STATUS_FWP_OUT_OF_BOUNDS (0XC0220028) Fix: Firewall Rule Integer Error

Cause 1: Corrupt Firewall Rule from a Third-Party VPN or Antivirus

This error shows up most often after you install or uninstall a VPN client (like NordVPN, ExpressVPN, or Windscribe) or a third-party antivirus with a firewall module (Avast, McAfee, Bitdefender). What's happening is the installer creates a Windows Filtering Platform (WFP) rule with an integer value — like a port number, a priority, or a weight — that's outside the allowed range. The range depends on the rule type. For example, a FWPM_LAYER_INBOUND_TRANSPORT_V4 rule might expect a weight between 0 and 10, but the software sets it to 99. Windows then throws 0xC0220028 when it tries to apply that rule.

The real fix is to find and remove the bad rule. You don't need to reinstall anything.

How to Fix It

1. Open an elevated Command Prompt — right-click Start, choose Windows Terminal (Admin) or Command Prompt (Admin).
2. Dump all active WFP filters to a text file:
   netsh wfp show filters > C:\wfp_filters.txt
   This creates a massive file. Don't panic — we'll search it.
3. Search for the error in the Security event log — open Event Viewer, go to Windows Logs > Security. Look for Event ID 5447 (WFP filter change) or 5152 (blocked connection) with the error code 0xC0220028. Note the Filter ID or Provider ID shown in the event details.
4. Open the dumped file and find that Filter ID:
   notepad C:\wfp_filters.txt
   Then press Ctrl+F and type the Filter ID from the event. The surrounding lines tell you the app that created the rule — look for a company name, a driver name like avast! Firewall or windscribe.
5. Remove the bad rule using PowerShell:
   Run this in an elevated PowerShell window, replacing 12345 with the Filter ID:
   Remove-NetFirewallFilter -FilterId 12345
   If the cmdlet doesn't exist on your system (it's only in Windows 10 1809+), use:
   netsh wfp delete filters filterId=12345

I've seen this work on Windows 10 22H2 and Windows 11 23H2. The key is matching the Filter ID from the log. If the event log doesn't show a Filter ID — and sometimes it doesn't — skip to cause 2.

Cause 2: Kernel-Mode Driver Conflict with WFP Callout Drivers

Sometimes the integer out-of-bounds comes from a WFP callout driver — a kernel driver that registers itself with WFP to inspect or modify network traffic. Common culprits are old third-party firewall drivers that weren't properly uninstalled. When the driver registers a callout with a layer ID or sublayer weight outside the spec, you get 0xC0220028 whenever any app tries to use that layer.

You'll know it's this cause if the error occurs at system boot, not just when a specific app runs. Also check for Event ID 5440 (WFP callout registered) with the same error code in the log.

How to Fix It

1. Open Device Manager — press Win+X, select Device Manager.
2. Show hidden devices — click View > Show hidden devices.
3. Expand 'Network adapters' and also 'Non-Plug and Play Drivers' — look for entries with names like avast! Firewall Driver, Symantec AntiVirus, Kaspersky, McAfee, or generic ones starting with wfp or fw.
4. Right-click each suspicious driver and choose Uninstall device. Confirm the prompt. Reboot.

Why this works: Windows removes the driver's registration from WFP on reboot. The bad callout is gone, so no more integer out-of-bounds. I prefer this over registry editing because it's safer and you can see exactly what you're deleting.

Cause 3: Corrupted WFP State Store (Less Common but Happens)

If neither of the above works, the WFP internal state may be corrupted — the in-memory database that tracks all rules and callouts. This can happen after a failed Windows Update, a disk write error when the firewall was being modified, or even a sudden power loss. The state store contains integer metadata for each rule, and one or more values are simply wrong.

This is harder to diagnose because the event log won't point to a specific filter. You'll see the error attached to random system processes like svchost.exe or lsass.exe.

How to Fix It

1. Reset WFP to its default state:
   Open elevated Command Prompt and run:
   netsh wfp reset
   This clears all WFP filters and callouts. It also disables Windows Firewall — you'll need to re-enable it after.
2. Re-enable Windows Firewall:
   netsh advfirewall set allprofiles state on
3. Reboot.

What's actually happening: netsh wfp reset flushes the WFP store and reinitializes it with the default system policy. It's like a factory reset for the firewall. The downside is you lose any custom firewall rules you manually created (port openings, app blocks). You'll need to recreate those. But it beats reinstalling Windows.

If netsh wfp reset doesn't exist on your system (older Windows 10 builds before 1607), use netsh advfirewall reset instead — it's less aggressive but still clears many rules.

Quick-Reference Summary Table

Start with cause 1 — it's the most common by far. If you don't see a Filter ID in the event log, skip to cause 2. Only try cause 3 if you're sure the first two didn't help, because it nukes your custom rules.