Merge branch 'win-restructure-fw-rules'

47 files changed, 1274 insertions, 716 deletions

diff --git a/docs/architecture.md b/docs/architecture.md
index f87c18fb33..1325eb6f3d 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -4,6 +4,10 @@ This document describes the code architecture and how everything fits together.
 
 For security and anonymity properties, please see [security](security.md).
 
+Some components have specific documentation that go into greater detail:
+
+- [winfw](../windows/winfw/README.md)
+
 ## Mullvad vs talpid
 
 Explain the differences between these layers and why the distinction exists.
diff --git a/windows/winfw/README.md b/windows/winfw/README.md
new file mode 100644
index 0000000000..6c4f456bed
--- /dev/null
+++ b/windows/winfw/README.md
@@ -0,0 +1,33 @@
+# Introduction
+
+`winfw` implements a number of policies for configuring the Windows Filtering Platform (WFP).
+
+# Organization of sublayers
+
+`winfw` uses a design that involves two different types of sublayers:
+
+- The baseline sublayer
+- Other sublayers
+
+## Baseline sublayer
+
+The baseline sublayer is weighted the highest to ensure it sees all traffic first. It contains a large number of permit-filters, with a different subset of them being activated by different policies. The permit-filters are all weighted the same and have the highest possible weight. It doesn't matter which filter sees the traffic first. If traffic is matched by a permit-filter, it's "lifted" out of the sublayer and processing is resumed with the next sublayer.
+
+The baseline sublayer also contains a set of blocking filters that match all traffic. These filters are weighted the lowest within the sublayer. A blocking verdict is final and any traffic matched will be dropped.
+
+The idea is that the primary sublayer (baseline sublayer) shapes the traffic to be more predictable for filters in subsequent sublayers.
+
+## Other sublayers
+
+Beyond the baseline sublayer, there's also the "other" type of sublayer. These sublayers are all weighted the same and slightly lower than the baseline sublayer. These sublayers focus on a specific type of traffic.
+
+Same as the baseline sublayer, these sublayers use a design with highly weighted permit-filters and lower weighted blocking filters.
+
+As an example, we have a sublayer that's dedicated to filtering DNS. Traffic that's not related to DNS will still be sent through it, but all the filters we install must deal only with DNS. This way we can install permit-filters with specific conditions that effectively whitelist the traffic we deem safe. To round it off there's a lower-weighted blocking filter that blocks all DNS.
+
+## Advantages of current design
+
+- Predictable sublayer weights.
+- Predictable filter weights.
+- Short and exact filter condition definitions.
+- Removes the need to express logical "and" for same-type conditions, something which is not possible in WFP.
diff --git a/windows/winfw/src/winfw/fwcontext.cpp b/windows/winfw/src/winfw/fwcontext.cpp
index 609f097336..c5c4646082 100644
--- a/windows/winfw/src/winfw/fwcontext.cpp
+++ b/windows/winfw/src/winfw/fwcontext.cpp
@@ -2,34 +2,40 @@
 #include "fwcontext.h"
 #include "mullvadobjects.h"
 #include "objectpurger.h"
-#include "rules/blockall.h"
 #include "rules/ifirewallrule.h"
-#include "rules/permitdhcp.h"
-#include "rules/permitndp.h"
-#include "rules/permitdhcpserver.h"
-#include "rules/permitlan.h"
-#include "rules/permitlanservice.h"
-#include "rules/permitloopback.h"
-#include "rules/permitvpnrelay.h"
-#include "rules/permitvpntunnel.h"
-#include "rules/permitvpntunnelservice.h"
-#include "rules/permitping.h"
-#include "rules/restrictdns.h"
+#include "rules/ports.h"
+#include "rules/baseline/blockall.h"
+#include "rules/baseline/permitdhcp.h"
+#include "rules/baseline/permitndp.h"
+#include "rules/baseline/permitdhcpserver.h"
+#include "rules/baseline/permitlan.h"
+#include "rules/baseline/permitlanservice.h"
+#include "rules/baseline/permitloopback.h"
+#include "rules/baseline/permitvpnrelay.h"
+#include "rules/baseline/permitvpntunnel.h"
+#include "rules/baseline/permitvpntunnelservice.h"
+#include "rules/baseline/permitping.h"
+#include "rules/baseline/permitdns.h"
+#include "rules/dns/blockall.h"
+#include "rules/dns/permitnontunnel.h"
+#include "rules/dns/permittunnel.h"
 #include <libwfp/transaction.h>
 #include <libwfp/filterengine.h>
 #include <libcommon/error.h>
 #include <functional>
 #include <utility>
 
+using namespace rules;
+
 namespace
 {
 
-rules::PermitVpnRelay::Protocol TranslateProtocol(WinFwProtocol protocol)
+baseline::PermitVpnRelay::Protocol TranslateProtocol(WinFwProtocol protocol)
 {
 	switch (protocol)
 	{
-		case Tcp: return rules::PermitVpnRelay::Protocol::Tcp;
-		case Udp: return rules::PermitVpnRelay::Protocol::Udp;
+		case Tcp: return baseline::PermitVpnRelay::Protocol::Tcp;
+		case Udp: return baseline::PermitVpnRelay::Protocol::Udp;
 		default:
 		{
 			THROW_ERROR("Missing case handler in switch clause");
@@ -37,27 +43,73 @@ rules::PermitVpnRelay::Protocol TranslateProtocol(WinFwProtocol protocol)
 	};
 }
 
-void AppendSettingsRules(FwContext::Ruleset &ruleset, const WinFwSettings &settings)
+//
+// Since the PermitLan rule doesn't specifically address DNS, it will allow DNS requests targetting
+// a local resolver to leave the machine. From the local resolver the request will either be
+// resolved from cache, or forwarded out onto the Internet.
+//
+// Therefore, whenever the PermitLan rule might be activated, we must also do proper DNS management
+// to prevent leaks.
+//
+void AppendSettingsRules
+(
+	FwContext::Ruleset &ruleset,
+	const WinFwSettings &settings,
+	std::optional<std::wstring> tunnelInterfaceAlias = std::nullopt,
+	std::optional<std::vector<wfp::IpAddress> > nonTunnelDnsServers = std::nullopt,
+	std::optional<std::vector<wfp::IpAddress> > tunnelDnsServers = std::nullopt
+)
 {
 	if (settings.permitDhcp)
 	{
-		ruleset.emplace_back(std::make_unique<rules::PermitDhcp>());
-		ruleset.emplace_back(std::make_unique<rules::PermitNdp>());
+		ruleset.emplace_back(std::make_unique<baseline::PermitDhcp>());
+		ruleset.emplace_back(std::make_unique<baseline::PermitNdp>());
 	}
 
 	if (settings.permitLan)
 	{
-		ruleset.emplace_back(std::make_unique<rules::PermitLan>());
-		ruleset.emplace_back(std::make_unique<rules::PermitLanService>());
-		ruleset.emplace_back(rules::PermitDhcpServer::WithExtent(rules::PermitDhcpServer::Extent::IPv4Only));
+		ruleset.emplace_back(std::make_unique<baseline::PermitLan>());
+		ruleset.emplace_back(std::make_unique<baseline::PermitLanService>());
+		ruleset.emplace_back(baseline::PermitDhcpServer::WithExtent(baseline::PermitDhcpServer::Extent::IPv4Only));
+	}
+
+	//
+	// DNS management
+	//
+
+	ruleset.emplace_back(std::make_unique<baseline::PermitDns>());
+	ruleset.emplace_back(std::make_unique<dns::BlockAll>());
+
+	if (nonTunnelDnsServers.has_value())
+	{
+		ruleset.emplace_back(std::make_unique<dns::PermitNonTunnel>(
+			tunnelInterfaceAlias, nonTunnelDnsServers.value()));
+	}
+
+	if (tunnelInterfaceAlias.has_value() && tunnelDnsServers.has_value())
+	{
+		ruleset.emplace_back(std::make_unique<dns::PermitTunnel>(
+			tunnelInterfaceAlias.value(), tunnelDnsServers.value()));
 	}
 }
 
-void AppendNetBlockedRules(FwContext::Ruleset &ruleset, const std::optional<WinFwRelay> &relay, const std::optional<rules::RestrictDns::DnsHosts> &dnsHosts)
+void AppendNetBlockedRules(FwContext::Ruleset &ruleset)
 {
-	ruleset.emplace_back(std::make_unique<rules::BlockAll>());
-	ruleset.emplace_back(std::make_unique<rules::PermitLoopback>());
-	ruleset.emplace_back(std::make_unique<rules::RestrictDns>(relay, dnsHosts));
+	ruleset.emplace_back(std::make_unique<baseline::BlockAll>());
+	ruleset.emplace_back(std::make_unique<baseline::PermitLoopback>());
+}
+
+std::optional<std::vector<wfp::IpAddress> >
+CreateRelayDnsExclusion(const WinFwRelay &relay)
+{
+	if (relay.port != DNS_SERVER_PORT)
+	{
+		return std::nullopt;
+	}
+
+	std::vector<wfp::IpAddress> result = { wfp::IpAddress(relay.ip) };
+
+	return std::move(result);
 }
 
 } // anonymous namespace
@@ -109,10 +161,10 @@ bool FwContext::applyPolicyConnecting
 {
 	Ruleset ruleset;
 
-	AppendNetBlockedRules(ruleset, relay, std::nullopt);
-	AppendSettingsRules(ruleset, settings);
+	AppendNetBlockedRules(ruleset);
+	AppendSettingsRules(ruleset, settings, std::nullopt, CreateRelayDnsExclusion(relay));
 
-	ruleset.emplace_back(std::make_unique<rules::PermitVpnRelay>(
+	ruleset.emplace_back(std::make_unique<baseline::PermitVpnRelay>(
 		wfp::IpAddress(relay.ip),
 		relay.port,
 		TranslateProtocol(relay.protocol)
@@ -127,7 +179,7 @@ bool FwContext::applyPolicyConnecting
 
 		for (const auto &host : ph.hosts)
 		{
-			ruleset.emplace_back(std::make_unique<rules::PermitPing>(
+			ruleset.emplace_back(std::make_unique<baseline::PermitPing>(
 				ph.tunnelInterfaceAlias,
 				host
 			));
@@ -142,32 +194,33 @@ bool FwContext::applyPolicyConnected
 	const WinFwSettings &settings,
 	const WinFwRelay &relay,
 	const std::wstring &tunnelInterfaceAlias,
-	const wfp::IpAddress &v4DnsHost,
-	const std::optional<wfp::IpAddress> &v6DnsHost
+	const std::vector<wfp::IpAddress> &tunnelDnsServers
 )
 {
 	Ruleset ruleset;
 
-	rules::RestrictDns::DnsHosts dnsHosts =
-	{
-		tunnelInterfaceAlias,
-		v4DnsHost,
-		v6DnsHost
-	};
-	AppendNetBlockedRules(ruleset, relay, dnsHosts);
-	AppendSettingsRules(ruleset, settings);
+	AppendNetBlockedRules(ruleset);
+
+	AppendSettingsRules
+	(
+		ruleset,
+		settings,
+		std::make_optional<>(tunnelInterfaceAlias),
+		CreateRelayDnsExclusion(relay),
+		std::make_optional<>(tunnelDnsServers)
+	);
 
-	ruleset.emplace_back(std::make_unique<rules::PermitVpnRelay>(
+	ruleset.emplace_back(std::make_unique<baseline::PermitVpnRelay>(
 		wfp::IpAddress(relay.ip),
 		relay.port,
 		TranslateProtocol(relay.protocol)
 	));
 
-	ruleset.emplace_back(std::make_unique<rules::PermitVpnTunnel>(
+	ruleset.emplace_back(std::make_unique<baseline::PermitVpnTunnel>(
 		tunnelInterfaceAlias
 	));
 
-	ruleset.emplace_back(std::make_unique<rules::PermitVpnTunnelService>(
+	ruleset.emplace_back(std::make_unique<baseline::PermitVpnTunnelService>(
 		tunnelInterfaceAlias
 	));
 
@@ -191,7 +244,7 @@ FwContext::Ruleset FwContext::composePolicyBlocked(const WinFwSettings &settings
 {
 	Ruleset ruleset;
 
-	AppendNetBlockedRules(ruleset, std::nullopt, std::nullopt);
+	AppendNetBlockedRules(ruleset);
 	AppendSettingsRules(ruleset, settings);
 
 	return ruleset;
@@ -237,8 +290,8 @@ bool FwContext::applyCommonBaseConfiguration(SessionController &controller, wfp:
 	// Install structural objects
 	//
 	return controller.addProvider(*MullvadObjects::Provider())
-		&& controller.addSublayer(*MullvadObjects::SublayerWhitelist())
-		&& controller.addSublayer(*MullvadObjects::SublayerBlacklist());
+		&& controller.addSublayer(*MullvadObjects::SublayerBaseline())
+		&& controller.addSublayer(*MullvadObjects::SublayerDns());
 }
 
 bool FwContext::applyRuleset(const Ruleset &ruleset)
diff --git a/windows/winfw/src/winfw/fwcontext.h b/windows/winfw/src/winfw/fwcontext.h
index 552b075869..6e2bc590e4 100644
--- a/windows/winfw/src/winfw/fwcontext.h
+++ b/windows/winfw/src/winfw/fwcontext.h
@@ -36,9 +36,9 @@ public:
 		const WinFwSettings &settings,
 		const WinFwRelay &relay,
 		const std::wstring &tunnelInterfaceAlias,
-		const wfp::IpAddress &v4DnsHost,
-		const std::optional<wfp::IpAddress> &v6DnsHost
+		const std::vector<wfp::IpAddress> &tunnelDnsServers
 	);
+
 	bool applyPolicyBlocked(const WinFwSettings &settings);
 
 	bool reset();
diff --git a/windows/winfw/src/winfw/mullvadguids.cpp b/windows/winfw/src/winfw/mullvadguids.cpp
index e73fac26ed..06edc3182e 100644
--- a/windows/winfw/src/winfw/mullvadguids.cpp
+++ b/windows/winfw/src/winfw/mullvadguids.cpp
@@ -4,9 +4,85 @@
 #include <iterator>
 
