Simplify with fewer sublayers

16 files changed, 110 insertions, 307 deletions

diff --git a/windows/winfw/src/winfw/fwcontext.cpp b/windows/winfw/src/winfw/fwcontext.cpp
index 975dd339a6..c5c4646082 100644
--- a/windows/winfw/src/winfw/fwcontext.cpp
+++ b/windows/winfw/src/winfw/fwcontext.cpp
@@ -16,10 +16,9 @@
 #include "rules/baseline/permitvpntunnelservice.h"
 #include "rules/baseline/permitping.h"
 #include "rules/baseline/permitdns.h"
-#include "rules/nontunneldns/permitselected.h"
-#include "rules/nontunneldns/blockall.h"
-#include "rules/tunneldns/permitselected.h"
-#include "rules/tunneldns/blockall.h"
+#include "rules/dns/blockall.h"
+#include "rules/dns/permitnontunnel.h"
+#include "rules/dns/permittunnel.h"
 #include <libwfp/transaction.h>
 #include <libwfp/filterengine.h>
 #include <libcommon/error.h>
@@ -79,26 +78,18 @@ void AppendSettingsRules
 	//
 
 	ruleset.emplace_back(std::make_unique<baseline::PermitDns>());
+	ruleset.emplace_back(std::make_unique<dns::BlockAll>());
 
+	if (nonTunnelDnsServers.has_value())
 	{
-		ruleset.emplace_back(std::make_unique<nontunneldns::BlockAll>(tunnelInterfaceAlias));
-
-		if (nonTunnelDnsServers.has_value())
-		{
-			ruleset.emplace_back(std::make_unique<nontunneldns::PermitSelected>(
-				tunnelInterfaceAlias, nonTunnelDnsServers.value()));
-		}
+		ruleset.emplace_back(std::make_unique<dns::PermitNonTunnel>(
+			tunnelInterfaceAlias, nonTunnelDnsServers.value()));
 	}
 
-	if (tunnelInterfaceAlias.has_value())
+	if (tunnelInterfaceAlias.has_value() && tunnelDnsServers.has_value())
 	{
-		ruleset.emplace_back(std::make_unique<tunneldns::BlockAll>(tunnelInterfaceAlias.value()));
-
-		if (tunnelDnsServers.has_value())
-		{
-			ruleset.emplace_back(std::make_unique<tunneldns::PermitSelected>(
-				tunnelInterfaceAlias.value(), tunnelDnsServers.value()));
-		}
+		ruleset.emplace_back(std::make_unique<dns::PermitTunnel>(
+			tunnelInterfaceAlias.value(), tunnelDnsServers.value()));
 	}
 }
 
@@ -300,8 +291,7 @@ bool FwContext::applyCommonBaseConfiguration(SessionController &controller, wfp:
 	//
 	return controller.addProvider(*MullvadObjects::Provider())
 		&& controller.addSublayer(*MullvadObjects::SublayerBaseline())
-		&& controller.addSublayer(*MullvadObjects::SublayerNonTunnelDns())
-		&& controller.addSublayer(*MullvadObjects::SublayerTunnelDns());
+		&& controller.addSublayer(*MullvadObjects::SublayerDns());
 }
 
 bool FwContext::applyRuleset(const Ruleset &ruleset)
diff --git a/windows/winfw/src/winfw/mullvadguids.cpp b/windows/winfw/src/winfw/mullvadguids.cpp
index 77f25f4c59..6f826d41e1 100644
--- a/windows/winfw/src/winfw/mullvadguids.cpp
+++ b/windows/winfw/src/winfw/mullvadguids.cpp
@@ -26,8 +26,7 @@ DetailedWfpObjectRegistry MullvadGuids::BuildDetailedRegistry()
 
 	registry.insert(std::make_pair(WfpObjectType::Provider, Provider()));
 	registry.insert(std::make_pair(WfpObjectType::Sublayer, SublayerBaseline()));
-	registry.insert(std::make_pair(WfpObjectType::Sublayer, SublayerNonTunnelDns()));
-	registry.insert(std::make_pair(WfpObjectType::Sublayer, SublayerTunnelDns()));
+	registry.insert(std::make_pair(WfpObjectType::Sublayer, SublayerDns()));
 	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_BlockAll_Outbound_Ipv4()));
 	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_BlockAll_Inbound_Ipv4()));
 	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_BlockAll_Outbound_Ipv6()));
@@ -60,14 +59,12 @@ DetailedWfpObjectRegistry MullvadGuids::BuildDetailedRegistry()
 	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitPing_Outbound_Icmpv6()));
 	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDns_Outbound_Ipv4()));
 	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Baseline_PermitDns_Outbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_NonTunnelDns_BlockAll_Outbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_NonTunnelDns_BlockAll_Outbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_NonTunnelDns_PermitSelected_Outbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_NonTunnelDns_PermitSelected_Outbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_TunnelDns_BlockAll_Outbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_TunnelDns_BlockAll_Outbound_Ipv6()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_TunnelDns_PermitSelected_Outbound_Ipv4()));
-	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_TunnelDns_PermitSelected_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_BlockAll_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_BlockAll_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_PermitNonTunnel_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_PermitNonTunnel_Outbound_Ipv6()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_PermitTunnel_Outbound_Ipv4()));
+	registry.insert(std::make_pair(WfpObjectType::Filter, Filter_Dns_PermitTunnel_Outbound_Ipv6()));
 
