MakeUseOf published a detailed walkthrough on July 13, 2026, of simplewall, a free, open‑source tool that replaces Windows’ rule‑centric outbound firewall management with an application‑first interface. The tool, developed by Henry++, is now at version 3.8.7 (released August 8, 2025) and uses the Windows Filtering Platform to create its own network filters, independent of Microsoft Defender Firewall.
A firewall built around applications, not rules
simplewall doesn’t touch the Defender Firewall rule set. It taps into the Windows Filtering Platform (WFP)—the same kernel‑level framework that Microsoft’s own firewall and many security products use—to insert its own allow/block decisions. The tool requires administrator rights to deploy these system‑level filters and is available as both an installer and a portable build from its official GitHub repository.
The main window is compact and organized around tabs: Apps, Services, UWP apps, System rules, User rules, Connections, Blocklist, and Packets log. The central concept is a default‑deny outbound policy: when you enable filtering, any executable not explicitly checked in the Apps list is blocked from making outbound connections. The tool itself does not need internet access to enforce these rules, so you can even clear its own entry once filters are active.
The Connections tab provides real‑time insight into every active network session—local and remote addresses, ports, protocols, and state—allowing you to trace an unfamiliar connection back to its process instantly. Right‑clicking a connection lets you create a custom rule directly from that context, specifying action, direction, protocol, addresses, and ports without ever opening a separate rule wizard.
The practical impact: Control comes with homework
simplewall’s default‑deny approach reverses the typical Windows outbound model. By default, Windows allows all outbound traffic unless a blocking rule exists. With simplewall’s allow‑list configuration, only programs you approve can reach the internet. That gives you clear oversight, but it also means that the first hours after activation can be disruptive.
For home users, blocking Windows Update, the Microsoft Store, DNS, DHCP, or time synchronization can lead to head‑scratching failures that don’t obviously point to the firewall. Applications that rely on svchost.exe‑hosted services—such as some VPNs and cloud‑sync clients—may stop working without a rule for the service itself, not just the desktop app. The tool’s documentation itself warns that it is intended for advanced users, and this is not a set‑and‑forget solution for a family PC.
For power users and IT professionals, however, simplewall provides a long‑missing control surface. The ability to see exactly what’s connecting, drill into the process, and create a granular rule in three clicks transforms outbound management from a multi‑step administrative chore into a quick investigative step. Temporary filtering mode (filters vanish after a reboot) is a safe way to test without committing to permanent changes.
For administrators managing kiosks, lab machines, or other tightly controlled environments, simplewall can serve as a lightweight layer of outbound enforcement, provided it is tested against all required Windows services and third‑party software. Because its filters are independent of Defender Firewall, the two can coexist, though overlapping rules can become confusing.
Why Windows' own firewall makes outbound control so difficult
Microsoft Defender Firewall with Advanced Security is a powerful tool, but it was built for rule‑centric administration. Creating an outbound block for a single application requires navigating through wizard pages for program path, direction, protocol, profiles, ports, and addresses. That design works well for enterprise policies pushed through Group Policy or Intune, but it is overkill for a user who simply wants to know, “Should this program be online?”
Microsoft defaults to allowing outbound traffic because a default‑deny stance would break too many consumer and business scenarios out of the box. The company’s documentation explicitly states that the firewall is designed to block inbound traffic by default while permitting outbound, a philosophy that prioritizes compatibility over per‑app privacy.
Third‑party firewall tools have long filled this gap, but many of them hook into the network stack at a different level or attempt to replace Defender Firewall entirely. simplewall’s use of WFP keeps it lightweight and compatible with other WFP‑based filters, including those from VPN clients and antivirus software.
How to start using simplewall without breaking everything
If you want to try simplewall, approach it methodically. The payoff is genuine per‑app control, but the initial configuration demands patience.
- Download from the official source. Get the installer or portable build from the GitHub releases page (version 3.8.7). Avoid third‑party download sites.
- Start with temporary filters. When you first click Enable filters, choose the temporary option. This ensures all simplewall filters are removed after a reboot if something critical is blocked.
- Leave Defender Firewall enabled unless you have a reason to disable it. simplewall can function alongside Microsoft’s firewall. Disabling Defender Firewall removes one potential source of overlapping rules, but it’s not required, and Microsoft recommends keeping it on for its additional protections.
- Test a known application. With filtering active, open a browser that you left unchecked in the Apps list. It should fail to load. Then check the browser in simplewall and reload; the connection should work. This confirms filtering is active.
- Watch the Connections tab. As you use your PC, keep the Connections tab open. When you see an unfamiliar process or connection, right‑click to create a rule immediately or jump to the executable’s folder for investigation.
- Allow essential system services first. Before you lock down everything, explicitly allow Windows Update, DNS, DHCP, time synchronization, and other system‑level rules via the System rules tab. For services running under svchost.exe, use the Services tab to identify and allow the specific service, not necessarily the entire host process.
- Use the Blocklist sparingly. The included blocklist categories (telemetry, updates, Microsoft apps) can be toggled on, but do not treat them as a substitute for malware detection or thorough network analysis. An IP blocklist cannot by itself prove that a connection is malicious.
- Switch to permanent filters only after you’re confident. Once your essential applications and services are working, you can re‑enable filtering in permanent mode.
Before you uninstall: A critical filter cleanup
simplewall’s filters do not disappear when you close the application. They remain active in the WFP engine and can persist even after uninstalling the tool. The official documentation strongly advises you to disable filters inside simplewall before removing it. If you forget, residual filters can continue to block traffic with no obvious indication that simplewall is still enforcing them.
If you used temporary filters, a reboot removes them. For permanent filters, open simplewall, disable filtering, then proceed with the standard uninstaller. The GitHub project includes an uninstall mechanism that cleans up its own filters, but manually disabling first is the safest path.
Outlook: Will Microsoft ever learn from simplewall?
Microsoft has shown little interest in overhauling the Defender Firewall interface for home users, even as Windows 11’s design language has modernized other system utilities. The existence of WFP means the technical underpinnings for an app‑centric outbound control panel are already there; what’s missing is the user interface.
For now, simplewall remains a niche but valuable tool for those who want to see and control every outbound connection. The project is actively maintained on GitHub, and while version 3.8.7 is the current stable release, future updates may refine the user experience further. If you have ever wished Windows gave you a straightforward way to decide which programs can talk to the internet, simplewall is worth a careful test—just be ready to do the homework that real control demands.