 //static
-WfpObjectRegistry MullvadGuids::BuildRegistry()
+MullvadGuids::DetailedIdentityRegistry MullvadGuids::DeprecatedIdentities()
 {
-	const auto detailedRegistry = DetailedRegistry();
+	//
+	// Collect GUIDs here that were in use in previous versions of the app.
+	//
+	// Otherwise upgrades will fail because the upgraded daemon will fail to
+	// remove sublayers etc because they contain filters that the updated code
+	// doesn't know about.
+	//
+
+	std::multimap<WfpObjectType, GUID> registry;
+
+	static const GUID sublayer_whitelist =
+	{
+		0x11d1a31a,
+		0xd7fa,
+		0x469b,
+		{ 0xbc, 0x21, 0xcc, 0xe9, 0x2e, 0x35, 0xfe, 0x90 }
+	};
+
+	registry.insert(std::make_pair(WfpObjectType::Sublayer, sublayer_whitelist));
+
+	static const GUID sublayer_blacklist =
+	{
+		0x843b74f0,
+		0xb499,
+		0x499a,
+		{ 0xac, 0xe3, 0xf9, 0xee, 0xa2, 0x4, 0x89, 0xc1 }
+	};
+
+	registry.insert(std::make_pair(WfpObjectType::Sublayer, sublayer_blacklist));
+
+	static const GUID filter_restrictdns_outbound_ipv4 =
+	{
+		0xc0792b44,
+		0xfc3c,
+		0x42e8,
+		{ 0xa6, 0x60, 0x25, 0x4b, 0xd0, 0x4, 0xb1, 0x9d }
+	};
+
+	registry.insert(std::make_pair(WfpObjectType::Filter, filter_restrictdns_outbound_ipv4));
+
+	static const GUID filter_restrictdns_outbound_tunnel_ipv4 =
+	{
+		0x790445dc,
+		0xb23e,
+		0x4ab4,
+		{ 0x8e, 0x2f, 0xc7, 0x6, 0x55, 0x5f, 0x94, 0xff }
+	};
+
+	registry.insert(std::make_pair(WfpObjectType::Filter, filter_restrictdns_outbound_tunnel_ipv4));
+
+	static const GUID filter_restrictdns_outbound_ipv6 =
+	{
+		0xcde477eb,
+		0x2d8a,
+		0x45b8,
+		{ 0x9a, 0x3e, 0x9a, 0xa3, 0xbe, 0x4d, 0xe2, 0xb4 }
+	};
+
+	registry.insert(std::make_pair(WfpObjectType::Filter, filter_restrictdns_outbound_ipv6));
+
+	static const GUID filter_restrictdns_outbound_tunnel_ipv6 =
+	{
+		0xacc90d87,
+		0xab77,
+		0x4cf4,
+		{ 0x84, 0xee, 0x1d, 0x68, 0x95, 0xf0, 0x66, 0xc2 }
+	};
+
+	registry.insert(std::make_pair(WfpObjectType::Filter, filter_restrictdns_outbound_tunnel_ipv6));
+
+	return registry;
+}
+
+//static
+MullvadGuids::IdentityRegistry MullvadGuids::Registry(IdentityQualifier qualifier)
+{
+	const auto detailedRegistry = DetailedRegistry(qualifier);
 	using ValueType = decltype(detailedRegistry)::const_reference;
 
 	std::unordered_set<GUID> registry;
@@ -20,62 +96,57 @@ WfpObjectRegistry MullvadGuids::BuildRegistry()
 }
 
 //static
-DetailedWfpObjectRegistry MullvadGuids::BuildDetailedRegistry()
+MullvadGuids::DetailedIdentityRegistry MullvadGuids::DetailedRegistry(IdentityQualifier qualifier)
 {
 	std::multimap<WfpObjectType, GUID> registry;
 
-	registry.insert(std::make_pair(WfpObjectType::Provider, Provider()));
-	registry.insert(std::make_pair(WfpObjectType::Sublayer, SublayerWhitelist()));
-	registry.insert(std::make_pair(WfpObjectType::Sublayer, SublayerBlacklist()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterBlockAll_Outbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterBlockAll_Inbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterBlockAll_Outbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterBlockAll_Inbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLan_Outbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLan_Outbound_Multicast_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLan_Outbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLan_Outbound_Multicast_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLanService_Inbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLanService_Inbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLoopback_Outbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLoopback_Inbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLoopback_Outbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitLoopback_Inbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitDhcp_Outbound_Request_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitDhcp_Inbound_Response_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitDhcp_Outbound_Request_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitDhcp_Inbound_Response_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitDhcpServer_Inbound_Request_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitDhcpServer_Outbound_Response_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitVpnRelay()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitVpnTunnel_Outbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitVpnTunnel_Outbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterRestrictDns_Outbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterRestrictDns_Outbound_Tunnel_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterRestrictDns_Outbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterRestrictDns_Outbound_Tunnel_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitVpnTunnelService_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitVpnTunnelService_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitNdp_Outbound_Router_Solicitation()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitNdp_Inbound_Router_Advertisement()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitNdp_Inbound_Redirect()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitPing_Outbound_Icmpv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, FilterPermitPing_Outbound_Icmpv6()));
-
-	return registry;
-}
+	if (IdentityQualifier::IncludeDeprecated == qualifier)
+	{
+		registry = DeprecatedIdentities();
+	}
 
-//static
-const WfpObjectRegistry &MullvadGuids::Registry()
-{
-	static auto registry = BuildRegistry();	// TODO: Thread safety.
-	return registry;
-}
+	registry.insert(std::make_pair(WfpObjectType::Provider, Provider()));
+	registry.insert(std::make_pair(WfpObjectType::Sublayer, SublayerBaseline()));
+	registry.insert(std::make_pair(WfpObjectType::Sublayer, SublayerDns()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_BlockAll_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_BlockAll_Inbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_BlockAll_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_BlockAll_Inbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLan_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLan_Outbound_Multicast_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLan_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLan_Outbound_Multicast_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLanService_Inbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLanService_Inbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLoopback_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLoopback_Inbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLoopback_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitLoopback_Inbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDhcp_Outbound_Request_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDhcp_Inbound_Response_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDhcp_Outbound_Request_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDhcp_Inbound_Response_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDhcpServer_Inbound_Request_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDhcpServer_Outbound_Response_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitVpnRelay()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitVpnTunnel_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitVpnTunnel_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitVpnTunnelService_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitVpnTunnelService_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitNdp_Outbound_Router_Solicitation()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitNdp_Inbound_Router_Advertisement()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitNdp_Inbound_Redirect()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitPing_Outbound_Icmpv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitPing_Outbound_Icmpv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDns_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDns_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_BlockAll_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_BlockAll_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_PermitNonTunnel_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_PermitNonTunnel_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_PermitTunnel_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_PermitTunnel_Outbound_Ipv6()));
 
-//static
-const DetailedWfpObjectRegistry &MullvadGuids::DetailedRegistry()
-{
-	static auto registry = BuildDetailedRegistry();	// TODO: Thread safety.
 	return registry;
 }
 
@@ -94,35 +165,35 @@ const GUID &MullvadGuids::Provider()
 }
 
 //static
-const GUID &MullvadGuids::SublayerWhitelist()
+const GUID &MullvadGuids::SublayerBaseline()
 {
 	static const GUID g =
 	{
-		0x11d1a31a,
-		0xd7fa,
-		0x469b,
-		{ 0xbc, 0x21, 0xcc, 0xe9, 0x2e, 0x35, 0xfe, 0x90 }
+		0xc78056ff,
+		0x2bc1,
+		0x4211,
+		{ 0xaa, 0xdd, 0x7f, 0x35, 0x8d, 0xef, 0x20, 0x2d }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::SublayerBlacklist()
+const GUID &MullvadGuids::SublayerDns()
 {
 	static const GUID g =
 	{
-		0x843b74f0,
-		0xb499,
-		0x499a,
-		{ 0xac, 0xe3, 0xf9, 0xee, 0xa2, 0x4, 0x89, 0xc1 }
+		0x60090787,
+		0xcca1,
+		0x4937,
+		{ 0xaa, 0xce, 0x51, 0x25, 0x6e, 0xf4, 0x81, 0xf3 }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterBlockAll_Outbound_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_BlockAll_Outbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -136,7 +207,7 @@ const GUID &MullvadGuids::FilterBlockAll_Outbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterBlockAll_Inbound_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_BlockAll_Inbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -150,7 +221,7 @@ const GUID &MullvadGuids::FilterBlockAll_Inbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterBlockAll_Outbound_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_BlockAll_Outbound_Ipv6()
 {
 	static const GUID g =
 	{
@@ -164,7 +235,7 @@ const GUID &MullvadGuids::FilterBlockAll_Outbound_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::FilterBlockAll_Inbound_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_BlockAll_Inbound_Ipv6()
 {
 	static const GUID g =
 	{
@@ -179,7 +250,7 @@ const GUID &MullvadGuids::FilterBlockAll_Inbound_Ipv6()
 
 
 //static
-const GUID &MullvadGuids::FilterPermitLan_Outbound_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitLan_Outbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -193,7 +264,7 @@ const GUID &MullvadGuids::FilterPermitLan_Outbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitLan_Outbound_Multicast_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitLan_Outbound_Multicast_Ipv4()
 {
 	static const GUID g =
 	{
@@ -207,7 +278,7 @@ const GUID &MullvadGuids::FilterPermitLan_Outbound_Multicast_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitLan_Outbound_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitLan_Outbound_Ipv6()
 {
 	static const GUID g =
 	{
@@ -221,7 +292,7 @@ const GUID &MullvadGuids::FilterPermitLan_Outbound_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitLan_Outbound_Multicast_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitLan_Outbound_Multicast_Ipv6()
 {
 	static const GUID g =
 	{
@@ -235,7 +306,7 @@ const GUID &MullvadGuids::FilterPermitLan_Outbound_Multicast_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitLanService_Inbound_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitLanService_Inbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -249,7 +320,7 @@ const GUID &MullvadGuids::FilterPermitLanService_Inbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitLanService_Inbound_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitLanService_Inbound_Ipv6()
 {
 	static const GUID g =
 	{
@@ -263,7 +334,7 @@ const GUID &MullvadGuids::FilterPermitLanService_Inbound_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitLoopback_Outbound_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitLoopback_Outbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -277,7 +348,7 @@ const GUID &MullvadGuids::FilterPermitLoopback_Outbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitLoopback_Inbound_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitLoopback_Inbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -291,7 +362,7 @@ const GUID &MullvadGuids::FilterPermitLoopback_Inbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitLoopback_Outbound_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitLoopback_Outbound_Ipv6()
 {
 	static const GUID g =
 	{
@@ -305,7 +376,7 @@ const GUID &MullvadGuids::FilterPermitLoopback_Outbound_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitLoopback_Inbound_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitLoopback_Inbound_Ipv6()
 {
 	static const GUID g =
 	{
@@ -319,7 +390,7 @@ const GUID &MullvadGuids::FilterPermitLoopback_Inbound_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitDhcp_Outbound_Request_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitDhcp_Outbound_Request_Ipv4()
 {
 	static const GUID g =
 	{
@@ -333,7 +404,7 @@ const GUID &MullvadGuids::FilterPermitDhcp_Outbound_Request_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitDhcp_Inbound_Response_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitDhcp_Inbound_Response_Ipv4()
 {
 	static const GUID g =
 	{
@@ -347,7 +418,7 @@ const GUID &MullvadGuids::FilterPermitDhcp_Inbound_Response_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitDhcp_Outbound_Request_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitDhcp_Outbound_Request_Ipv6()
 {
 	static const GUID g =
 	{
@@ -361,7 +432,7 @@ const GUID &MullvadGuids::FilterPermitDhcp_Outbound_Request_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitDhcp_Inbound_Response_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitDhcp_Inbound_Response_Ipv6()
 {
 	static const GUID g =
 	{
@@ -375,7 +446,7 @@ const GUID &MullvadGuids::FilterPermitDhcp_Inbound_Response_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitDhcpServer_Inbound_Request_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitDhcpServer_Inbound_Request_Ipv4()
 {
 	static const GUID g =
 	{
@@ -389,7 +460,7 @@ const GUID &MullvadGuids::FilterPermitDhcpServer_Inbound_Request_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitDhcpServer_Outbound_Response_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitDhcpServer_Outbound_Response_Ipv4()
 {
 	static const GUID g =
 	{
@@ -403,7 +474,7 @@ const GUID &MullvadGuids::FilterPermitDhcpServer_Outbound_Response_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitVpnRelay()
+const GUID &MullvadGuids::Filter_Baseline_PermitVpnRelay()
 {
 	static const GUID g =
 	{
@@ -417,7 +488,7 @@ const GUID &MullvadGuids::FilterPermitVpnRelay()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitVpnTunnel_Outbound_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitVpnTunnel_Outbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -431,7 +502,7 @@ const GUID &MullvadGuids::FilterPermitVpnTunnel_Outbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitVpnTunnel_Outbound_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitVpnTunnel_Outbound_Ipv6()
 {
 	static const GUID g =
 	{
@@ -445,154 +516,210 @@ const GUID &MullvadGuids::FilterPermitVpnTunnel_Outbound_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::FilterRestrictDns_Outbound_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitVpnTunnelService_Ipv4()
 {
 	static const GUID g =
 	{
-		0xc0792b44,
-		0xfc3c,
-		0x42e8,
-		{ 0xa6, 0x60, 0x25, 0x4b, 0xd0, 0x4, 0xb1, 0x9d }
+		0xf11a9ab4,
+		0x3dd6,
+		0x4cd9,
+		{ 0x9d, 0x95, 0xb0, 0x36, 0x22, 0x71, 0x6b, 0x3d }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterRestrictDns_Outbound_Tunnel_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitVpnTunnelService_Ipv6()
 {
 	static const GUID g =
 	{
-		0x790445dc,
-		0xb23e,
-		0x4ab4,
-		{ 0x8e, 0x2f, 0xc7, 0x6, 0x55, 0x5f, 0x94, 0xff }
+		0xe902e448,
+		0x1845,
+		0x42e5,
+		{ 0xad, 0xf3, 0x33, 0xb2, 0x7a, 0xd, 0x5d, 0x38 }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterRestrictDns_Outbound_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitNdp_Outbound_Router_Solicitation()
 {
 	static const GUID g =
 	{
-		0xcde477eb,
-		0x2d8a,
-		0x45b8,
-		{ 0x9a, 0x3e, 0x9a, 0xa3, 0xbe, 0x4d, 0xe2, 0xb4 }
+		0xbc5a85e4,
+		0x5319,
+		0x4224,
+		{ 0x8a, 0x27, 0x53, 0xeb, 0x61, 0xef, 0x3b, 0x1 }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterRestrictDns_Outbound_Tunnel_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitNdp_Inbound_Router_Advertisement()
 {
 	static const GUID g =
 	{
-		0xacc90d87,
-		0xab77,
-		0x4cf4,
-		{ 0x84, 0xee, 0x1d, 0x68, 0x95, 0xf0, 0x66, 0xc2 }
+		0x4d996f1d,
+		0x4915,
+		0x4a6a,
+		{ 0xbd, 0xf5, 0xb5, 0x1a, 0x2d, 0xbc, 0xb8, 0xe9 }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitVpnTunnelService_Ipv4()
+const GUID &MullvadGuids::Filter_Baseline_PermitNdp_Inbound_Redirect()
 {
 	static const GUID g =
 	{
-		0xf11a9ab4,
-		0x3dd6,
-		0x4cd9,
-		{ 0x9d, 0x95, 0xb0, 0x36, 0x22, 0x71, 0x6b, 0x3d }
+		0xcec23a8,
+		0x4fdd,
+		0x4a96,
+		{ 0xae, 0xba, 0x33, 0xd2, 0xa7, 0xf, 0x85, 0x22 }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitVpnTunnelService_Ipv6()
+const GUID &MullvadGuids::Filter_Baseline_PermitPing_Outbound_Icmpv4()
 {
 	static const GUID g =
 	{
-		0xe902e448,
-		0x1845,
-		0x42e5,
-		{ 0xad, 0xf3, 0x33, 0xb2, 0x7a, 0xd, 0x5d, 0x38 }
+		0x2ecf7ff7,
+		0xc951,
+		0x4056,
+		{ 0xb0, 0xf7, 0x40, 0xa4, 0x5c, 0x7e, 0xb4, 0xc2 }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitNdp_Outbound_Router_Solicitation()
+const GUID &MullvadGuids::Filter_Baseline_PermitPing_Outbound_Icmpv6()
 {
 	static const GUID g =
 	{
-		0xbc5a85e4,
-		0x5319,
-		0x4224,
-		{ 0x8a, 0x27, 0x53, 0xeb, 0x61, 0xef, 0x3b, 0x1 }
+		0x3deb8cab,
+		0x1edb,
+		0x4aa1,
+		{ 0xb2, 0x73, 0xec, 0x61, 0x4f, 0x50, 0xdc, 0x13 }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitNdp_Inbound_Router_Advertisement()
+const GUID &MullvadGuids::Filter_Baseline_PermitDns_Outbound_Ipv4()
 {
 	static const GUID g =
 	{
-		0x4d996f1d,
-		0x4915,
-		0x4a6a,
-		{ 0xbd, 0xf5, 0xb5, 0x1a, 0x2d, 0xbc, 0xb8, 0xe9 }
+		0xeb484664,
+		0xa37c,
+		0x41a4,
+		{ 0x95, 0x83, 0xd5, 0xf7, 0x77, 0x38, 0xdc, 0x4f }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitNdp_Inbound_Redirect()
+const GUID &MullvadGuids::Filter_Baseline_PermitDns_Outbound_Ipv6()
 {
 	static const GUID g =
 	{
-		0xcec23a8,
-		0x4fdd,
-		0x4a96,
-		{ 0xae, 0xba, 0x33, 0xd2, 0xa7, 0xf, 0x85, 0x22 }
+		0xab3ca903,
+		0xa637,
+		0x4254,
+		{ 0xb5, 0x45, 0x60, 0xa7, 0xb7, 0xf6, 0x35, 0xb9 }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitPing_Outbound_Icmpv4()
+const GUID &MullvadGuids::Filter_Dns_BlockAll_Outbound_Ipv4()
 {
 	static const GUID g =
 	{
-		0x2ecf7ff7,
-		0xc951,
-		0x4056,
-		{ 0xb0, 0xf7, 0x40, 0xa4, 0x5c, 0x7e, 0xb4, 0xc2 }
+		0x81b26a4f,
+		0xca9c,
+		0x4547,
+		{ 0x90, 0x50, 0x49, 0x25, 0x88, 0xc0, 0xc9, 0xa8 }
 	};
 