 	return registry;
 }
@@ -115,7 +112,7 @@ const GUID &MullvadGuids::SublayerBaseline()
 }
 
 //static
-const GUID& MullvadGuids::SublayerNonTunnelDns()
+const GUID &MullvadGuids::SublayerDns()
 {
 	static const GUID g =
 	{
@@ -129,20 +126,6 @@ const GUID& MullvadGuids::SublayerNonTunnelDns()
 }
 
 //static
-const GUID& MullvadGuids::SublayerTunnelDns()
-{
-	static const GUID g =
-	{
-		0xd879542d,
-		0x2f34,
-		0x4af6,
-		{ 0x9f, 0xec, 0xe1, 0xa, 0x20, 0x86, 0xbf, 0xbc }
-	};
-
-	return g;
-}
-
-//static
 const GUID &MullvadGuids::Filter_Baseline_BlockAll_Outbound_Ipv4()
 {
 	static const GUID g =
@@ -592,7 +575,7 @@ const GUID &MullvadGuids::Filter_Baseline_PermitDns_Outbound_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::Filter_NonTunnelDns_BlockAll_Outbound_Ipv4()
+const GUID &MullvadGuids::Filter_Dns_BlockAll_Outbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -606,7 +589,7 @@ const GUID &MullvadGuids::Filter_NonTunnelDns_BlockAll_Outbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::Filter_NonTunnelDns_BlockAll_Outbound_Ipv6()
+const GUID &MullvadGuids::Filter_Dns_BlockAll_Outbound_Ipv6()
 {
 	static const GUID g =
 	{
@@ -620,7 +603,7 @@ const GUID &MullvadGuids::Filter_NonTunnelDns_BlockAll_Outbound_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::Filter_NonTunnelDns_PermitSelected_Outbound_Ipv4()
+const GUID &MullvadGuids::Filter_Dns_PermitNonTunnel_Outbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -634,7 +617,7 @@ const GUID &MullvadGuids::Filter_NonTunnelDns_PermitSelected_Outbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::Filter_NonTunnelDns_PermitSelected_Outbound_Ipv6()
+const GUID &MullvadGuids::Filter_Dns_PermitNonTunnel_Outbound_Ipv6()
 {
 	static const GUID g =
 	{
@@ -648,35 +631,7 @@ const GUID &MullvadGuids::Filter_NonTunnelDns_PermitSelected_Outbound_Ipv6()
 }
 
 //static
-const GUID &MullvadGuids::Filter_TunnelDns_BlockAll_Outbound_Ipv4()
-{
-	static const GUID g =
-	{
-		0xfdc269d6,
-		0x1e51,
-		0x4687,
-		{ 0x82, 0x2c, 0x15, 0xc1, 0xcd, 0x9b, 0x1b, 0x43 }
-	};
-
-	return g;
-}
-
-//static
-const GUID &MullvadGuids::Filter_TunnelDns_BlockAll_Outbound_Ipv6()
-{
-	static const GUID g =
-	{
-		0xf76b04b8,
-		0x73da,
-		0x4880,
-		{ 0x88, 0xe5, 0x27, 0x38, 0x2b, 0xd8, 0xf7, 0x4 }
-	};
-
-	return g;
-}
-
-//static
-const GUID &MullvadGuids::Filter_TunnelDns_PermitSelected_Outbound_Ipv4()
+const GUID &MullvadGuids::Filter_Dns_PermitTunnel_Outbound_Ipv4()
 {
 	static const GUID g =
 	{
@@ -690,7 +645,7 @@ const GUID &MullvadGuids::Filter_TunnelDns_PermitSelected_Outbound_Ipv4()
 }
 
