A developer built a transparent TCP proxy on Windows using Rust and WinDivert. The architecture was correct—using DNAT/SNAT redirection instead of packet forging—but it failed silently on Wi-Fi. The user-mode tool never captured outbound packets, even with correct filters and layers.
The culprit was a Wi-Fi driver fast-path. Intel's adapter constructs outbound TCP packets below the NDIS filter layer, making them invisible to user-mode tools. This isn't a bug; it's a hardware/firmware boundary that bypasses software interception entirely.
Ethernet drivers typically expose outbound packets through NDIS, allowing WinDivert to work. The fix was a $15 USB-to-Ethernet adapter, validating the proxy's architecture. For Wi-Fi interception, kernel-mode drivers like WFP are mandatory, as user-mode tools cannot cross this driver boundary.
Source: DEV Community · Summarized by HeadlinesBriefing