 	return g;
 }
 
 //static
-const GUID &MullvadGuids::FilterPermitPing_Outbound_Icmpv6()
+const GUID &MullvadGuids::Filter_Dns_BlockAll_Outbound_Ipv6()
 {
 	static const GUID g =
 	{
-		0x3deb8cab,
-		0x1edb,
-		0x4aa1,
-		{ 0xb2, 0x73, 0xec, 0x61, 0x4f, 0x50, 0xdc, 0x13 }
+		0xa053c210,
+		0x7467,
+		0x4a13,
+		{ 0x90, 0x75, 0xaf, 0x5d, 0xd4, 0xb8, 0x60, 0xb5 }
+	};
+
+	return g;
+}
+
+//static
+const GUID &MullvadGuids::Filter_Dns_PermitNonTunnel_Outbound_Ipv4()
+{
+	static const GUID g =
+	{
+		0x32207aec,
+		0x2938,
+		0x4cc7,
+		{ 0xa9, 0x4f, 0xd5, 0xdc, 0xe5, 0x2a, 0x9b, 0x56 }
+	};
+
+	return g;
+}
+
+//static
+const GUID &MullvadGuids::Filter_Dns_PermitNonTunnel_Outbound_Ipv6()
+{
+	static const GUID g =
+	{
+		0x41f539d4,
+		0xa98e,
+		0x4663,
+		{ 0x90, 0xef, 0x1f, 0x2f, 0x78, 0x4a, 0x41, 0xad }
+	};
+
+	return g;
+}
+
+//static
+const GUID &MullvadGuids::Filter_Dns_PermitTunnel_Outbound_Ipv4()
+{
+	static const GUID g =
+	{
+		0x260fcc99,
+		0x2b95,
+		0x41a7,
+		{ 0xa2, 0x7f, 0xd0, 0x95, 0x7, 0x51, 0x51, 0xaa }
+	};
+
+	return g;
+}
+
+//static
+const GUID &MullvadGuids::Filter_Dns_PermitTunnel_Outbound_Ipv6()
+{
+	static const GUID g =
+	{
+		0x4a919d7f,
+		0x6f2c,
+		0x4bf5,
+		{ 0x8f, 0xdc, 0xfd, 0xd, 0x4a, 0x64, 0x42, 0x9d }
 	};
 
 	return g;
diff --git a/windows/winfw/src/winfw/mullvadguids.h b/windows/winfw/src/winfw/mullvadguids.h
index 3c3ca9702b..8e5970698c 100644
--- a/windows/winfw/src/winfw/mullvadguids.h
+++ b/windows/winfw/src/winfw/mullvadguids.h
@@ -6,68 +6,87 @@
 #include <unordered_set>
 #include <map>
 
-using WfpObjectRegistry = std::unordered_set<GUID>;
-using DetailedWfpObjectRegistry = std::multimap<WfpObjectType, GUID>;
-
 class MullvadGuids
 {
-	static WfpObjectRegistry BuildRegistry();
-	static DetailedWfpObjectRegistry BuildDetailedRegistry();
+public:
+
+	using IdentityRegistry = std::unordered_set<GUID>;
+	using DetailedIdentityRegistry = std::multimap<WfpObjectType, GUID>;
+
+private:
+
+	static DetailedIdentityRegistry DeprecatedIdentities();
 
 public:
 
-	static const WfpObjectRegistry &Registry();
-	static const DetailedWfpObjectRegistry &DetailedRegistry();
+	enum class IdentityQualifier
+	{
+		IncludeDeprecated,
+		OnlyCurrent,
+	};
+
+	static IdentityRegistry Registry(IdentityQualifier qualifier);
+	static DetailedIdentityRegistry DetailedRegistry(IdentityQualifier qualifier);
 
 	MullvadGuids() = delete;
 
 	static const GUID &Provider();
-	static const GUID &SublayerWhitelist();
-	static const GUID &SublayerBlacklist();
+	static const GUID &SublayerBaseline();
+	static const GUID &SublayerDns();
+
+	//
+	// Filter identifiers
+	// Naming convention: Filter_sublayer_rule_filter
+	//
+
+	static const GUID &Filter_Baseline_BlockAll_Outbound_Ipv4();
+	static const GUID &Filter_Baseline_BlockAll_Inbound_Ipv4();
+	static const GUID &Filter_Baseline_BlockAll_Outbound_Ipv6();
+	static const GUID &Filter_Baseline_BlockAll_Inbound_Ipv6();
 
-	static const GUID &FilterBlockAll_Outbound_Ipv4();
-	static const GUID &FilterBlockAll_Inbound_Ipv4();
-	static const GUID &FilterBlockAll_Outbound_Ipv6();
-	static const GUID &FilterBlockAll_Inbound_Ipv6();
+	static const GUID &Filter_Baseline_PermitLan_Outbound_Ipv4();
+	static const GUID &Filter_Baseline_PermitLan_Outbound_Multicast_Ipv4();
+	static const GUID &Filter_Baseline_PermitLan_Outbound_Ipv6();
+	static const GUID &Filter_Baseline_PermitLan_Outbound_Multicast_Ipv6();
 
-	static const GUID &FilterPermitLan_Outbound_Ipv4();
-	static const GUID &FilterPermitLan_Outbound_Multicast_Ipv4();
-	static const GUID &FilterPermitLan_Outbound_Ipv6();
-	static const GUID &FilterPermitLan_Outbound_Multicast_Ipv6();
+	static const GUID &Filter_Baseline_PermitLanService_Inbound_Ipv4();
+	static const GUID &Filter_Baseline_PermitLanService_Inbound_Ipv6();
 
-	static const GUID &FilterPermitLanService_Inbound_Ipv4();
-	static const GUID &FilterPermitLanService_Inbound_Ipv6();
+	static const GUID &Filter_Baseline_PermitLoopback_Outbound_Ipv4();
+	static const GUID &Filter_Baseline_PermitLoopback_Inbound_Ipv4();
+	static const GUID &Filter_Baseline_PermitLoopback_Outbound_Ipv6();
+	static const GUID &Filter_Baseline_PermitLoopback_Inbound_Ipv6();
 
-	static const GUID &FilterPermitLoopback_Outbound_Ipv4();
-	static const GUID &FilterPermitLoopback_Inbound_Ipv4();
-	static const GUID &FilterPermitLoopback_Outbound_Ipv6();
-	static const GUID &FilterPermitLoopback_Inbound_Ipv6();
+	static const GUID &Filter_Baseline_PermitDhcp_Outbound_Request_Ipv4();
+	static const GUID &Filter_Baseline_PermitDhcp_Inbound_Response_Ipv4();
+	static const GUID &Filter_Baseline_PermitDhcp_Outbound_Request_Ipv6();
+	static const GUID &Filter_Baseline_PermitDhcp_Inbound_Response_Ipv6();
 
-	static const GUID &FilterPermitDhcp_Outbound_Request_Ipv4();
-	static const GUID &FilterPermitDhcp_Inbound_Response_Ipv4();
-	static const GUID &FilterPermitDhcp_Outbound_Request_Ipv6();
-	static const GUID &FilterPermitDhcp_Inbound_Response_Ipv6();
+	static const GUID &Filter_Baseline_PermitDhcpServer_Inbound_Request_Ipv4();
+	static const GUID &Filter_Baseline_PermitDhcpServer_Outbound_Response_Ipv4();
 
-	static const GUID &FilterPermitDhcpServer_Inbound_Request_Ipv4();
-	static const GUID &FilterPermitDhcpServer_Outbound_Response_Ipv4();
+	static const GUID &Filter_Baseline_PermitVpnRelay();
 
-	static const GUID &FilterPermitVpnRelay();
+	static const GUID &Filter_Baseline_PermitVpnTunnel_Outbound_Ipv4();
+	static const GUID &Filter_Baseline_PermitVpnTunnel_Outbound_Ipv6();
 
-	static const GUID &FilterPermitVpnTunnel_Outbound_Ipv4();
-	static const GUID &FilterPermitVpnTunnel_Outbound_Ipv6();
+	static const GUID &Filter_Baseline_PermitVpnTunnelService_Ipv4();
+	static const GUID &Filter_Baseline_PermitVpnTunnelService_Ipv6();
 
-	static const GUID &FilterRestrictDns_Outbound_Ipv4();
-	static const GUID &FilterRestrictDns_Outbound_Tunnel_Ipv4();
-	static const GUID &FilterRestrictDns_Outbound_Ipv6();
-	static const GUID &FilterRestrictDns_Outbound_Tunnel_Ipv6();
+	static const GUID &Filter_Baseline_PermitNdp_Outbound_Router_Solicitation();
+	static const GUID &Filter_Baseline_PermitNdp_Inbound_Router_Advertisement();
+	static const GUID &Filter_Baseline_PermitNdp_Inbound_Redirect();
 
-	static const GUID &FilterPermitVpnTunnelService_Ipv4();
-	static const GUID &FilterPermitVpnTunnelService_Ipv6();
+	static const GUID &Filter_Baseline_PermitPing_Outbound_Icmpv4();
+	static const GUID &Filter_Baseline_PermitPing_Outbound_Icmpv6();
 
-	static const GUID &FilterPermitNdp_Outbound_Router_Solicitation();
-	static const GUID &FilterPermitNdp_Inbound_Router_Advertisement();
-	static const GUID &FilterPermitNdp_Inbound_Redirect();
+	static const GUID &Filter_Baseline_PermitDns_Outbound_Ipv4();
+	static const GUID &Filter_Baseline_PermitDns_Outbound_Ipv6();
 