 //static
-const GUID &MullvadGuids::Filter_TunnelDns_PermitSelected_Outbound_Ipv6()
+const GUID &MullvadGuids::Filter_Dns_PermitTunnel_Outbound_Ipv6()
 {
 	static const GUID g =
 	{
diff --git a/windows/winfw/src/winfw/mullvadguids.h b/windows/winfw/src/winfw/mullvadguids.h
index e64c6460f1..daac20fb59 100644
--- a/windows/winfw/src/winfw/mullvadguids.h
+++ b/windows/winfw/src/winfw/mullvadguids.h
@@ -23,8 +23,7 @@ public:
 
 	static const GUID &Provider();
 	static const GUID &SublayerBaseline();
-	static const GUID &SublayerNonTunnelDns();
-	static const GUID &SublayerTunnelDns();
+	static const GUID &SublayerDns();
 
 	//
 	// Filter identifiers
@@ -75,13 +74,10 @@ public:
 	static const GUID &Filter_Baseline_PermitDns_Outbound_Ipv4();
 	static const GUID &Filter_Baseline_PermitDns_Outbound_Ipv6();
 
-	static const GUID &Filter_NonTunnelDns_BlockAll_Outbound_Ipv4();
-	static const GUID &Filter_NonTunnelDns_BlockAll_Outbound_Ipv6();
-	static const GUID &Filter_NonTunnelDns_PermitSelected_Outbound_Ipv4();
-	static const GUID &Filter_NonTunnelDns_PermitSelected_Outbound_Ipv6();
-
-	static const GUID &Filter_TunnelDns_BlockAll_Outbound_Ipv4();
-	static const GUID &Filter_TunnelDns_BlockAll_Outbound_Ipv6();
-	static const GUID &Filter_TunnelDns_PermitSelected_Outbound_Ipv4();
-	static const GUID &Filter_TunnelDns_PermitSelected_Outbound_Ipv6();
+	static const GUID &Filter_Dns_BlockAll_Outbound_Ipv4();
+	static const GUID &Filter_Dns_BlockAll_Outbound_Ipv6();
+	static const GUID &Filter_Dns_PermitNonTunnel_Outbound_Ipv4();
+	static const GUID &Filter_Dns_PermitNonTunnel_Outbound_Ipv6();
+	static const GUID &Filter_Dns_PermitTunnel_Outbound_Ipv4();
+	static const GUID &Filter_Dns_PermitTunnel_Outbound_Ipv6();
 };
diff --git a/windows/winfw/src/winfw/mullvadobjects.cpp b/windows/winfw/src/winfw/mullvadobjects.cpp
index e305f76388..b96f0dd743 100644
--- a/windows/winfw/src/winfw/mullvadobjects.cpp
+++ b/windows/winfw/src/winfw/mullvadobjects.cpp
@@ -31,29 +31,14 @@ std::unique_ptr<wfp::SublayerBuilder> MullvadObjects::SublayerBaseline()
 }
 
 //static
-std::unique_ptr<wfp::SublayerBuilder> MullvadObjects::SublayerNonTunnelDns()
+std::unique_ptr<wfp::SublayerBuilder> MullvadObjects::SublayerDns()
 {
 	auto builder = std::make_unique<wfp::SublayerBuilder>();
 
 	(*builder)
-		.name(L"Mullvad VPN non-tunnel DNS")
-		.description(L"Filters that restrict DNS traffic outside tunnel")
-		.key(MullvadGuids::SublayerNonTunnelDns())
-		.provider(MullvadGuids::Provider())
-		.weight(MAXUINT16 - 1);
-
-	return builder;
-}
-
-//static
-std::unique_ptr<wfp::SublayerBuilder> MullvadObjects::SublayerTunnelDns()
-{
-	auto builder = std::make_unique<wfp::SublayerBuilder>();
-
-	(*builder)
-		.name(L"Mullvad VPN tunnel DNS")
-		.description(L"Filters that restrict DNS traffic inside tunnel")
-		.key(MullvadGuids::SublayerTunnelDns())
+		.name(L"Mullvad VPN DNS")
+		.description(L"Filters that restrict DNS traffic")
+		.key(MullvadGuids::SublayerDns())
 		.provider(MullvadGuids::Provider())
 		.weight(MAXUINT16 - 1);
 
diff --git a/windows/winfw/src/winfw/mullvadobjects.h b/windows/winfw/src/winfw/mullvadobjects.h
index 430b61f4be..a1183c9018 100644
--- a/windows/winfw/src/winfw/mullvadobjects.h
+++ b/windows/winfw/src/winfw/mullvadobjects.h
@@ -14,6 +14,5 @@ public:
 
