Open Services (services.msc), find Windows Defender Firewall, make sure it's set to Automatic and started.

Real-world trigger: I've seen this error after installing a VPN client like NordVPN or ExpressVPN that adds its own filter driver. Uninstall the VPN, reset firewall, reinstall VPN — that order works.

3. Invalid mask in a third-party security software rule

Antivirus or firewall software (like Norton, McAfee, Avast, or even some corporate agents like McAfee ENS) also uses Windows Filtering Platform. They can create rules with bad masks too — but you won't see them in the Windows Firewall interface.

How to fix it:

1. Open your third-party security software.
2. Look for Firewall, Network Protection, or Application Control settings.
3. Find any custom rules you added — especially rules that specify IP ranges or network masks.
4. Check the mask format. Most software expects CIDR (like /24) or a dotted decimal mask. If you used a mask like 255.255.255.0 but the software required 255.255.255.0 (no, literally the same — but sometimes the software has a bug with certain masks), try changing it.

Quick test: Disable the third-party firewall temporarily. If the error disappears, you know the culprit. Then check or recreate the rule.

Example scenario: You're using McAfee Endpoint Security and created a rule to block traffic to 10.0.0.0/255.0.0.0 — but McAfee's parser might misread it. Try 10.0.0.0/8 instead.

If you're using nano or advanced users: You can also check the WFP store via command line to see all rules, but that's overkill for most people. Skip it unless you're desperate.

Quick-reference summary table