-	static const GUID &FilterPermitPing_Outbound_Icmpv4();
-	static const GUID &FilterPermitPing_Outbound_Icmpv6();
+	static const GUID &Filter_Dns_BlockAll_Outbound_Ipv4();
+	static const GUID &Filter_Dns_BlockAll_Outbound_Ipv6();
+	static const GUID &Filter_Dns_PermitNonTunnel_Outbound_Ipv4();
+	static const GUID &Filter_Dns_PermitNonTunnel_Outbound_Ipv6();
+	static const GUID &Filter_Dns_PermitTunnel_Outbound_Ipv4();
+	static const GUID &Filter_Dns_PermitTunnel_Outbound_Ipv6();
 };
diff --git a/windows/winfw/src/winfw/mullvadobjects.cpp b/windows/winfw/src/winfw/mullvadobjects.cpp
index 43618b51b3..b96f0dd743 100644
--- a/windows/winfw/src/winfw/mullvadobjects.cpp
+++ b/windows/winfw/src/winfw/mullvadobjects.cpp
@@ -16,14 +16,14 @@ std::unique_ptr<wfp::ProviderBuilder> MullvadObjects::Provider()
 }
 
 //static
-std::unique_ptr<wfp::SublayerBuilder> MullvadObjects::SublayerWhitelist()
+std::unique_ptr<wfp::SublayerBuilder> MullvadObjects::SublayerBaseline()
 {
 	auto builder = std::make_unique<wfp::SublayerBuilder>();
 
 	(*builder)
-		.name(L"Mullvad VPN whitelist")
-		.description(L"Filters that permit traffic")
-		.key(MullvadGuids::SublayerWhitelist())
+		.name(L"Mullvad VPN baseline")
+		.description(L"Filters that enforce a good baseline")
+		.key(MullvadGuids::SublayerBaseline())
 		.provider(MullvadGuids::Provider())
 		.weight(MAXUINT16);
 
@@ -31,14 +31,14 @@ std::unique_ptr<wfp::SublayerBuilder> MullvadObjects::SublayerWhitelist()
 }
 
 //static
-std::unique_ptr<wfp::SublayerBuilder> MullvadObjects::SublayerBlacklist()
+std::unique_ptr<wfp::SublayerBuilder> MullvadObjects::SublayerDns()
 {
 	auto builder = std::make_unique<wfp::SublayerBuilder>();
 
 	(*builder)
-		.name(L"Mullvad VPN blacklist")
-		.description(L"Filters that block traffic")
-		.key(MullvadGuids::SublayerBlacklist())
+		.name(L"Mullvad VPN DNS")
+		.description(L"Filters that restrict DNS traffic")
+		.key(MullvadGuids::SublayerDns())
 		.provider(MullvadGuids::Provider())
 		.weight(MAXUINT16 - 1);
 
diff --git a/windows/winfw/src/winfw/mullvadobjects.h b/windows/winfw/src/winfw/mullvadobjects.h
index 9a056c9186..a1183c9018 100644
--- a/windows/winfw/src/winfw/mullvadobjects.h
+++ b/windows/winfw/src/winfw/mullvadobjects.h
@@ -13,6 +13,6 @@ public:
 	MullvadObjects() = delete;
 
 	static std::unique_ptr<wfp::ProviderBuilder> Provider();
-	static std::unique_ptr<wfp::SublayerBuilder> SublayerWhitelist();
-	static std::unique_ptr<wfp::SublayerBuilder> SublayerBlacklist();
+	static std::unique_ptr<wfp::SublayerBuilder> SublayerBaseline();
+	static std::unique_ptr<wfp::SublayerBuilder> SublayerDns();
 };
diff --git a/windows/winfw/src/winfw/objectpurger.cpp b/windows/winfw/src/winfw/objectpurger.cpp
index 60c32cd53e..1db397566c 100644
--- a/windows/winfw/src/winfw/objectpurger.cpp
+++ b/windows/winfw/src/winfw/objectpurger.cpp
@@ -29,7 +29,7 @@ ObjectPurger::RemovalFunctor ObjectPurger::GetRemoveFiltersFunctor()
 {
 	return [](wfp::FilterEngine &engine)
 	{
-		const auto registry = MullvadGuids::DetailedRegistry();
+		const auto registry = MullvadGuids::DetailedRegistry(MullvadGuids::IdentityQualifier::IncludeDeprecated);
 
 		// Resolve correct overload.
 		void (*deleter)(wfp::FilterEngine &, const GUID &) = wfp::ObjectDeleter::DeleteFilter;
@@ -43,7 +43,7 @@ ObjectPurger::RemovalFunctor ObjectPurger::GetRemoveAllFunctor()
 {
 	return [](wfp::FilterEngine &engine)
 	{
-		const auto registry = MullvadGuids::DetailedRegistry();
+		const auto registry = MullvadGuids::DetailedRegistry(MullvadGuids::IdentityQualifier::IncludeDeprecated);
 
 		// Resolve correct overload.
 		void(*deleter)(wfp::FilterEngine &, const GUID &) = wfp::ObjectDeleter::DeleteFilter;
diff --git a/windows/winfw/src/winfw/rules/blockall.cpp b/windows/winfw/src/winfw/rules/baseline/blockall.cpp
index 7695ece765..ef5c82a0df 100644
--- a/windows/winfw/src/winfw/rules/blockall.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/blockall.cpp
@@ -1,10 +1,10 @@
 #include "stdafx.h"
 #include "blockall.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/nullconditionbuilder.h"
+#include <winfw/mullvadguids.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/nullconditionbuilder.h>
 
-namespace rules
+namespace rules::baseline
 {
 
 bool BlockAll::apply(IObjectInstaller &objectInstaller)
@@ -12,16 +12,16 @@ bool BlockAll::apply(IObjectInstaller &objectInstaller)
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 block outbound connections, ipv4
+	// #1 Block outbound connections, IPv4.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterBlockAll_Outbound_Ipv4())
+		.key(MullvadGuids::Filter_Baseline_BlockAll_Outbound_Ipv4())
 		.name(L"Block all outbound connections (IPv4)")
 		.description(L"This filter is part of a rule that restricts inbound and outbound traffic")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Min)
 		.block();
 
@@ -33,11 +33,11 @@ bool BlockAll::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #2 block inbound connections, ipv4
+	// #2 Block inbound connections, IPv4.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterBlockAll_Inbound_Ipv4())
+		.key(MullvadGuids::Filter_Baseline_BlockAll_Inbound_Ipv4())
 		.name(L"Block all inbound connections (IPv4)")
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4);
 
@@ -47,11 +47,11 @@ bool BlockAll::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #3 block outbound connections, ipv6
+	// #3 Block outbound connections, IPv6.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterBlockAll_Outbound_Ipv6())
+		.key(MullvadGuids::Filter_Baseline_BlockAll_Outbound_Ipv6())
 		.name(L"Block all outbound connections (IPv6)")
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
 
@@ -61,11 +61,11 @@ bool BlockAll::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #4 block inbound connections, ipv6
+	// #4 Block inbound connections, IPv6.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterBlockAll_Inbound_Ipv6())
+		.key(MullvadGuids::Filter_Baseline_BlockAll_Inbound_Ipv6())
 		.name(L"Block all inbound connections (IPv6)")
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6);
 
diff --git a/windows/winfw/src/winfw/rules/blockall.h b/windows/winfw/src/winfw/rules/baseline/blockall.h
index c60c43fa1d..23d5a0b1d2 100644
--- a/windows/winfw/src/winfw/rules/blockall.h
+++ b/windows/winfw/src/winfw/rules/baseline/blockall.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 
-namespace rules
+namespace rules::baseline
 {
 
 class BlockAll : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/permitdhcp.cpp b/windows/winfw/src/winfw/rules/baseline/permitdhcp.cpp
index d2d7292746..4d142a6305 100644
--- a/windows/winfw/src/winfw/rules/permitdhcp.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitdhcp.cpp
@@ -1,29 +1,20 @@
 #include "stdafx.h"
 #include "permitdhcp.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/ipaddress.h"
-#include "libwfp/ipnetwork.h"
-#include "libwfp/conditions/conditionprotocol.h"
-#include "libwfp/conditions/conditionport.h"
-#include "libwfp/conditions/conditionip.h"
+#include <winfw/mullvadguids.h>
+#include <winfw/rules/ports.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/ipaddress.h>
+#include <libwfp/ipnetwork.h>
+#include <libwfp/conditions/conditionprotocol.h>
+#include <libwfp/conditions/conditionport.h>
+#include <libwfp/conditions/conditionip.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
-namespace
-{
-
-static const uint32_t DHCPV4_CLIENT_PORT = 68;
-static const uint32_t DHCPV4_SERVER_PORT = 67;
-static const uint32_t DHCPV6_CLIENT_PORT = 546;
-static const uint32_t DHCPV6_SERVER_PORT = 547;
-
-} // anonymous namespace
-
 bool PermitDhcp::apply(IObjectInstaller &objectInstaller)
 {
 	return applyIpv4(objectInstaller) && applyIpv6(objectInstaller);
@@ -41,16 +32,16 @@ bool PermitDhcp::applyIpv4(IObjectInstaller &objectInstaller) const
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 permit outbound DHCPv4 request
+	// #1 Permit outbound DHCPv4 requests.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitDhcp_Outbound_Request_Ipv4())
-		.name(L"Permit outbound DHCP request (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitDhcp_Outbound_Request_Ipv4())
+		.name(L"Permit outbound DHCP requests (IPv4)")
 		.description(L"This filter is part of a rule that permits DHCP client traffic")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
@@ -69,12 +60,12 @@ bool PermitDhcp::applyIpv4(IObjectInstaller &objectInstaller) const
 	}
 
 	//
-	// #2 permit inbound DHCPv4 response
+	// #2 Permit inbound DHCPv4 responses.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitDhcp_Inbound_Response_Ipv4())
-		.name(L"Permit inbound DHCP response (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitDhcp_Inbound_Response_Ipv4())
+		.name(L"Permit inbound DHCP responses (IPv4)")
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4);
 
 	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4);
@@ -93,12 +84,12 @@ bool PermitDhcp::applyIpv6(IObjectInstaller &objectInstaller) const
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 permit outbound DHCPv6 request
+	// #1 Permit outbound DHCPv6 requests.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitDhcp_Outbound_Request_Ipv6())
-		.name(L"Permit outbound DHCP request (IPv6)")
+		.key(MullvadGuids::Filter_Baseline_PermitDhcp_Outbound_Request_Ipv6())
+		.name(L"Permit outbound DHCP requests (IPv6)")
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
 
 	{
@@ -121,12 +112,12 @@ bool PermitDhcp::applyIpv6(IObjectInstaller &objectInstaller) const
 	}
 
 	//
-	// #2 permit inbound DHCPv6 response
+	// #2 Permit inbound DHCPv6 responses.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitDhcp_Inbound_Response_Ipv6())
-		.name(L"Permit inbound DHCP response (IPv6)")
+		.key(MullvadGuids::Filter_Baseline_PermitDhcp_Inbound_Response_Ipv6())
+		.name(L"Permit inbound DHCP responses (IPv6)")
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6);
 
 	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6);
diff --git a/windows/winfw/src/winfw/rules/permitdhcp.h b/windows/winfw/src/winfw/rules/baseline/permitdhcp.h
index 5500829c0c..0e635bc184 100644
--- a/windows/winfw/src/winfw/rules/permitdhcp.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitdhcp.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitDhcp : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/permitdhcpserver.cpp b/windows/winfw/src/winfw/rules/baseline/permitdhcpserver.cpp
index 2c765ecdea..a8fb2e3036 100644
--- a/windows/winfw/src/winfw/rules/permitdhcpserver.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitdhcpserver.cpp
@@ -1,27 +1,20 @@
 #include "stdafx.h"
 #include "permitdhcpserver.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/ipaddress.h"
-#include "libwfp/conditions/conditionprotocol.h"
-#include "libwfp/conditions/conditionport.h"
-#include "libwfp/conditions/conditionip.h"
+#include <winfw/mullvadguids.h>
+#include <winfw/rules/ports.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/ipaddress.h>
+#include <libwfp/conditions/conditionprotocol.h>
+#include <libwfp/conditions/conditionport.h>
+#include <libwfp/conditions/conditionip.h>
 #include <libcommon/error.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
-namespace
-{
-
-static const uint32_t DHCPV4_CLIENT_PORT = 68;
-static const uint32_t DHCPV4_SERVER_PORT = 67;
-
-} // anonymous namespace
-
 //static
 std::unique_ptr<PermitDhcpServer> PermitDhcpServer::WithExtent(Extent extent)
 {
@@ -41,18 +34,18 @@ bool PermitDhcpServer::apply(IObjectInstaller &objectInstaller)
 bool PermitDhcpServer::applyIpv4(IObjectInstaller &objectInstaller) const
 {
 	//
-	// #1 permit incoming DHCPv4 request
+	// #1 Permit inbound DHCPv4 requests.
 	//
 
 	wfp::FilterBuilder filterBuilder;
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitDhcpServer_Inbound_Request_Ipv4())
-		.name(L"Permit inbound DHCP request (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitDhcpServer_Inbound_Request_Ipv4())
+		.name(L"Permit inbound DHCP requests (IPv4)")
 		.description(L"This filter is part of a rule that permits DHCP server traffic")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
@@ -71,12 +64,12 @@ bool PermitDhcpServer::applyIpv4(IObjectInstaller &objectInstaller) const
 	}
 
 	//
-	// #2 permit outbound DHCPv4 response
+	// #2 Permit outbound DHCPv4 responses.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitDhcpServer_Outbound_Response_Ipv4())
-		.name(L"Permit outbound DHCP response (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitDhcpServer_Outbound_Response_Ipv4())
+		.name(L"Permit outbound DHCP responses (IPv4)")
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
 