 	static std::unique_ptr<wfp::ProviderBuilder> Provider();
 	static std::unique_ptr<wfp::SublayerBuilder> SublayerBaseline();
-	static std::unique_ptr<wfp::SublayerBuilder> SublayerNonTunnelDns();
-	static std::unique_ptr<wfp::SublayerBuilder> SublayerTunnelDns();
+	static std::unique_ptr<wfp::SublayerBuilder> SublayerDns();
 };
diff --git a/windows/winfw/src/winfw/rules/tunneldns/blockall.cpp b/windows/winfw/src/winfw/rules/dns/blockall.cpp
index 8d9c2d7cd2..8324a5fdb2 100644
--- a/windows/winfw/src/winfw/rules/tunneldns/blockall.cpp
+++ b/windows/winfw/src/winfw/rules/dns/blockall.cpp
@@ -5,18 +5,12 @@
 #include <libwfp/filterbuilder.h>
 #include <libwfp/conditionbuilder.h>
 #include <libwfp/conditions/conditionport.h>
-#include <libwfp/conditions/conditioninterface.h>
 
 using namespace wfp::conditions;
 
-namespace rules::tunneldns
+namespace rules::dns
 {
 
-BlockAll::BlockAll(const std::wstring &tunnelInterfaceAlias)
-	: m_tunnelInterfaceAlias(tunnelInterfaceAlias)
-{
-}
-
 bool BlockAll::apply(IObjectInstaller &objectInstaller)
 {
 	wfp::FilterBuilder filterBuilder;
@@ -26,19 +20,18 @@ bool BlockAll::apply(IObjectInstaller &objectInstaller)
 	//
 
 	filterBuilder
-		.key(MullvadGuids::Filter_TunnelDns_BlockAll_Outbound_Ipv4())
-		.name(L"Block DNS inside the tunnel (IPv4)")
-		.description(L"This filter is part of a rule that blocks DNS inside the tunnel")
+		.key(MullvadGuids::Filter_Dns_BlockAll_Outbound_Ipv4())
+		.name(L"Block outbound DNS (IPv4)")
+		.description(L"This filter is part of a rule that blocks DNS requests")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-		.sublayer(MullvadGuids::SublayerTunnelDns())
+		.sublayer(MullvadGuids::SublayerDns())
 		.weight(wfp::FilterBuilder::WeightClass::Min)
 		.block();
 
 	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
 
 	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
-	conditionBuilder.add_condition(ConditionInterface::Alias(m_tunnelInterfaceAlias));
 
 	if (false == objectInstaller.addFilter(filterBuilder, conditionBuilder))
 	{
@@ -50,14 +43,13 @@ bool BlockAll::apply(IObjectInstaller &objectInstaller)
 	//
 
 	filterBuilder
-		.key(MullvadGuids::Filter_TunnelDns_BlockAll_Outbound_Ipv6())
-		.name(L"Block DNS inside the tunnel (IPv6)")
+		.key(MullvadGuids::Filter_Dns_BlockAll_Outbound_Ipv6())
+		.name(L"Block outbound DNS (IPv6)")
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
 
 	conditionBuilder.reset(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
 
 	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
-	conditionBuilder.add_condition(ConditionInterface::Alias(m_tunnelInterfaceAlias));
 
 	return objectInstaller.addFilter(filterBuilder, conditionBuilder);
 }
diff --git a/windows/winfw/src/winfw/rules/dns/blockall.h b/windows/winfw/src/winfw/rules/dns/blockall.h
new file mode 100644
index 0000000000..8ea50077a4
--- /dev/null
+++ b/windows/winfw/src/winfw/rules/dns/blockall.h
@@ -0,0 +1,15 @@
+#pragma once
+
+#include <winfw/rules/ifirewallrule.h>
+
+namespace rules::dns
+{
+
+class BlockAll : public IFirewallRule
+{
+public:
+
+	bool apply(IObjectInstaller &objectInstaller) override;
+};
+
+}
diff --git a/windows/winfw/src/winfw/rules/nontunneldns/permitselected.cpp b/windows/winfw/src/winfw/rules/dns/permitnontunnel.cpp
index 3c8130ea40..0af09a2d8b 100644
--- a/windows/winfw/src/winfw/rules/nontunneldns/permitselected.cpp
+++ b/windows/winfw/src/winfw/rules/dns/permitnontunnel.cpp
@@ -1,5 +1,5 @@
 #include "stdafx.h"
-#include "permitselected.h"
+#include "permitnontunnel.h"
 #include <winfw/mullvadguids.h>
 #include <winfw/rules/ports.h>
 #include <libwfp/filterbuilder.h>
@@ -11,10 +11,10 @@
 
 using namespace wfp::conditions;
 
