I wanted one simple thing from Windows Firewall: an application-first view of which programs I had allowed online. Windows instead pushed me toward Windows Firewall with Advanced Security, a Microsoft Management Console snap-in filled with profiles, protocols, ports, addresses, and enough terminology to turn a basic outbound decision into administrative paperwork.

That machinery is powerful, but it is a poor starting point for my question, which is simply whether an app should be allowed online. That is why simplewall caught my attention. It isn’t just a prettier front end for Microsoft Defender Firewall (Windows’ Firewall official name, if you didn’t know!).

Instead, it creates separate filters through Windows Filtering Platform, the low-level Windows framework used by Microsoft and third-party tools to inspect and control network traffic. simplewall then organizes those filters around recognizable applications.

The green shield comes with paperwork

One click, several consequences

I downloaded simplewall from Henry++’s official GitHub page. Version 3.8.7, released on August 8, 2025, is the latest release at the time of writing. The free, open-source project offers installer and portable builds and requires administrator privileges because it installs system-level network filters.

The compact main window has several tabs and an unapologetically large Enable filters button. Clicking it warned that the current configuration would deny network access, then asked whether I wanted permanent or temporary filtering.

Permanent filters remain active until I disable them. Temporary filters disappear after a restart, making that the safer option for my first test. The activation dialog also had Disable Windows Firewall checked, and I left it that way to isolate simplewall during testing. simplewall doesn’t require this, and its documentation says the two systems can work independently alongside each other. Disabling Windows Defender Firewall removed it as one possible source of overlapping rules, although VPN clients, security software, and other WFP filtering providers could still have affected traffic.

With the default allowlist configuration I tested, unchecked apps were blocked once filtering began. The Apps tab divided programs into Apps with internet access and Apps without internet access. simplewall itself was checked, while Chrome, Slack, CrossDeviceService, Explorer, and several Windows processes weren’t. I later cleared simplewall’s entry because its installed filters continue to work even when the application has no internet access, though features such as update checks may stop working.

To test the behavior, I enabled temporary filtering and opened a webpage in Chrome while leaving it unchecked. The page failed to load. I returned to simplewall, checked Chrome, refreshed the page, and the connection worked again.

That sequence explained the appeal. I was deciding whether Chrome could connect, not walking through Windows Firewall with Advanced Security to define an executable path, direction, protocol, profile, ports, and scope.

Windows normally allows outbound traffic unless a blocking rule says otherwise. simplewall’s default allowlist configuration reverses that mental model: I approve the programs I trust, while everything else waits outside.

The executable gets top billing

Start with the culprit, then narrow the rule

The main window also includes tabs for Services, UWP apps, System rules, User rules, Connections, Blocklist, and Packets log. Together, those tabs answered two questions: what was communicating and how precisely I wanted to control it.

The Connections tab was the best starting point. It listed executables beside local and remote addresses, ports, protocols, and connection states. Right-clicking a connection lets me jump to the executable in the app list, open its folder, create a rule, or close the connection. Closing it only ended that session, so the program could reconnect unless I created a lasting rule. Choosing Create rule opened an editor where I could set the action, direction, protocol, addresses, and ports, then associate the rule with a specific app.

That made for a useful contrast with Microsoft’s native console. Microsoft’s firewall supports those controls, but its custom outbound wizard expects me to assemble them across several pages. simplewall let me begin with the process I had just seen communicating and add detail only when necessary.

Services and UWP apps received separate lists because allowing a desktop program might not be enough if it relied on a helper process or Windows service. For example, an instance of svchost.exe can host one or more Windows services, so an unfamiliar connection is not always easy to identify from the executable name alone. It is one of those essential Windows processes that can be legitimate while still requiring context before you decide what it should be allowed to do online.

System rules covered dependencies such as DNS, DHCP, Windows Update, time synchronization, file sharing, and Windows’ network status checks — the mechanism Windows uses to determine whether the computer appears to have internet access.

There was also a Blocklist with categories for Microsoft telemetry, updates, and applications. I would treat it as an optional set of rules, not a privacy verdict. simplewall’s lists use labels such as “spy” for some telemetry-related destinations, but those labels don’t prove what every individual connection contains. An IP blocklist also cannot replace malware detection or behavioral analysis.

If you want to go deeper than simplewall’s log view, Windows 11 even has a built-in packet analyzer, although simplewall’s value is that it keeps the everyday decision anchored to the app rather than asking you to live inside packet captures.

This much control still expects homework

The price of control is knowing what svchost.exe does

simplewall’s documentation calls it software for advanced users, and the warning is fair. A default-deny setup gives me meaningful control, but the first pass can interrupt more than expected. Store apps, cloud-sync clients, VPN software, Windows Update, and even Windows’ network-status detection may stop working until the correct app, service, or system rule is allowed.

It makes it easier to express decisions, but it cannot make them for me. A process name may be obvious, or it may be one of several services running through svchost.exe. Blocking first and investigating later can lead to failures that don’t immediately appear to be networking problems.

simplewall’s filters can remain active alongside Microsoft Defender Firewall, although I didn’t test that configuration because I left Disable Windows Firewall checked during activation. simplewall doesn’t edit Defender Firewall rules or appear in Windows Security as a replacement interface. When both systems are enabled, a connection allowed by simplewall could still be blocked by a Defender Firewall rule or another filtering provider.

Its filters can also continue working after simplewall is closed. Uninstalling the program doesn’t automatically remove its installed filters, so I would use Disable filters before removing it. Temporary filters should disappear after the next restart, but permanent filters remain until they are explicitly disabled.

OS

Windows

Developer

henrypp

Price model

Free

simplewall is a lightweight firewall that gives you fine-grained control over which Windows applications can access the internet. Built on the Windows Filtering Platform, it blocks unwanted network connections without replacing the built-in Windows Firewall.

This is the firewall workflow I expected Windows to have

I am keeping simplewall because it gives network control a clearer starting point: the application making the connection. It isn’t the program I would hand to someone unwilling to investigate why an unfamiliar process or Windows feature has stopped connecting. Still, it works well for anyone willing to maintain an allowlist and investigate the occasional dependency.

Microsoft already built the filtering foundation into Windows. simplewall uses it to provide the compact, application-first control panel Microsoft never did.