 	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
diff --git a/windows/winfw/src/winfw/rules/permitdhcpserver.h b/windows/winfw/src/winfw/rules/baseline/permitdhcpserver.h
index 93879b21a7..14ccfcd9f7 100644
--- a/windows/winfw/src/winfw/rules/permitdhcpserver.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitdhcpserver.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 #include <memory>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitDhcpServer : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/baseline/permitdns.cpp b/windows/winfw/src/winfw/rules/baseline/permitdns.cpp
new file mode 100644
index 0000000000..8ce530edaa
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/baseline/permitdns.cpp
@@ -0,0 +1,56 @@
+#include "stdafx.h"
+#include "permitdns.h"
+#include <winfw/mullvadguids.h>
+#include <winfw/rules/ports.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/conditions/conditionport.h>
+
+using namespace wfp::conditions;
+
+namespace rules::baseline
+{
+
+bool PermitDns::apply(IObjectInstaller &objectInstaller)
+{
+	wfp::FilterBuilder filterBuilder;
+
+	//
+	// #1 Permit outbound DNS, IPv4.
+	//
+
+	filterBuilder
+		.key(MullvadGuids::Filter_Baseline_PermitDns_Outbound_Ipv4())
+		.name(L"Permit outbound connections to DNS server (IPv4)")
+		.description(L"This filter is part of a rule that permits outbound DNS")
+		.provider(MullvadGuids::Provider())
+		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
+		.sublayer(MullvadGuids::SublayerBaseline())
+		.weight(wfp::FilterBuilder::WeightClass::Max)
+		.permit();
+
+	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
+
+	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
+
+	if (false == objectInstaller.addFilter(filterBuilder, conditionBuilder))
+	{
+		return false;
+	}
+
+	//
+	// #2 Permit outbound DNS, IPv6.
+	//
+
+	filterBuilder
+		.key(MullvadGuids::Filter_Baseline_PermitDns_Outbound_Ipv6())
+		.name(L"Permit outbound connections to DNS server (IPv6)")
+		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
+
+	conditionBuilder.reset(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
+	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
+
+	return objectInstaller.addFilter(filterBuilder, conditionBuilder);
+}
+
+}
diff --git a/windows/winfw/src/winfw/rules/baseline/permitdns.h b/windows/winfw/src/winfw/rules/baseline/permitdns.h
new file mode 100644
index 0000000000..039102f70e
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/baseline/permitdns.h
@@ -0,0 +1,18 @@
+#pragma once
+
+#include <winfw/rules/ifirewallrule.h>
+
+namespace rules::baseline
+{
+
+class PermitDns : public IFirewallRule
+{
+public:
+
+	PermitDns() = default;
+	~PermitDns() = default;
+
+	bool apply(IObjectInstaller& objectInstaller) override;
+};
+
+}
diff --git a/windows/winfw/src/winfw/rules/permitlan.cpp b/windows/winfw/src/winfw/rules/baseline/permitlan.cpp
index e973bf29d8..b9a24cf038 100644
--- a/windows/winfw/src/winfw/rules/permitlan.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitlan.cpp
@@ -1,15 +1,15 @@
 #include "stdafx.h"
 #include "permitlan.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/ipaddress.h"
-#include "libwfp/ipnetwork.h"
-#include "libwfp/conditions/conditionip.h"
+#include <winfw/mullvadguids.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/ipaddress.h>
+#include <libwfp/ipnetwork.h>
+#include <libwfp/conditions/conditionip.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
 bool PermitLan::apply(IObjectInstaller &objectInstaller)
@@ -22,16 +22,16 @@ bool PermitLan::applyIpv4(IObjectInstaller &objectInstaller) const
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 locally-initiated traffic
+	// #1 Permit outbound connections on LAN.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLan_Outbound_Ipv4())
-		.name(L"Permit outbound LAN traffic (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitLan_Outbound_Ipv4())
+		.name(L"Permit outbound connections on LAN (IPv4)")
 		.description(L"This filter is part of a rule that permits LAN traffic")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
@@ -48,12 +48,12 @@ bool PermitLan::applyIpv4(IObjectInstaller &objectInstaller) const
 	}
 
 	//
-	// #2 LAN to multicast
+	// #2 Permit outbound multicast on LAN.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLan_Outbound_Multicast_Ipv4())
-		.name(L"Permit outbound LAN multicast traffic (IPv4)");
+		.key(MullvadGuids::Filter_Baseline_PermitLan_Outbound_Multicast_Ipv4())
+		.name(L"Permit outbound multicast on LAN (IPv4)");
 
 	conditionBuilder.reset();
 
@@ -74,16 +74,16 @@ bool PermitLan::applyIpv6(IObjectInstaller &objectInstaller) const
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 locally-initiated traffic
+	// #1 Permit outbound connections on LAN.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLan_Outbound_Ipv6())
-		.name(L"Permit outbound LAN traffic (IPv6)")
+		.key(MullvadGuids::Filter_Baseline_PermitLan_Outbound_Ipv6())
+		.name(L"Permit outbound connections on LAN (IPv6)")
 		.description(L"This filter is part of a rule that permits LAN traffic")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
@@ -99,12 +99,12 @@ bool PermitLan::applyIpv6(IObjectInstaller &objectInstaller) const
 	}
 
 	//
-	// #2 LAN to multicast
+	// #2 Permit outbound multicast on LAN.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLan_Outbound_Multicast_Ipv6())
-		.name(L"Permit outbound LAN multicast traffic (IPv6)");
+		.key(MullvadGuids::Filter_Baseline_PermitLan_Outbound_Multicast_Ipv6())
+		.name(L"Permit outbound multicast on LAN (IPv6)");
 
 	conditionBuilder.reset();
 
diff --git a/windows/winfw/src/winfw/rules/permitlan.h b/windows/winfw/src/winfw/rules/baseline/permitlan.h
index 7eb52a4956..e37814c6f6 100644
--- a/windows/winfw/src/winfw/rules/permitlan.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitlan.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitLan : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/permitlanservice.cpp b/windows/winfw/src/winfw/rules/baseline/permitlanservice.cpp
index 516aa3fcd7..7534e08462 100644
--- a/windows/winfw/src/winfw/rules/permitlanservice.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitlanservice.cpp
@@ -1,15 +1,15 @@
 #include "stdafx.h"
 #include "permitlanservice.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/ipaddress.h"
-#include "libwfp/ipnetwork.h"
-#include "libwfp/conditions/conditionip.h"
+#include <winfw/mullvadguids.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/ipaddress.h>
+#include <libwfp/ipnetwork.h>
+#include <libwfp/conditions/conditionip.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
 bool PermitLanService::apply(IObjectInstaller &objectInstaller)
@@ -22,16 +22,16 @@ bool PermitLanService::applyIpv4(IObjectInstaller &objectInstaller) const
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 incoming request
+	// #1 Permit inbound connections on LAN.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLanService_Inbound_Ipv4())
-		.name(L"Permit inbound LAN traffic (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitLanService_Inbound_Ipv4())
+		.name(L"Permit inbound connections on LAN (IPv4)")
 		.description(L"This filter is part of a rule that permits hosting services in a LAN environment")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
@@ -50,16 +50,16 @@ bool PermitLanService::applyIpv6(IObjectInstaller &objectInstaller) const
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 incoming request
+	// #1 Permit inbound connections on LAN.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLanService_Inbound_Ipv6())
-		.name(L"Permit inbound LAN traffic (IPv6)")
+		.key(MullvadGuids::Filter_Baseline_PermitLanService_Inbound_Ipv6())
+		.name(L"Permit inbound connections on LAN (IPv6)")
 		.description(L"This filter is part of a rule that permits hosting services in a LAN environment")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
diff --git a/windows/winfw/src/winfw/rules/permitlanservice.h b/windows/winfw/src/winfw/rules/baseline/permitlanservice.h
index a99a71a25b..800ed83d4b 100644
--- a/windows/winfw/src/winfw/rules/permitlanservice.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitlanservice.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitLanService : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/permitloopback.cpp b/windows/winfw/src/winfw/rules/baseline/permitloopback.cpp
index 99ee977b86..123bed4b42 100644
--- a/windows/winfw/src/winfw/rules/permitloopback.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitloopback.cpp
@@ -1,13 +1,13 @@
 #include "stdafx.h"
 #include "permitloopback.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/conditions/conditionloopback.h"
+#include <winfw/mullvadguids.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/conditions/conditionloopback.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
 bool PermitLoopback::apply(IObjectInstaller &objectInstaller)
@@ -15,16 +15,16 @@ bool PermitLoopback::apply(IObjectInstaller &objectInstaller)
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 permit outbound connections, ipv4
+	// #1 Permit outbound connections, IPv4.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLoopback_Outbound_Ipv4())
-		.name(L"Permit outbound on loopback (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitLoopback_Outbound_Ipv4())
+		.name(L"Permit outbound connections on loopback (IPv4)")
 		.description(L"This filter is part of a rule that permits all loopback traffic")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
@@ -40,12 +40,12 @@ bool PermitLoopback::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #2 permit inbound connections, ipv4
+	// #2 Permit inbound connections, IPv4.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLoopback_Inbound_Ipv4())
-		.name(L"Permit inbound on loopback (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitLoopback_Inbound_Ipv4())
+		.name(L"Permit inbound connections on loopback (IPv4)")
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4);
 
 	{
@@ -60,12 +60,12 @@ bool PermitLoopback::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #3 permit outbound connections, ipv6
+	// #3 Permit outbound connections, IPv6.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLoopback_Outbound_Ipv6())
-		.name(L"Permit outbound on loopback (IPv6)")
+		.key(MullvadGuids::Filter_Baseline_PermitLoopback_Outbound_Ipv6())
+		.name(L"Permit outbound connections on loopback (IPv6)")
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
 
 	{
@@ -80,12 +80,12 @@ bool PermitLoopback::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #4 permit inbound connections, ipv6
+	// #4 Permit inbound connections, IPv6.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitLoopback_Inbound_Ipv6())
-		.name(L"Permit inbound on loopback (IPv6)")
+		.key(MullvadGuids::Filter_Baseline_PermitLoopback_Inbound_Ipv6())
+		.name(L"Permit inbound connections on loopback (IPv6)")
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6);
 
 	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6);
diff --git a/windows/winfw/src/winfw/rules/permitloopback.h b/windows/winfw/src/winfw/rules/baseline/permitloopback.h
index 71694c353d..4fb2eace2f 100644
--- a/windows/winfw/src/winfw/rules/permitloopback.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitloopback.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitLoopback : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/permitndp.cpp b/windows/winfw/src/winfw/rules/baseline/permitndp.cpp
index 2aca5d0d1b..52e6ec4693 100644
--- a/windows/winfw/src/winfw/rules/permitndp.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitndp.cpp
@@ -1,17 +1,17 @@
 #include "stdafx.h"
 #include "permitndp.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/ipaddress.h"
-#include "libwfp/ipnetwork.h"
-#include "libwfp/conditions/conditionprotocol.h"
-#include "libwfp/conditions/conditionicmp.h"
-#include "libwfp/conditions/conditionip.h"
+#include <winfw/mullvadguids.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/ipaddress.h>
+#include <libwfp/ipnetwork.h>
+#include <libwfp/conditions/conditionprotocol.h>
+#include <libwfp/conditions/conditionicmp.h>
+#include <libwfp/conditions/conditionip.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
 bool PermitNdp::apply(IObjectInstaller &objectInstaller)
@@ -22,11 +22,11 @@ bool PermitNdp::apply(IObjectInstaller &objectInstaller)
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 permit outbound router solicitation
+	// #1 Permit outbound router solicitation.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitNdp_Outbound_Router_Solicitation())
+		.key(MullvadGuids::Filter_Baseline_PermitNdp_Outbound_Router_Solicitation())
 		.name(L"Permit outbound NDP router solicitation")
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
 
@@ -45,11 +45,11 @@ bool PermitNdp::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #2 permit inbound router advertisement
+	// #2 Permit inbound router advertisement.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitNdp_Inbound_Router_Advertisement())
+		.key(MullvadGuids::Filter_Baseline_PermitNdp_Inbound_Router_Advertisement())
 		.name(L"Permit inbound NDP router advertisement")
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6);
 
@@ -68,11 +68,11 @@ bool PermitNdp::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #3 permit inbound redirect message
+	// #3 Permit inbound redirect message.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitNdp_Inbound_Redirect())
+		.key(MullvadGuids::Filter_Baseline_PermitNdp_Inbound_Redirect())
 		.name(L"Permit inbound NDP redirect")
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6);
 
diff --git a/windows/winfw/src/winfw/rules/permitndp.h b/windows/winfw/src/winfw/rules/baseline/permitndp.h
index ebd53b62c2..fbe1c66862 100644
--- a/windows/winfw/src/winfw/rules/permitndp.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitndp.h
@@ -1,8 +1,8 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitNdp : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/permitping.cpp b/windows/winfw/src/winfw/rules/baseline/permitping.cpp
index f6aed36bf2..0fb388a953 100644
--- a/windows/winfw/src/winfw/rules/permitping.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitping.cpp
@@ -1,24 +1,23 @@
 #include "stdafx.h"
 #include "permitping.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/conditions/conditionip.h"
-#include "libwfp/conditions/conditioninterface.h"
-#include "libwfp/conditions/conditionprotocol.h"
-
+#include <winfw/mullvadguids.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/conditions/conditionip.h>
+#include <libwfp/conditions/conditioninterface.h>
+#include <libwfp/conditions/conditionprotocol.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
 PermitPing::PermitPing
 (
-	const std::optional<std::wstring> &interfaceAlias,
+	std::optional<std::wstring> interfaceAlias,
 	const wfp::IpAddress &host
 )
-	: m_interfaceAlias(interfaceAlias)
+	: m_interfaceAlias(std::move(interfaceAlias))
 	, m_host(host)
 {
 }
@@ -38,16 +37,16 @@ bool PermitPing::applyIcmpv4(IObjectInstaller &objectInstaller) const
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 Permit outbound ICMPv4 to %host% on %interface%
+	// #1 Permit outbound ICMPv4 to %host% on %interface%.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitPing_Outbound_Icmpv4())
+		.key(MullvadGuids::Filter_Baseline_PermitPing_Outbound_Icmpv4())
 		.name(L"Permit outbound ICMP to specific host (ICMPv4)")
 		.description(L"This filter is part of a rule that permits ping")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
@@ -69,16 +68,16 @@ bool PermitPing::applyIcmpv6(IObjectInstaller &objectInstaller) const
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 Permit outbound ICMPv6 to %host% on %interface%
+	// #1 Permit outbound ICMPv6 to %host% on %interface%.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitPing_Outbound_Icmpv6())
+		.key(MullvadGuids::Filter_Baseline_PermitPing_Outbound_Icmpv6())
 		.name(L"Permit outbound ICMP to specific host (ICMPv6)")
 		.description(L"This filter is part of a rule that permits ping")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
diff --git a/windows/winfw/src/winfw/rules/permitping.h b/windows/winfw/src/winfw/rules/baseline/permitping.h
index c8238ceaa8..b7747296f7 100644
--- a/windows/winfw/src/winfw/rules/permitping.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitping.h
@@ -1,18 +1,18 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 #include <libwfp/ipaddress.h>
 #include <string>
 #include <optional>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitPing : public IFirewallRule
 {
 public:
 