-namespace rules::nontunneldns
+namespace rules::dns
 {
 
-PermitSelected::PermitSelected(std::optional<std::wstring> tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts)
+PermitNonTunnel::PermitNonTunnel(std::optional<std::wstring> tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts)
 	: m_tunnelInterfaceAlias(std::move(tunnelInterfaceAlias))
 {
 	if (hosts.empty())
@@ -44,7 +44,7 @@ PermitSelected::PermitSelected(std::optional<std::wstring> tunnelInterfaceAlias,
 	}
 }
 
-bool PermitSelected::apply(IObjectInstaller &objectInstaller)
+bool PermitNonTunnel::apply(IObjectInstaller &objectInstaller)
 {
 	wfp::FilterBuilder filterBuilder;
 
@@ -55,12 +55,12 @@ bool PermitSelected::apply(IObjectInstaller &objectInstaller)
 	if (false == m_hostsIpv4.empty())
 	{
 		filterBuilder
-			.key(MullvadGuids::Filter_NonTunnelDns_PermitSelected_Outbound_Ipv4())
-			.name(L"Permit outbound connections to selected DNS servers (IPv4)")
-			.description(L"This filter is part of a rule that permits outbound DNS")
+			.key(MullvadGuids::Filter_Dns_PermitNonTunnel_Outbound_Ipv4())
+			.name(L"Permit selected non-tunnel DNS traffic (IPv4)")
+			.description(L"This filter is part of a rule that permits non-tunnel DNS traffic")
 			.provider(MullvadGuids::Provider())
 			.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-			.sublayer(MullvadGuids::SublayerNonTunnelDns())
+			.sublayer(MullvadGuids::SublayerDns())
 			.weight(wfp::FilterBuilder::WeightClass::Max)
 			.permit();
 
@@ -94,12 +94,12 @@ bool PermitSelected::apply(IObjectInstaller &objectInstaller)
 	//
 
 	filterBuilder
-		.key(MullvadGuids::Filter_NonTunnelDns_PermitSelected_Outbound_Ipv6())
-		.name(L"Permit outbound connections to selected DNS servers (IPv6)")
-		.description(L"This filter is part of a rule that permits outbound DNS")
+		.key(MullvadGuids::Filter_Dns_PermitNonTunnel_Outbound_Ipv6())
+		.name(L"Permit selected non-tunnel DNS traffic (IPv6)")
+		.description(L"This filter is part of a rule that permits non-tunnel DNS traffic")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6)
-		.sublayer(MullvadGuids::SublayerNonTunnelDns())
+		.sublayer(MullvadGuids::SublayerDns())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
diff --git a/windows/winfw/src/winfw/rules/nontunneldns/permitselected.h b/windows/winfw/src/winfw/rules/dns/permitnontunnel.h
index 6dffbab857..07b67245c3 100644
--- a/windows/winfw/src/winfw/rules/nontunneldns/permitselected.h
+++ b/windows/winfw/src/winfw/rules/dns/permitnontunnel.h
@@ -6,10 +6,10 @@
 #include <optional>
 #include <string>
 
-namespace rules::nontunneldns
+namespace rules::dns
 {
 
-class PermitSelected : public IFirewallRule
+class PermitNonTunnel : public IFirewallRule
 {
 public:
 
@@ -17,7 +17,7 @@ public:
 	// The alias argument has to be optional for when the relay is connected on port 53.
 	// At this point in time there's no tunnel yet.
 	//
-	PermitSelected(std::optional<std::wstring> tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts);
+	PermitNonTunnel(std::optional<std::wstring> tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts);
 	
 	bool apply(IObjectInstaller &objectInstaller) override;
 
diff --git a/windows/winfw/src/winfw/rules/tunneldns/permitselected.cpp b/windows/winfw/src/winfw/rules/dns/permittunnel.cpp
index 0d34706589..64211ef17f 100644
--- a/windows/winfw/src/winfw/rules/tunneldns/permitselected.cpp
+++ b/windows/winfw/src/winfw/rules/dns/permittunnel.cpp
@@ -1,5 +1,5 @@
 #include "stdafx.h"
-#include "permitselected.h"
+#include "permittunnel.h"
 #include <winfw/mullvadguids.h>
 #include <winfw/rules/ports.h>
 #include <libwfp/filterbuilder.h>
@@ -11,10 +11,10 @@
 
 using namespace wfp::conditions;
 
-namespace rules::tunneldns
+namespace rules::dns
 {
 
-PermitSelected::PermitSelected(const std::wstring &tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts)
+PermitTunnel::PermitTunnel(const std::wstring &tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts)
 	: m_tunnelInterfaceAlias(tunnelInterfaceAlias)
 {
 	if (hosts.empty())
@@ -44,7 +44,7 @@ PermitSelected::PermitSelected(const std::wstring &tunnelInterfaceAlias, const s
 	}
 }
 
