diff --git a/src/libcharon/plugins/kernel_wfp/kernel_wfp_compat.h b/src/libcharon/plugins/kernel_wfp/kernel_wfp_compat.h
index a553a0986..beda3d11b 100644
--- a/src/libcharon/plugins/kernel_wfp/kernel_wfp_compat.h
+++ b/src/libcharon/plugins/kernel_wfp/kernel_wfp_compat.h
@@ -108,49 +108,49 @@ enum {
 };
 
 /* missing in some MinGW versions */
-const GUID FWPM_CONDITION_IP_REMOTE_ADDRESS;
-const GUID FWPM_CONDITION_IP_LOCAL_ADDRESS;
-const GUID FWPM_CONDITION_IP_SOURCE_ADDRESS;
-const GUID FWPM_CONDITION_IP_DESTINATION_ADDRESS;
-const GUID FWPM_CONDITION_IP_LOCAL_PORT;
-const GUID FWPM_CONDITION_IP_REMOTE_PORT;
-const GUID FWPM_CONDITION_IP_PROTOCOL;
+extern const GUID FWPM_CONDITION_IP_REMOTE_ADDRESS;
+extern const GUID FWPM_CONDITION_IP_LOCAL_ADDRESS;
+extern const GUID FWPM_CONDITION_IP_SOURCE_ADDRESS;
+extern const GUID FWPM_CONDITION_IP_DESTINATION_ADDRESS;
+extern const GUID FWPM_CONDITION_IP_LOCAL_PORT;
+extern const GUID FWPM_CONDITION_IP_REMOTE_PORT;
+extern const GUID FWPM_CONDITION_IP_PROTOCOL;
 #ifndef FWPM_CONDITION_ICMP_TYPE
 # define FWPM_CONDITION_ICMP_TYPE FWPM_CONDITION_IP_LOCAL_PORT
 #endif
 #ifndef FWPM_CONDITION_ICMP_CODE
 # define FWPM_CONDITION_ICMP_CODE FWPM_CONDITION_IP_REMOTE_PORT
 #endif
-const GUID FWPM_LAYER_INBOUND_TRANSPORT_V4;
-const GUID FWPM_LAYER_INBOUND_TRANSPORT_V6;
-const GUID FWPM_LAYER_OUTBOUND_TRANSPORT_V4;
-const GUID FWPM_LAYER_OUTBOUND_TRANSPORT_V6;
-const GUID FWPM_LAYER_IPFORWARD_V4;
-const GUID FWPM_LAYER_IPFORWARD_V6;
-const GUID FWPM_LAYER_ALE_AUTH_CONNECT_V4;
-const GUID FWPM_LAYER_ALE_AUTH_CONNECT_V6;
-const GUID FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4;
-const GUID FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6;
-const GUID FWPM_SUBLAYER_IPSEC_TUNNEL;
-const GUID FWPM_SUBLAYER_IPSEC_FORWARD_OUTBOUND_TUNNEL;
-const GUID FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4;
-const GUID FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6;
-const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4;
-const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6;
-const GUID FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4;
-const GUID FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6;
-const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4;
-const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6;
-const GUID FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4;
-const GUID FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6;
-const GUID FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4;
-const GUID FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6;
-const GUID FWPM_CALLOUT_IPSEC_ALE_CONNECT_V4;
-const GUID FWPM_CALLOUT_IPSEC_ALE_CONNECT_V6;
-const GUID FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V4;
-const GUID FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V6;
-const GUID FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V4;
-const GUID FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V6;
+extern const GUID FWPM_LAYER_INBOUND_TRANSPORT_V4;
+extern const GUID FWPM_LAYER_INBOUND_TRANSPORT_V6;
+extern const GUID FWPM_LAYER_OUTBOUND_TRANSPORT_V4;
+extern const GUID FWPM_LAYER_OUTBOUND_TRANSPORT_V6;
+extern const GUID FWPM_LAYER_IPFORWARD_V4;
+extern const GUID FWPM_LAYER_IPFORWARD_V6;
+extern const GUID FWPM_LAYER_ALE_AUTH_CONNECT_V4;
+extern const GUID FWPM_LAYER_ALE_AUTH_CONNECT_V6;
+extern const GUID FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V4;
+extern const GUID FWPM_LAYER_ALE_AUTH_RECV_ACCEPT_V6;
+extern const GUID FWPM_SUBLAYER_IPSEC_TUNNEL;
+extern const GUID FWPM_SUBLAYER_IPSEC_FORWARD_OUTBOUND_TUNNEL;
+extern const GUID FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V4;
+extern const GUID FWPM_CALLOUT_IPSEC_INBOUND_TRANSPORT_V6;
+extern const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V4;
+extern const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TRANSPORT_V6;
+extern const GUID FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V4;
+extern const GUID FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_V6;
+extern const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V4;
+extern const GUID FWPM_CALLOUT_IPSEC_OUTBOUND_TUNNEL_V6;
+extern const GUID FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V4;
+extern const GUID FWPM_CALLOUT_IPSEC_FORWARD_INBOUND_TUNNEL_V6;
+extern const GUID FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V4;
+extern const GUID FWPM_CALLOUT_IPSEC_FORWARD_OUTBOUND_TUNNEL_V6;
+extern const GUID FWPM_CALLOUT_IPSEC_ALE_CONNECT_V4;
+extern const GUID FWPM_CALLOUT_IPSEC_ALE_CONNECT_V6;
+extern const GUID FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V4;
+extern const GUID FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT_V6;
+extern const GUID FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V4;
+extern const GUID FWPM_CALLOUT_IPSEC_INBOUND_INITIATE_SECURE_V6;
 
 /* integrity config, missing in some MinGW versions */
 #ifndef IPSEC_AUTH_CONFIG_HMAC_MD5_96