henrypp/simplewall
Simplewall
Simplewall is an application firewall manager and network traffic filter that provides a graphical interface for the Windows Filtering Platform. It controls inbound and outbound network access for individual programs and services by intercepting and filtering traffic at the kernel level.
The project identifies specific binaries using file hashes to prevent spoofing and allows users to define custom firewall rules based on IP addresses, CIDR ranges, and port numbers. It includes a system for blocking operating system telemetry and managing blocklists of known malicious IP addresses.
The tool provides observability through packet logging and real-time notifications when applications attempt unauthorized connections. It also includes capabilities for auditing application changes, managing security profiles, and caching DNS resolutions to optimize event processing.
Features
- Network Access Control - Defines and enforces security policies to regulate inbound and outbound traffic for specific applications.
- Packet Filtering Engines - Utilizes the Windows Filtering Platform for kernel-level network traffic interception and filtering.
- Traffic Filtering Rules - Implements a system for defining and applying rules to permit or deny network connections.
- Traffic Filters - Inspects and controls network packets using global and application-specific rules to manage traffic flow.
- Background Security Services - Implements a background system service to apply firewall rules independently of the user interface.
- Binary Identity Verification - Identifies specific binaries using file hashes to prevent spoofing and ensure rules apply to the correct program.
- Windows Filtering Platform Interfaces - Provides a graphical interface for managing network traffic and application rules via the Windows Filtering Platform.
- Firewall Management - Controls inbound and outbound network access for individual programs based on file paths and hashes.
- Network Traffic Filters - Intercepts and blocks network requests to telemetry and malicious endpoints for security and privacy.
- Telemetry Blocking - Prevents operating system telemetry and analytics services from communicating with remote servers using built-in blocklists.
- Firewall Rule Configurations - Allows the creation of custom firewall rules based on IP addresses, CIDR ranges, and port numbers.
- IP Address Blocklists - Maintains and updates lists of malicious IP addresses to automatically filter unwanted network traffic.
- Blocked Connection Monitoring - Logs blocked network attempts and displays them for review and rule adjustment.
- Security Profiles - Allows saving and restoring sets of network rules as distinct security profiles.
- Dropped Packet Logging - Records dropped network packets and notifies users when applications attempt unauthorized connections.
- Firewall Configurations - Provides tools for managing host-based network access rules and security configurations.
- Network Security Auditing - Logs dropped packets and monitors blocked attempts to audit network security and refine rules.
- Network Traffic Logs - Records dropped and allowed packets to a file for historical analysis and troubleshooting.
- Packet Drop Logging - Provides a detailed log of network packets blocked by the firewall for troubleshooting and auditing.