-bool PermitSelected::apply(IObjectInstaller &objectInstaller)
+bool PermitTunnel::apply(IObjectInstaller &objectInstaller)
 {
 	wfp::FilterBuilder filterBuilder;
 
@@ -55,12 +55,12 @@ bool PermitSelected::apply(IObjectInstaller &objectInstaller)
 	if (false == m_hostsIpv4.empty())
 	{
 		filterBuilder
-			.key(MullvadGuids::Filter_TunnelDns_PermitSelected_Outbound_Ipv4())
-			.name(L"Permit outbound connections to selected DNS servers (IPv4)")
-			.description(L"This filter is part of a rule that permits outbound DNS")
+			.key(MullvadGuids::Filter_Dns_PermitTunnel_Outbound_Ipv4())
+			.name(L"Permit selected DNS traffic inside tunnel (IPv4)")
+			.description(L"This filter is part of a rule that permits DNS traffic inside the VPN tunnel")
 			.provider(MullvadGuids::Provider())
 			.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-			.sublayer(MullvadGuids::SublayerTunnelDns())
+			.sublayer(MullvadGuids::SublayerDns())
 			.weight(wfp::FilterBuilder::WeightClass::Max)
 			.permit();
 
@@ -90,12 +90,12 @@ bool PermitSelected::apply(IObjectInstaller &objectInstaller)
 	//
 
 	filterBuilder
-		.key(MullvadGuids::Filter_TunnelDns_PermitSelected_Outbound_Ipv6())
-		.name(L"Permit outbound connections to selected DNS servers (IPv6)")
-		.description(L"This filter is part of a rule that permits outbound DNS")
+		.key(MullvadGuids::Filter_Dns_PermitTunnel_Outbound_Ipv6())
+		.name(L"Permit selected DNS traffic inside tunnel (IPv6)")
+		.description(L"This filter is part of a rule that permits DNS traffic inside the VPN tunnel")
 		.provider(MullvadGuids::Provider())
 		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6)
-		.sublayer(MullvadGuids::SublayerTunnelDns())
+		.sublayer(MullvadGuids::SublayerDns())
 		.weight(wfp::FilterBuilder::WeightClass::Max)
 		.permit();
 
diff --git a/windows/winfw/src/winfw/rules/tunneldns/permitselected.h b/windows/winfw/src/winfw/rules/dns/permittunnel.h
index 7f7eff49d2..067a8a9607 100644
--- a/windows/winfw/src/winfw/rules/tunneldns/permitselected.h
+++ b/windows/winfw/src/winfw/rules/dns/permittunnel.h
@@ -5,14 +5,14 @@
 #include <vector>
 #include <string>
 
-namespace rules::tunneldns
+namespace rules::dns
 {
 
-class PermitSelected : public IFirewallRule
+class PermitTunnel : public IFirewallRule
 {
 public:
 
-	PermitSelected(const std::wstring &tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts);
+	PermitTunnel(const std::wstring &tunnelInterfaceAlias, const std::vector<wfp::IpAddress> &hosts);
 	
 	bool apply(IObjectInstaller &objectInstaller) override;
 