-	PermitPing(const std::optional<std::wstring> &interfaceAlias, const wfp::IpAddress &host);
+	PermitPing(std::optional<std::wstring> interfaceAlias, const wfp::IpAddress &host);
 
 	bool apply(IObjectInstaller &objectInstaller) override;
 
diff --git a/windows/winfw/src/winfw/rules/permitvpnrelay.cpp b/windows/winfw/src/winfw/rules/baseline/permitvpnrelay.cpp
index 2c59c0ab99..daa21c3e35 100644
--- a/windows/winfw/src/winfw/rules/permitvpnrelay.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitvpnrelay.cpp
@@ -1,16 +1,16 @@
 #include "stdafx.h"
 #include "permitvpnrelay.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/conditions/conditionprotocol.h"
-#include "libwfp/conditions/conditionip.h"
-#include "libwfp/conditions/conditionport.h"
+#include <winfw/mullvadguids.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/conditions/conditionprotocol.h>
+#include <libwfp/conditions/conditionip.h>
+#include <libwfp/conditions/conditionport.h>
 #include <libcommon/error.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
 namespace
@@ -56,16 +56,16 @@ bool PermitVpnRelay::apply(IObjectInstaller &objectInstaller)
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 permit connecting to relay
+	// #1 Permit outbound connections to relay.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitVpnRelay())
+		.key(MullvadGuids::Filter_Baseline_PermitVpnRelay())
 		.name(L"Permit outbound connections to VPN relay")
 		.description(L"This filter is part of a rule that permits communication with a VPN relay")
 		.provider(MullvadGuids::Provider())
 		.layer(LayerFromIp(m_relay))
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
diff --git a/windows/winfw/src/winfw/rules/permitvpnrelay.h b/windows/winfw/src/winfw/rules/baseline/permitvpnrelay.h
index c5ae8b024a..8dd2c630f4 100644
--- a/windows/winfw/src/winfw/rules/permitvpnrelay.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitvpnrelay.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "ifirewallrule.h"
-#include "libwfp/ipaddress.h"
+#include <winfw/rules/ifirewallrule.h>
+#include <libwfp/ipaddress.h>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitVpnRelay : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/permitvpntunnel.cpp b/windows/winfw/src/winfw/rules/baseline/permitvpntunnel.cpp
index e21a99c04d..c09f7b631c 100644
--- a/windows/winfw/src/winfw/rules/permitvpntunnel.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitvpntunnel.cpp
@@ -1,13 +1,13 @@
 #include "stdafx.h"
 #include "permitvpntunnel.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/conditions/conditioninterface.h"
+#include <winfw/mullvadguids.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/conditions/conditioninterface.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
 PermitVpnTunnel::PermitVpnTunnel(const std::wstring &tunnelInterfaceAlias)
@@ -20,16 +20,16 @@ bool PermitVpnTunnel::apply(IObjectInstaller &objectInstaller)
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 permit locally-initiated traffic on tunnel interface, ipv4
+	// #1 Permit outbound connections, IPv4.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitVpnTunnel_Outbound_Ipv4())
-		.name(L"Permit outbound on tunnel interface (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitVpnTunnel_Outbound_Ipv4())
+		.name(L"Permit outbound connections on tunnel interface (IPv4)")
 		.description(L"This filter is part of a rule that permits communications inside the VPN tunnel")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
@@ -45,12 +45,12 @@ bool PermitVpnTunnel::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #2 permit locally-initiated traffic on tunnel interface, ipv6
+	// #2 Permit outbound connections, IPv6.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitVpnTunnel_Outbound_Ipv6())
-		.name(L"Permit outbound on tunnel interface (IPv6)")
+		.key(MullvadGuids::Filter_Baseline_PermitVpnTunnel_Outbound_Ipv6())
+		.name(L"Permit outbound connections on tunnel interface (IPv6)")
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
 
 	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
diff --git a/windows/winfw/src/winfw/rules/permitvpntunnel.h b/windows/winfw/src/winfw/rules/baseline/permitvpntunnel.h
index 49c1b028ab..9c9a7b14c1 100644
--- a/windows/winfw/src/winfw/rules/permitvpntunnel.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitvpntunnel.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 #include <string>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitVpnTunnel : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/permitvpntunnelservice.cpp b/windows/winfw/src/winfw/rules/baseline/permitvpntunnelservice.cpp
index bbdf9a6e2b..d24830db8f 100644
--- a/windows/winfw/src/winfw/rules/permitvpntunnelservice.cpp
+++ b/windows/winfw/src/winfw/rules/baseline/permitvpntunnelservice.cpp
@@ -1,13 +1,13 @@
 #include "stdafx.h"
 #include "permitvpntunnelservice.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/conditions/conditioninterface.h"
+#include <winfw/mullvadguids.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/conditions/conditioninterface.h>
 
 using namespace wfp::conditions;
 
-namespace rules
+namespace rules::baseline
 {
 
 PermitVpnTunnelService::PermitVpnTunnelService(const std::wstring &tunnelInterfaceAlias)
@@ -20,16 +20,16 @@ bool PermitVpnTunnelService::apply(IObjectInstaller &objectInstaller)
 	wfp::FilterBuilder filterBuilder;
 
 	//
-	// #1 incoming request on Ipv4
+	// #1 Permit inbound connections, IPv4.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitVpnTunnelService_Ipv4())
-		.name(L"Permit inbound on tunnel interface (IPv4)")
+		.key(MullvadGuids::Filter_Baseline_PermitVpnTunnelService_Ipv4())
+		.name(L"Permit inbound connections on tunnel interface (IPv4)")
 		.description(L"This filter is part of a rule that permits hosting services that listen on the tunnel interface")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4)
-		.sublayer(MullvadGuids::SublayerWhitelist())
+		.sublayer(MullvadGuids::SublayerBaseline())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
@@ -43,12 +43,12 @@ bool PermitVpnTunnelService::apply(IObjectInstaller &objectInstaller)
 	}
 
 	//
-	// #2 incoming request on IPv6
+	// #2 Permit inbound connections, IPv6.
 	//
 
 	filterBuilder
-		.key(MullvadGuids::FilterPermitVpnTunnelService_Ipv6())
-		.name(L"Permit inbound on tunnel interface (IPv6)")
+		.key(MullvadGuids::Filter_Baseline_PermitVpnTunnelService_Ipv6())
+		.name(L"Permit inbound connections on tunnel interface (IPv6)")
 		.layer(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6);
 
 	conditionBuilder.reset(FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6);
diff --git a/windows/winfw/src/winfw/rules/permitvpntunnelservice.h b/windows/winfw/src/winfw/rules/baseline/permitvpntunnelservice.h
index adec88658b..8880c06328 100644
--- a/windows/winfw/src/winfw/rules/permitvpntunnelservice.h
+++ b/windows/winfw/src/winfw/rules/baseline/permitvpntunnelservice.h
@@ -1,9 +1,9 @@
 #pragma once
 
-#include "ifirewallrule.h"
+#include <winfw/rules/ifirewallrule.h>
 #include <string>
 
