STATUS_FWP_KM_CLIENTS_ONLY (0xC0220015): Kernel-Mode Firewall Call Fix

Quick answer: Reboot, then run netsh winsock reset and netsh int ip reset from an admin command prompt. If that doesn't work, find and reinstall the firewall or VPN driver causing the issue.

What's actually happening here

This error code, STATUS_FWP_KM_CLIENTS_ONLY (0xC0220015), pops up when a user-mode application tries to make a call that's only allowed for kernel-mode drivers in the Windows Filtering Platform (WFP). Think of WFP as the core firewall engine under Windows. It's designed to let drivers do deep packet inspection, but regular apps can't touch certain functions.

I see this most often with VPN clients — especially older versions of OpenVPN, Cisco AnyConnect, or WireGuard — or third-party firewalls like ZoneAlarm or Comodo. The driver installs, but the user-mode service tries to call a kernel-only function and gets slapped down. Happened last month with a client running NordVPN on Windows 10 22H2 — every 20 minutes the network would drop and this error would flood the event log.

Fix steps (start here)

1. Reboot. Not joking. A clean restart clears any half-loaded filter drivers. Do this first, test.
2. Reset Winsock and IP stack. Open Command Prompt as admin, run:

   netsh winsock reset
   netsh int ip reset
   ipconfig /flushdns

   Reboot again.
3. Identify the culprit. Check Event Viewer under Applications and Services Logs > Microsoft > Windows > WFP. Look for events with error 0xC0220015. The 'ProcessId' or 'ApplicationName' field tells you which program triggered it. For example, I saw C:\Program Files\OpenVPN\bin\openvpn.exe logged.
4. Reinstall the offending driver. Uninstall the VPN or firewall software completely using Revo Uninstaller (their built-in uninstaller often leaves filter drivers behind). Reboot, then install the latest version from the vendor's site.
5. Remove leftover filter drivers manually. In an admin command prompt:

   sc query type= driver | findstr /i "filter"

   Look for anything named like vpnfilter or fwdrv. Stop and delete them:

   sc stop [drivername]
   sc delete [drivername]

   Be careful — don't delete Microsoft's built-in filter drivers (WFPLwfs, WFPv6, etc.).

If the main fix doesn't work

Sometimes the driver is stubborn. Try these:

• System Restore to a point before the error appeared. This saved me when a Comodo update broke a client's VPN.
• Safe Mode with Networking — boot into it, see if the error still occurs. If not, a non-Microsoft filter driver is definitely the issue.
• Disable all non-Microsoft services via msconfig (selective startup). If the error stops, turn services back on one by one until it breaks again.
• Update network drivers from your motherboard or laptop manufacturer's site — not Windows Update. Realtek and Intel NIC drivers sometimes conflict with WFP filters.

Preventing this long-term

Once you've fixed it, lock it down:

• Never install beta VPN or firewall drivers on a production machine. Had a client install a beta WireGuard driver — broke everything.
• Keep your VPN client updated. Vendors fix these kernel-mode call issues in later releases.
• If you use a third-party firewall, make sure it's certified for your Windows version. Old ZoneAlarm versions on Windows 11 are a disaster.
• Consider using the built-in Windows Firewall — it rarely causes this error because it uses proper kernel-mode APIs from the start.

Real talk: Most of the time, this error is a bad driver update. The user installed a VPN, it worked for a week, then an update broke the filter driver. A clean uninstall-reinstall of the VPN software fixes 90% of cases. The other 10%? You're hunting driver leftovers in the registry and system32\drivers. Use Autoruns from Sysinternals to spot them.

If you're still stuck after all this, the problem might be a corrupt system file. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth from an admin prompt. That's the nuclear option, but I've seen it work when a Windows update hosed the WFP stack.