diff --git a/windows/winfw/src/winfw/rules/nontunneldns/blockall.cpp b/windows/winfw/src/winfw/rules/nontunneldns/blockall.cpp
deleted file mode 100644
index 8592aa5d42..0000000000
--- a/windows/winfw/src/winfw/rules/nontunneldns/blockall.cpp
+++ /dev/null
@@ -1,72 +0,0 @@
-#include "stdafx.h"
-#include "blockall.h"
-#include <winfw/mullvadguids.h>
-#include <winfw/rules/ports.h>
-#include <libwfp/filterbuilder.h>
-#include <libwfp/conditionbuilder.h>
-#include <libwfp/conditions/conditionport.h>
-#include <libwfp/conditions/conditioninterface.h>
-
-using namespace wfp::conditions;
-
-namespace rules::nontunneldns
-{
-
-BlockAll::BlockAll(std::optional<std::wstring> tunnelInterfaceAlias)
-	: m_tunnelInterfaceAlias(std::move(tunnelInterfaceAlias))
-{
-}
-
-bool BlockAll::apply(IObjectInstaller &objectInstaller)
-{
-	wfp::FilterBuilder filterBuilder;
-
-	//
-	// #1 Block outbound DNS, IPv4.
-	//
-
-	filterBuilder
-		.key(MullvadGuids::Filter_NonTunnelDns_BlockAll_Outbound_Ipv4())
-		.name(L"Block DNS outside the tunnel (IPv4)")
-		.description(L"This filter is part of a rule that blocks DNS outside the tunnel")
-		.provider(MullvadGuids::Provider())
-		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V4)
-		.sublayer(MullvadGuids::SublayerNonTunnelDns())
-		.weight(wfp::FilterBuilder::WeightClass::Min)
-		.block();
-
-	wfp::ConditionBuilder conditionBuilder(FWPM_LAYER_ALE_AUTH_CONNECT_V4);
-
-	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
-
-	if (m_tunnelInterfaceAlias.has_value())
-	{
-		conditionBuilder.add_condition(ConditionInterface::Alias(m_tunnelInterfaceAlias.value(), CompareNeq()));
-	}
-
-	if (false == objectInstaller.addFilter(filterBuilder, conditionBuilder))
-	{
-		return false;
-	}
-
-	//
-	// #2 Block outbound DNS, IPv6.
-	//
-
-	filterBuilder
-		.key(MullvadGuids::Filter_NonTunnelDns_BlockAll_Outbound_Ipv6())
-		.name(L"Block DNS outside the tunnel (IPv6)")
-		.layer(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
-
-	conditionBuilder.reset(FWPM_LAYER_ALE_AUTH_CONNECT_V6);
-	conditionBuilder.add_condition(ConditionPort::Remote(DNS_SERVER_PORT));
-
-	if (m_tunnelInterfaceAlias.has_value())
-	{
-		conditionBuilder.add_condition(ConditionInterface::Alias(m_tunnelInterfaceAlias.value(), CompareNeq()));
-	}
-
-	return objectInstaller.addFilter(filterBuilder, conditionBuilder);
-}
-
-}
diff --git a/windows/winfw/src/winfw/rules/nontunneldns/blockall.h b/windows/winfw/src/winfw/rules/nontunneldns/blockall.h
deleted file mode 100644
index 6269bb4850..0000000000
--- a/windows/winfw/src/winfw/rules/nontunneldns/blockall.h
+++ /dev/null
@@ -1,23 +0,0 @@
-#pragma once
-
-#include <winfw/rules/ifirewallrule.h>
-#include <optional>
-#include <string>
-
-namespace rules::nontunneldns
-{
-
-class BlockAll : public IFirewallRule
-{
-public:
-
-	BlockAll(std::optional<std::wstring> tunnelInterfaceAlias);
-	
-	bool apply(IObjectInstaller &objectInstaller) override;
-
-private:
-
-	const std::optional<std::wstring> m_tunnelInterfaceAlias;
-};
-
-}
diff --git a/windows/winfw/src/winfw/rules/tunneldns/blockall.h b/windows/winfw/src/winfw/rules/tunneldns/blockall.h
deleted file mode 100644
index 7a61aee398..0000000000
--- a/windows/winfw/src/winfw/rules/tunneldns/blockall.h
+++ /dev/null
@@ -1,23 +0,0 @@
-#pragma once
-
-#include <winfw/rules/ifirewallrule.h>
-#include <optional>
-#include <string>
-
-namespace rules::tunneldns
-{
-
-class BlockAll : public IFirewallRule
-{
-public:
-
-	BlockAll(const std::wstring &tunnelInterfaceAlias);
-	
-	bool apply(IObjectInstaller &objectInstaller) override;
-
-private:
-
-	const std::wstring m_tunnelInterfaceAlias;
-};
-
-}
diff --git a/windows/winfw/src/winfw/winfw.vcxproj b/windows/winfw/src/winfw/winfw.vcxproj
index 40829a0cb9..c3805cfec8 100644
--- a/windows/winfw/src/winfw/winfw.vcxproj
+++ b/windows/winfw/src/winfw/winfw.vcxproj
@@ -35,10 +35,9 @@
     <ClCompile Include="rules\baseline\permitvpnrelay.cpp" />
     <ClCompile Include="rules\baseline\permitvpntunnel.cpp" />
     <ClCompile Include="rules\baseline\permitvpntunnelservice.cpp" />