-namespace rules
+namespace rules::baseline
 {
 
 class PermitVpnTunnelService : public IFirewallRule
diff --git a/windows/winfw/src/winfw/rules/dns/blockall.cpp b/windows/winfw/src/winfw/rules/dns/blockall.cpp
new file mode 100644
index 0000000000..8324a5fdb2
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/dns/blockall.cpp
@@ -0,0 +1,57 @@
+#include "stdafx.h"
+#include "blockall.h"
+#include <winfw/mullvadguids.h>
+#include <winfw/rules/ports.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/conditions/conditionport.h>
+
+using namespace wfp::conditions;
+
+namespace rules::dns
+{
+
+bool BlockAll::apply(IObjectInstaller &objectInstaller)
+{
+	wfp::FilterBuilder filterBuilder;
+
+	//
+	// #1 Block outbound DNS, IPv4.
+	//
+
+	filterBuilder
+		.key(MullvadGuids::Filter_Dns_BlockAll_Outbound_Ipv4())
+		.name(L"Block outbound DNS (IPv4)")
+		.description(L"This filter is part of a rule that blocks DNS requests")
+		.provider(MullvadGuids::Provider())
+		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
+		.sublayer(MullvadGuids::SublayerDns())
+		.weight(wfp::FilterBuilder::WeightClass::Min)
+		.block();
+
+	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
+
+	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
+
+	if (false == objectInstaller.addFilter(filterBuilder, conditionBuilder))
+	{
+		return false;
+	}
+
+	//
+	// #2 Block outbound DNS, IPv6.
+	//
+
+	filterBuilder
+		.key(MullvadGuids::Filter_Dns_BlockAll_Outbound_Ipv6())
+		.name(L"Block outbound DNS (IPv6)")
+		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
+
+	conditionBuilder.reset(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
+
+	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
+
+	return objectInstaller.addFilter(filterBuilder, conditionBuilder);
+}
+
+}
diff --git a/windows/winfw/src/winfw/rules/dns/blockall.h b/windows/winfw/src/winfw/rules/dns/blockall.h
new file mode 100644
index 0000000000..8ea50077a4
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/dns/blockall.h
@@ -0,0 +1,15 @@
+#pragma once
+
+#include <winfw/rules/ifirewallrule.h>
+
+namespace rules::dns
+{
+
+class BlockAll : public IFirewallRule
+{
+public:
+
+	bool apply(IObjectInstaller &objectInstaller) override;
+};
+
+}
diff --git a/windows/winfw/src/winfw/rules/dns/permitnontunnel.cpp b/windows/winfw/src/winfw/rules/dns/permitnontunnel.cpp
new file mode 100644
index 0000000000..0af09a2d8b
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/dns/permitnontunnel.cpp
@@ -0,0 +1,123 @@
+#include "stdafx.h"
+#include "permitnontunnel.h"
+#include <winfw/mullvadguids.h>
+#include <winfw/rules/ports.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/conditions/conditionport.h>
+#include <libwfp/conditions/conditionip.h>
+#include <libwfp/conditions/conditioninterface.h>
+#include <libcommon/error.h>
+
+using namespace wfp::conditions;
+
+namespace rules::dns
+{
+
+PermitNonTunnel::PermitNonTunnel(std::optional<std::wstring> tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts)
+	: m_tunnelInterfaceAlias(std::move(tunnelInterfaceAlias))
+{
+	if (hosts.empty())
+	{
+		THROW_ERROR("Invalid argument: No hosts specified");
+	}
+
+	for (const auto &host : hosts)
+	{
+		switch (host.type())
+		{
+			case wfp::IpAddress::Type::Ipv4:
+			{
+				m_hostsIpv4.push_back(host);
+				break;
+			}
+			case wfp::IpAddress::Type::Ipv6:
+			{
+				m_hostsIpv6.push_back(host);
+				break;
+			}
+			default:
+			{
+				THROW_ERROR("Missing case handler in switch clause");
+			}
+		}
+	}
+}
+
+bool PermitNonTunnel::apply(IObjectInstaller &objectInstaller)
+{
+	wfp::FilterBuilder filterBuilder;
+
+	//
+	// #1 Permit outbound DNS, IPv4.
+	//
+
+	if (false == m_hostsIpv4.empty())
+	{
+		filterBuilder
+			.key(MullvadGuids::Filter_Dns_PermitNonTunnel_Outbound_Ipv4())
+			.name(L"Permit selected non-tunnel DNS traffic (IPv4)")
+			.description(L"This filter is part of a rule that permits non-tunnel DNS traffic")
+			.provider(MullvadGuids::Provider())
+			.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
+			.sublayer(MullvadGuids::SublayerDns())
+			.weight(wfp::FilterBuilder::WeightClass::Max)
+			.permit();
+
+		wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
+
+		conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
+
+		for (const auto &host : m_hostsIpv4)
+		{
+			conditionBuilder.add_condition(ConditionIp::Remote(host));
+		}
+
+		if (m_tunnelInterfaceAlias.has_value())
+		{
+			conditionBuilder.add_condition(ConditionInterface::Alias(m_tunnelInterfaceAlias.value(), CompareNeq()));
+		}
+
+		if (false == objectInstaller.addFilter(filterBuilder, conditionBuilder))
+		{
+			return false;
+		}
+	}
+
+	if (m_hostsIpv6.empty())
+	{
+		return true;
+	}
+
+	//
+	// #2 Permit outbound DNS, IPv6.
+	//
+
+	filterBuilder
+		.key(MullvadGuids::Filter_Dns_PermitNonTunnel_Outbound_Ipv6())
+		.name(L"Permit selected non-tunnel DNS traffic (IPv6)")
+		.description(L"This filter is part of a rule that permits non-tunnel DNS traffic")
+		.provider(MullvadGuids::Provider())
+		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6)
+		.sublayer(MullvadGuids::SublayerDns())
+		.weight(wfp::FilterBuilder::WeightClass::Max)
+		.permit();
+
+	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
+
+	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
+
+	for (const auto &host : m_hostsIpv6)
+	{
+		conditionBuilder.add_condition(ConditionIp::Remote(host));
+	}
+
+	if (m_tunnelInterfaceAlias.has_value())
+	{
+		conditionBuilder.add_condition(ConditionInterface::Alias(m_tunnelInterfaceAlias.value(), CompareNeq()));
+	}
+
+	return objectInstaller.addFilter(filterBuilder, conditionBuilder);
+}
+
+}
diff --git a/windows/winfw/src/winfw/rules/dns/permitnontunnel.h b/windows/winfw/src/winfw/rules/dns/permitnontunnel.h
new file mode 100644
index 0000000000..07b67245c3
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/dns/permitnontunnel.h
@@ -0,0 +1,31 @@
+#pragma once
+
+#include <winfw/rules/ifirewallrule.h>
+#include <libwfp/ipaddress.h>
+#include <vector>
+#include <optional>
+#include <string>
+
+namespace rules::dns
+{
+
+class PermitNonTunnel : public IFirewallRule
+{
+public:
+
+	//
+	// The alias argument has to be optional for when the relay is connected on port 53.
+	// At this point in time there's no tunnel yet.
+	//
+	PermitNonTunnel(std::optional<std::wstring> tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts);
+	
+	bool apply(IObjectInstaller &objectInstaller) override;
+
+private:
+
+	const std::optional<std::wstring> m_tunnelInterfaceAlias;
+	std::vector<wfp::IpAddress> m_hostsIpv4;
+	std::vector<wfp::IpAddress> m_hostsIpv6;
+};
+
+}
diff --git a/windows/winfw/src/winfw/rules/dns/permittunnel.cpp b/windows/winfw/src/winfw/rules/dns/permittunnel.cpp
new file mode 100644
index 0000000000..64211ef17f
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/dns/permittunnel.cpp
@@ -0,0 +1,115 @@
+#include "stdafx.h"
+#include "permittunnel.h"
+#include <winfw/mullvadguids.h>
+#include <winfw/rules/ports.h>
+#include <libwfp/filterbuilder.h>
+#include <libwfp/conditionbuilder.h>
+#include <libwfp/conditions/conditionport.h>
+#include <libwfp/conditions/conditionip.h>
+#include <libwfp/conditions/conditioninterface.h>
+#include <libcommon/error.h>
+
+using namespace wfp::conditions;
+
+namespace rules::dns
+{
+
+PermitTunnel::PermitTunnel(const std::wstring &tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts)
+	: m_tunnelInterfaceAlias(tunnelInterfaceAlias)
+{
+	if (hosts.empty())
+	{
+		THROW_ERROR("Invalid argument: No hosts specified");
+	}
+
+	for (const auto &host : hosts)
+	{
+		switch (host.type())
+		{
+			case wfp::IpAddress::Type::Ipv4:
+			{
+				m_hostsIpv4.push_back(host);
+				break;
+			}
+			case wfp::IpAddress::Type::Ipv6:
+			{
+				m_hostsIpv6.push_back(host);
+				break;
+			}
+			default:
+			{
+				THROW_ERROR("Missing case handler in switch clause");
+			}
+		}
+	}
+}
+
+bool PermitTunnel::apply(IObjectInstaller &objectInstaller)
+{
+	wfp::FilterBuilder filterBuilder;
+
+	//
+	// #1 Permit outbound DNS, IPv4.
+	//
+
+	if (false == m_hostsIpv4.empty())
+	{
+		filterBuilder
+			.key(MullvadGuids::Filter_Dns_PermitTunnel_Outbound_Ipv4())
+			.name(L"Permit selected DNS traffic inside tunnel (IPv4)")
+			.description(L"This filter is part of a rule that permits DNS traffic inside the VPN tunnel")
+			.provider(MullvadGuids::Provider())
+			.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
+			.sublayer(MullvadGuids::SublayerDns())
+			.weight(wfp::FilterBuilder::WeightClass::Max)
+			.permit();
+
+		wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
+
+		conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
+		conditionBuilder.add_condition(ConditionInterface::Alias(m_tunnelInterfaceAlias));
+
+		for (const auto &host : m_hostsIpv4)
+		{
+			conditionBuilder.add_condition(ConditionIp::Remote(host));
+		}
+
+		if (false == objectInstaller.addFilter(filterBuilder, conditionBuilder))
+		{
+			return false;
+		}
+	}
+
+	if (m_hostsIpv6.empty())
+	{
+		return true;
+	}
+
+	//
+	// #2 Permit outbound DNS, IPv6.
+	//
+
+	filterBuilder
+		.key(MullvadGuids::Filter_Dns_PermitTunnel_Outbound_Ipv6())
+		.name(L"Permit selected DNS traffic inside tunnel (IPv6)")
+		.description(L"This filter is part of a rule that permits DNS traffic inside the VPN tunnel")
+		.provider(MullvadGuids::Provider())
+		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6)
+		.sublayer(MullvadGuids::SublayerDns())
+		.weight(wfp::FilterBuilder::WeightClass::Max)
+		.permit();
+
+	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
+
+	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
+	conditionBuilder.add_condition(ConditionInterface::Alias(m_tunnelInterfaceAlias));
+
+	for (const auto &host : m_hostsIpv6)
+	{
+		conditionBuilder.add_condition(ConditionIp::Remote(host));
+	}
+
+	return objectInstaller.addFilter(filterBuilder, conditionBuilder);
+}
+
+}
diff --git a/windows/winfw/src/winfw/rules/dns/permittunnel.h b/windows/winfw/src/winfw/rules/dns/permittunnel.h
new file mode 100644
index 0000000000..067a8a9607
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/dns/permittunnel.h
@@ -0,0 +1,26 @@
+#pragma once
+
+#include <winfw/rules/ifirewallrule.h>
+#include <libwfp/ipaddress.h>
+#include <vector>
+#include <string>
+
+namespace rules::dns
+{
+
+class PermitTunnel : public IFirewallRule
+{
+public:
+
+	PermitTunnel(const std::wstring &tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts);
+	
+	bool apply(IObjectInstaller &objectInstaller) override;
+
+private:
+
+	const std::wstring m_tunnelInterfaceAlias;
+	std::vector<wfp::IpAddress> m_hostsIpv4;
+	std::vector<wfp::IpAddress> m_hostsIpv6;
+};
+
+}
diff --git a/windows/winfw/src/winfw/rules/ports.h b/windows/winfw/src/winfw/rules/ports.h
new file mode 100644
index 0000000000..5a4e601062
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/ports.h
@@ -0,0 +1,19 @@
+#pragma once
+
+#include <cstdint>
+
+namespace rules
+{
+
+// Use weakly typed enum to get implicit promotion to integral types.
+enum Ports : uint16_t
+{
+	DHCPV4_CLIENT_PORT = 68,
+	DHCPV4_SERVER_PORT = 67,
+	DHCPV6_CLIENT_PORT = 546,
+	DHCPV6_SERVER_PORT = 547,
+
+	DNS_SERVER_PORT = 53,
+};
+
+}
diff --git a/windows/winfw/src/winfw/rules/restrictdns.cpp b/windows/winfw/src/winfw/rules/restrictdns.cpp
deleted file mode 100644
index 751e278233..0000000000
--- a/windows/winfw/src/winfw/rules/restrictdns.cpp
+++ /dev/null
@@ -1,132 +0,0 @@
-#include "stdafx.h"
-#include "restrictdns.h"
-#include "winfw/mullvadguids.h"
-#include "libwfp/filterbuilder.h"
-#include "libwfp/conditionbuilder.h"
-#include "libwfp/conditions/conditioninterface.h"
-#include "libwfp/conditions/conditionip.h"
-#include "libwfp/conditions/conditionport.h"
-
-using namespace wfp::conditions;
-
-namespace rules
-{
-
-RestrictDns::RestrictDns(
-	const std::optional<WinFwRelay> &relay,
-	const std::optional<DnsHosts> &dnsHosts
-)
-	: m_dnsHosts(dnsHosts)
-{
-	if (relay.has_value() && 53 == relay->port)
-	{
-		m_allowHost = std::make_optional(wfp::IpAddress(relay->ip));
-	}
-}
-
-bool RestrictDns::apply(IObjectInstaller &objectInstaller)
-{
-	wfp::FilterBuilder filterBuilder;
-
-	//
-	// Requires that the following rules are in effect:
-	//
-	// BlockAll
-	// PermitVpnTunnel
-	//
-	// TODO: Have each rule specify requirements?
-	//
-
-	filterBuilder
-		.provider(MullvadGuids::Provider())
-		.description(L"This filter is part of a rule that restricts DNS traffic")
-		.sublayer(MullvadGuids::SublayerBlacklist());
-
-	if (m_dnsHosts.has_value())
-	{
-		filterBuilder
-			.key(MullvadGuids::FilterRestrictDns_Outbound_Tunnel_Ipv4())
-			.name(L"Restrict DNS requests inside the VPN tunnel (IPv4)")
-			.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-			.weight(MAXUINT16)
-			.permit();
-
-		{
-			wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
-
-			conditionBuilder.add_condition(ConditionInterface::Alias(m_dnsHosts->tunnelInterfaceAlias, CompareEq()));
-			conditionBuilder.add_condition(ConditionIp::Remote(m_dnsHosts->v4DnsHost, CompareEq()));
-
-			if (!objectInstaller.addFilter(filterBuilder, conditionBuilder))
-			{
-				return false;
-			}
-		}
-	}
-
-	filterBuilder
-		.key(MullvadGuids::FilterRestrictDns_Outbound_Ipv4())
-		.name(L"Block DNS requests outside the VPN tunnel (IPv4)")
-		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-		.weight(MAXUINT16 - 1)
-		.block();
-
-	{
-		wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
-		conditionBuilder.add_condition(ConditionPort::Remote(53));
-
-		//
-		// Allow DNS traffic over select host
-		//
-		if (m_allowHost.has_value())
-		{
-			conditionBuilder.add_condition(ConditionIp::Remote(*m_allowHost, CompareNeq()));
-		}
-
-		if (!objectInstaller.addFilter(filterBuilder, conditionBuilder))
-		{
-			return false;
-		}
-	}
-
-	//
-	// IPv6 also
-	//
-
-	if (m_dnsHosts.has_value() && m_dnsHosts->v6DnsHost.has_value())
-	{
-		filterBuilder
-			.key(MullvadGuids::FilterRestrictDns_Outbound_Tunnel_Ipv6())
-			.name(L"Restrict DNS requests inside the VPN tunnel (IPv6)")
-			.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6)
-			.weight(MAXUINT16)
-			.permit();
-
-		{
-			wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
-
-			conditionBuilder.add_condition(ConditionInterface::Alias(m_dnsHosts->tunnelInterfaceAlias, CompareEq()));
-			conditionBuilder.add_condition(ConditionIp::Remote(*m_dnsHosts->v6DnsHost, CompareEq()));
-
-			if (!objectInstaller.addFilter(filterBuilder, conditionBuilder))
-			{
-				return false;
-			}
-		}
-	}
-
-	filterBuilder
-		.key(MullvadGuids::FilterRestrictDns_Outbound_Ipv6())
-		.name(L"Block DNS requests outside the VPN tunnel (IPv6)")
-		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6)
-		.weight(MAXUINT16 - 1)
-		.block();
-
-	{
-		wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
-		conditionBuilder.add_condition(ConditionPort::Remote(53));
-		return objectInstaller.addFilter(filterBuilder, conditionBuilder);
-	}
-}
-
-}
diff --git a/windows/winfw/src/winfw/rules/restrictdns.h b/windows/winfw/src/winfw/rules/restrictdns.h
deleted file mode 100644
index 9cf0ad00a9..0000000000
--- a/windows/winfw/src/winfw/rules/restrictdns.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#pragma once
-
-#include "ifirewallrule.h"
-#include "libwfp/ipaddress.h"
-#include "winfw/winfw.h"
-#include <optional>
-#include <string>
-#include <cstdint>
-
-namespace rules
-{
-
-class RestrictDns : public IFirewallRule
-{
-public:
-
-	struct DnsHosts
-	{
-		std::wstring tunnelInterfaceAlias;
-		wfp::IpAddress v4DnsHost;
-		std::optional<wfp::IpAddress> v6DnsHost;
-	};
-
-	RestrictDns(const std::optional<WinFwRelay> &relay, const std::optional<DnsHosts> &dnsHosts);
-
-	bool apply(IObjectInstaller &objectInstaller) override;
-
-private:
-
-	std::optional<wfp::IpAddress> m_allowHost;
-	const std::optional<DnsHosts> m_dnsHosts;
-
-};
-
-}
diff --git a/windows/winfw/src/winfw/sessioncontroller.cpp b/windows/winfw/src/winfw/sessioncontroller.cpp
index 3d7fcc2e1a..c5342fce78 100644
--- a/windows/winfw/src/winfw/sessioncontroller.cpp
+++ b/windows/winfw/src/winfw/sessioncontroller.cpp
@@ -1,7 +1,6 @@
 #include "stdafx.h"
 #include "sessioncontroller.h"
 #include "wfpobjecttype.h"
-#include "mullvadguids.h"
 #include "libwfp/objectinstaller.h"
 #include "libwfp/objectdeleter.h"
 #include "libwfp/transaction.h"
@@ -57,21 +56,11 @@ bool CheckpointKeyToIndex(const std::vector<SessionRecord> &container, uint32_t
 	return false;
 }
 
-void ValidateObject(const wfp::IIdentifiable &object)
-{
-	const auto registry = MullvadGuids::Registry();
-
-	if (registry.end() == registry.find(object.id()))
-	{
-		THROW_ERROR("Attempting to install non-registered WFP object");
-	}
-}
-
-
 } // anonymous namespace
 
 SessionController::SessionController(std::unique_ptr<wfp::FilterEngine> &&engine)
 	: m_engine(std::move(engine))
+	, m_identityRegistry(MullvadGuids::Registry(MullvadGuids::IdentityQualifier::OnlyCurrent))
 	, m_activeTransaction(false)
 {
 }
@@ -103,7 +92,7 @@ bool SessionController::addProvider(wfp::ProviderBuilder &providerBuilder)
 		THROW_ERROR("Cannot add provider outside transaction");
 	}
 
-	ValidateObject(providerBuilder);
+	validateObject(providerBuilder);
 
 	GUID key;
 
@@ -124,7 +113,7 @@ bool SessionController::addSublayer(wfp::SublayerBuilder &sublayerBuilder)
 		THROW_ERROR("Cannot add sublayer outside transaction");
 	}
 
-	ValidateObject(sublayerBuilder);
+	validateObject(sublayerBuilder);
 
 	GUID key;
 
@@ -145,7 +134,7 @@ bool SessionController::addFilter(wfp::FilterBuilder &filterBuilder, const wfp::
 		THROW_ERROR("Cannot add filter outside transaction");
 	}
 
-	ValidateObject(filterBuilder);
+	validateObject(filterBuilder);
 
 	UINT64 id;
 
@@ -286,3 +275,11 @@ void SessionController::rewindState(size_t steps)
 
 	EraseBack(m_transactionRecords, steps);
 }
+
+void SessionController::validateObject(const wfp::IIdentifiable &object) const
+{
+	if (m_identityRegistry.end() == m_identityRegistry.find(object.id()))
+	{
+		THROW_ERROR("Attempting to install non-registered WFP object");
+	}
+}
diff --git a/windows/winfw/src/winfw/sessioncontroller.h b/windows/winfw/src/winfw/sessioncontroller.h
index 243a501083..4300791660 100644
--- a/windows/winfw/src/winfw/sessioncontroller.h
+++ b/windows/winfw/src/winfw/sessioncontroller.h
@@ -2,6 +2,7 @@
 
 #include "iobjectinstaller.h"
 #include "sessionrecord.h"
+#include "mullvadguids.h"
 #include "libwfp/filterengine.h"
 #include "libwfp/iidentifiable.h"
 #include <functional>
@@ -54,9 +55,13 @@ private:
 	SessionController &operator=(const SessionController &) = delete;
 
 	void rewindState(size_t steps);
+	void validateObject(const wfp::IIdentifiable &object) const;
 
 	std::unique_ptr<wfp::FilterEngine> m_engine;
 
+	// Implement cache here since the source data doesn't change.
+	const MullvadGuids::IdentityRegistry m_identityRegistry;
+
 	std::vector<SessionRecord> m_records;
 	std::vector<SessionRecord> m_transactionRecords;
 
diff --git a/windows/winfw/src/winfw/winfw.cpp b/windows/winfw/src/winfw/winfw.cpp
index c053087355..dc0dbe3387 100644
--- a/windows/winfw/src/winfw/winfw.cpp
+++ b/windows/winfw/src/winfw/winfw.cpp
@@ -205,12 +205,18 @@ WinFw_ApplyPolicyConnected(
 
 	try
 	{
+		std::vector<wfp::IpAddress> tunnelDnsServers = { wfp::IpAddress(v4DnsHost) };
+
+		if (nullptr != v6DnsHost)
+		{
+			tunnelDnsServers.emplace_back(wfp::IpAddress(v6DnsHost));
+		}
+
 		return g_fwContext->applyPolicyConnected(
 			settings,
 			relay,
 			tunnelInterfaceAlias,
-			wfp::IpAddress(v4DnsHost),
-			nullptr != v6DnsHost ? std::make_optional(wfp::IpAddress(v6DnsHost)) : std::nullopt
+			tunnelDnsServers
 		);
 	}
 	catch (std::exception &err)
diff --git a/windows/winfw/src/winfw/winfw.vcxproj b/windows/winfw/src/winfw/winfw.vcxproj
index 15da42ec0f..c3805cfec8 100644
--- a/windows/winfw/src/winfw/winfw.vcxproj
+++ b/windows/winfw/src/winfw/winfw.vcxproj
@@ -23,18 +23,21 @@
     <ClCompile Include="mullvadguids.cpp" />
     <ClCompile Include="mullvadobjects.cpp" />
     <ClCompile Include="objectpurger.cpp" />
-    <ClCompile Include="rules\blockall.cpp" />
-    <ClCompile Include="rules\permitdhcp.cpp" />
-    <ClCompile Include="rules\permitdhcpserver.cpp" />
-    <ClCompile Include="rules\permitlan.cpp" />
-    <ClCompile Include="rules\permitlanservice.cpp" />
-    <ClCompile Include="rules\permitloopback.cpp" />
-    <ClCompile Include="rules\permitndp.cpp" />
-    <ClCompile Include="rules\permitping.cpp" />
-    <ClCompile Include="rules\permitvpntunnelservice.cpp" />
-    <ClCompile Include="rules\permitvpnrelay.cpp" />
-    <ClCompile Include="rules\permitvpntunnel.cpp" />
-    <ClCompile Include="rules\restrictdns.cpp" />
+    <ClCompile Include="rules\baseline\blockall.cpp" />
+    <ClCompile Include="rules\baseline\permitdhcp.cpp" />
+    <ClCompile Include="rules\baseline\permitdhcpserver.cpp" />
+    <ClCompile Include="rules\baseline\permitdns.cpp" />
+    <ClCompile Include="rules\baseline\permitlan.cpp" />
+    <ClCompile Include="rules\baseline\permitlanservice.cpp" />
+    <ClCompile Include="rules\baseline\permitloopback.cpp" />
+    <ClCompile Include="rules\baseline\permitndp.cpp" />
+    <ClCompile Include="rules\baseline\permitping.cpp" />
+    <ClCompile Include="rules\baseline\permitvpnrelay.cpp" />
+    <ClCompile Include="rules\baseline\permitvpntunnel.cpp" />
+    <ClCompile Include="rules\baseline\permitvpntunnelservice.cpp" />
+    <ClCompile Include="rules\dns\blockall.cpp" />
+    <ClCompile Include="rules\dns\permitnontunnel.cpp" />
+    <ClCompile Include="rules\dns\permittunnel.cpp" />
     <ClCompile Include="sessioncontroller.cpp" />
     <ClCompile Include="sessionrecord.cpp" />
     <ClCompile Include="stdafx.cpp">
@@ -52,20 +55,24 @@
     <ClInclude Include="mullvadguids.h" />
     <ClInclude Include="mullvadobjects.h" />
     <ClInclude Include="objectpurger.h" />
-    <ClInclude Include="rules\permitdhcpserver.h" />
-    <ClInclude Include="rules\permitndp.h" />
-    <ClInclude Include="rules\permitping.h" />
+    <ClInclude Include="rules\baseline\blockall.h" />
+    <ClInclude Include="rules\baseline\permitdhcp.h" />
+    <ClInclude Include="rules\baseline\permitdhcpserver.h" />
+    <ClInclude Include="rules\baseline\permitdns.h" />
+    <ClInclude Include="rules\baseline\permitlan.h" />
+    <ClInclude Include="rules\baseline\permitlanservice.h" />
+    <ClInclude Include="rules\baseline\permitloopback.h" />
+    <ClInclude Include="rules\baseline\permitndp.h" />
+    <ClInclude Include="rules\baseline\permitping.h" />
+    <ClInclude Include="rules\baseline\permitvpnrelay.h" />
+    <ClInclude Include="rules\baseline\permitvpntunnel.h" />
+    <ClInclude Include="rules\baseline\permitvpntunnelservice.h" />
+    <ClInclude Include="rules\dns\blockall.h" />
+    <ClInclude Include="rules\dns\permitnontunnel.h" />
+    <ClInclude Include="rules\dns\permittunnel.h" />
+    <ClInclude Include="rules\ports.h" />
     <ClInclude Include="wfpobjecttype.h" />
-    <ClInclude Include="rules\blockall.h" />
     <ClInclude Include="rules\ifirewallrule.h" />
-    <ClInclude Include="rules\permitdhcp.h" />
-    <ClInclude Include="rules\permitlan.h" />
-    <ClInclude Include="rules\permitlanservice.h" />
-    <ClInclude Include="rules\permitloopback.h" />
-    <ClInclude Include="rules\permitvpntunnelservice.h" />
-    <ClInclude Include="rules\permitvpnrelay.h" />
-    <ClInclude Include="rules\permitvpntunnel.h" />
-    <ClInclude Include="rules\restrictdns.h" />
     <ClInclude Include="sessioncontroller.h" />
     <ClInclude Include="sessionrecord.h" />
     <ClInclude Include="stdafx.h" />
@@ -161,6 +168,7 @@
       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
       <LanguageStandard>stdcpplatest</LanguageStandard>
       <AdditionalIncludeDirectories>$(ProjectDir)..\..\..\libshared\src\;$(ProjectDir)..\;$(ProjectDir)..\..\..\windows-libraries\src\;$(ProjectDir)..\..\..\libwfp\src\</AdditionalIncludeDirectories>
+      <ObjectFileName>$(IntDir)%(RelativeDir)/</ObjectFileName>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -180,6 +188,7 @@
       <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
       <LanguageStandard>stdcpplatest</LanguageStandard>
       <AdditionalIncludeDirectories>$(ProjectDir)..\..\..\libshared\src\;$(ProjectDir)..\;$(ProjectDir)..\..\..\windows-libraries\src\;$(ProjectDir)..\..\..\libwfp\src\</AdditionalIncludeDirectories>
+      <ObjectFileName>$(IntDir)%(RelativeDir)/</ObjectFileName>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -201,6 +210,7 @@
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <LanguageStandard>stdcpplatest</LanguageStandard>
       <AdditionalIncludeDirectories>$(ProjectDir)..\..\..\libshared\src\;$(ProjectDir)..\;$(ProjectDir)..\..\..\windows-libraries\src\;$(ProjectDir)..\..\..\libwfp\src\</AdditionalIncludeDirectories>
+      <ObjectFileName>$(IntDir)%(RelativeDir)/</ObjectFileName>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
@@ -224,6 +234,7 @@
       <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
       <LanguageStandard>stdcpplatest</LanguageStandard>
       <AdditionalIncludeDirectories>$(ProjectDir)..\..\..\libshared\src\;$(ProjectDir)..\;$(ProjectDir)..\..\..\windows-libraries\src\;$(ProjectDir)..\..\..\libwfp\src\</AdditionalIncludeDirectories>
+      <ObjectFileName>$(IntDir)%(RelativeDir)/</ObjectFileName>
     </ClCompile>
     <Link>
       <SubSystem>Windows</SubSystem>
diff --git a/windows/winfw/src/winfw/winfw.vcxproj.filters b/windows/winfw/src/winfw/winfw.vcxproj.filters
index a758a1c9ec..40d7c95067 100644
--- a/windows/winfw/src/winfw/winfw.vcxproj.filters
+++ b/windows/winfw/src/winfw/winfw.vcxproj.filters
@@ -8,43 +8,52 @@
     <ClCompile Include="sessioncontroller.cpp" />
     <ClCompile Include="mullvadguids.cpp" />
     <ClCompile Include="mullvadobjects.cpp" />
-    <ClCompile Include="rules\permitlan.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="sessionrecord.cpp" />
+    <ClCompile Include="objectpurger.cpp" />
+    <ClCompile Include="rules\baseline\blockall.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\blockall.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitdhcp.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\permitlanservice.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitdhcpserver.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\permitloopback.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitlan.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\permitdhcp.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitlanservice.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\permitvpnrelay.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitloopback.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\permitvpntunnel.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitndp.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="sessionrecord.cpp" />
-    <ClCompile Include="rules\restrictdns.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitping.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\permitvpntunnelservice.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitvpnrelay.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="objectpurger.cpp" />
-    <ClCompile Include="rules\permitdhcpserver.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitvpntunnel.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\permitndp.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitvpntunnelservice.cpp">
+      <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\permitping.cpp">
-      <Filter>rules</Filter>
+    <ClCompile Include="rules\baseline\permitdns.cpp">
+      <Filter>rules\baseline</Filter>
+    </ClCompile>
+    <ClCompile Include="rules\dns\blockall.cpp">
+      <Filter>rules\dns</Filter>
+    </ClCompile>
+    <ClCompile Include="rules\dns\permitnontunnel.cpp">
+      <Filter>rules\dns</Filter>
+    </ClCompile>
+    <ClCompile Include="rules\dns\permittunnel.cpp">
+      <Filter>rules\dns</Filter>
     </ClCompile>
   </ItemGroup>
   <ItemGroup>
@@ -58,52 +67,70 @@
     <ClInclude Include="rules\ifirewallrule.h">
       <Filter>rules</Filter>
     </ClInclude>
-    <ClInclude Include="rules\permitlan.h">
-      <Filter>rules</Filter>
-    </ClInclude>
     <ClInclude Include="iobjectinstaller.h" />
-    <ClInclude Include="rules\blockall.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="sessionrecord.h" />
+    <ClInclude Include="wfpobjecttype.h" />
+    <ClInclude Include="guidhash.h" />
+    <ClInclude Include="objectpurger.h" />
+    <ClInclude Include="rules\baseline\blockall.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="rules\permitlanservice.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\baseline\permitdhcp.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="rules\permitloopback.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\baseline\permitdhcpserver.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="rules\permitdhcp.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\baseline\permitlan.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="rules\permitvpnrelay.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\baseline\permitlanservice.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="rules\permitvpntunnel.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\baseline\permitloopback.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="sessionrecord.h" />
-    <ClInclude Include="rules\restrictdns.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\baseline\permitndp.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="rules\permitvpntunnelservice.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\baseline\permitping.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="wfpobjecttype.h" />
-    <ClInclude Include="guidhash.h" />
-    <ClInclude Include="objectpurger.h" />
-    <ClInclude Include="rules\permitdhcpserver.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\baseline\permitvpnrelay.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="rules\permitndp.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\baseline\permitvpntunnel.h">
+      <Filter>rules\baseline</Filter>
+    </ClInclude>
+    <ClInclude Include="rules\baseline\permitvpntunnelservice.h">
+      <Filter>rules\baseline</Filter>
+    </ClInclude>
+    <ClInclude Include="rules\baseline\permitdns.h">
+      <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="rules\permitping.h">
+    <ClInclude Include="rules\ports.h">
       <Filter>rules</Filter>
     </ClInclude>
+    <ClInclude Include="rules\dns\blockall.h">
+      <Filter>rules\dns</Filter>
+    </ClInclude>
+    <ClInclude Include="rules\dns\permitnontunnel.h">
+      <Filter>rules\dns</Filter>
+    </ClInclude>
+    <ClInclude Include="rules\dns\permittunnel.h">
+      <Filter>rules\dns</Filter>
+    </ClInclude>
   </ItemGroup>
   <ItemGroup>
     <Filter Include="rules">
       <UniqueIdentifier>{3639a3ba-599e-400c-918b-8869654cdc1f}</UniqueIdentifier>
     </Filter>
+    <Filter Include="rules\baseline">
+      <UniqueIdentifier>{6f15853c-ccbb-49c0-98ec-add205bc5c2f}</UniqueIdentifier>
+    </Filter>
+    <Filter Include="rules\dns">
+      <UniqueIdentifier>{9b35e8a4-84be-4ac3-9b6f-eb21cc02e065}</UniqueIdentifier>
+    </Filter>
   </ItemGroup>
   <ItemGroup>
     <None Include="winfw.def" />