-    <ClCompile Include="rules\nontunneldns\blockall.cpp" />
-    <ClCompile Include="rules\nontunneldns\permitselected.cpp" />
-    <ClCompile Include="rules\tunneldns\blockall.cpp" />
-    <ClCompile Include="rules\tunneldns\permitselected.cpp" />
+    <ClCompile Include="rules\dns\blockall.cpp" />
+    <ClCompile Include="rules\dns\permitnontunnel.cpp" />
+    <ClCompile Include="rules\dns\permittunnel.cpp" />
     <ClCompile Include="sessioncontroller.cpp" />
     <ClCompile Include="sessionrecord.cpp" />
     <ClCompile Include="stdafx.cpp">
@@ -68,11 +67,10 @@
     <ClInclude Include="rules\baseline\permitvpnrelay.h" />
     <ClInclude Include="rules\baseline\permitvpntunnel.h" />
     <ClInclude Include="rules\baseline\permitvpntunnelservice.h" />
-    <ClInclude Include="rules\nontunneldns\blockall.h" />
-    <ClInclude Include="rules\nontunneldns\permitselected.h" />
+    <ClInclude Include="rules\dns\blockall.h" />
+    <ClInclude Include="rules\dns\permitnontunnel.h" />
+    <ClInclude Include="rules\dns\permittunnel.h" />
     <ClInclude Include="rules\ports.h" />
-    <ClInclude Include="rules\tunneldns\blockall.h" />
-    <ClInclude Include="rules\tunneldns\permitselected.h" />
     <ClInclude Include="wfpobjecttype.h" />
     <ClInclude Include="rules\ifirewallrule.h" />
     <ClInclude Include="sessioncontroller.h" />
diff --git a/windows/winfw/src/winfw/winfw.vcxproj.filters b/windows/winfw/src/winfw/winfw.vcxproj.filters
index 90f15ab205..40d7c95067 100644
--- a/windows/winfw/src/winfw/winfw.vcxproj.filters
+++ b/windows/winfw/src/winfw/winfw.vcxproj.filters
@@ -46,17 +46,14 @@
     <ClCompile Include="rules\baseline\permitdns.cpp">
       <Filter>rules\baseline</Filter>
     </ClCompile>
-    <ClCompile Include="rules\nontunneldns\blockall.cpp">
-      <Filter>rules\nontunneldns</Filter>
+    <ClCompile Include="rules\dns\blockall.cpp">
+      <Filter>rules\dns</Filter>
     </ClCompile>
-    <ClCompile Include="rules\nontunneldns\permitselected.cpp">
-      <Filter>rules\nontunneldns</Filter>
+    <ClCompile Include="rules\dns\permitnontunnel.cpp">
+      <Filter>rules\dns</Filter>
     </ClCompile>
-    <ClCompile Include="rules\tunneldns\blockall.cpp">
-      <Filter>rules\tunneldns</Filter>
-    </ClCompile>
-    <ClCompile Include="rules\tunneldns\permitselected.cpp">
-      <Filter>rules\tunneldns</Filter>
+    <ClCompile Include="rules\dns\permittunnel.cpp">
+      <Filter>rules\dns</Filter>
     </ClCompile>
   </ItemGroup>
   <ItemGroup>
@@ -111,20 +108,17 @@
     <ClInclude Include="rules\baseline\permitdns.h">
       <Filter>rules\baseline</Filter>
     </ClInclude>
-    <ClInclude Include="rules\nontunneldns\blockall.h">
-      <Filter>rules\nontunneldns</Filter>
+    <ClInclude Include="rules\ports.h">
+      <Filter>rules</Filter>
     </ClInclude>
-    <ClInclude Include="rules\nontunneldns\permitselected.h">
-      <Filter>rules\nontunneldns</Filter>
+    <ClInclude Include="rules\dns\blockall.h">
+      <Filter>rules\dns</Filter>
     </ClInclude>
-    <ClInclude Include="rules\tunneldns\blockall.h">
-      <Filter>rules\tunneldns</Filter>
+    <ClInclude Include="rules\dns\permitnontunnel.h">
+      <Filter>rules\dns</Filter>
     </ClInclude>
-    <ClInclude Include="rules\tunneldns\permitselected.h">
-      <Filter>rules\tunneldns</Filter>
-    </ClInclude>
-    <ClInclude Include="rules\ports.h">
-      <Filter>rules</Filter>
+    <ClInclude Include="rules\dns\permittunnel.h">
+      <Filter>rules\dns</Filter>
     </ClInclude>
   </ItemGroup>
   <ItemGroup>
@@ -134,12 +128,9 @@
     <Filter Include="rules\baseline">
       <UniqueIdentifier>{6f15853c-ccbb-49c0-98ec-add205bc5c2f}</UniqueIdentifier>
     </Filter>
-    <Filter Include="rules\nontunneldns">
+    <Filter Include="rules\dns">
       <UniqueIdentifier>{9b35e8a4-84be-4ac3-9b6f-eb21cc02e065}</UniqueIdentifier>
     </Filter>
-    <Filter Include="rules\tunneldns">
-      <UniqueIdentifier>{c574d27d-cede-4a3f-9c71-6e02793a25f6}</UniqueIdentifier>
-    </Filter>
   </ItemGroup>
   <ItemGroup>
     <None Include="winfw.def" />