Windows has a capable firewall built in. The problem is not the engine — it is that the built-in interface makes it hard to see what is actually allowed, and harder still to decide about a new connection while it is happening. That is the gap free firewall tools fill.
What is available free, and what it really gives you
| Tool | Approach | Honest status |
|---|---|---|
| SimpleWall | A clean front end to the Windows Filtering Platform, with per-application rules | Free, open source, actively maintained |
| Comodo Firewall Free | A full firewall suite with HIPS and sandboxing | Free; last release December 2024 and no stated Windows 11 support |
| GlassWire Lite | Visibility only — which application talks to which host | Free tier has no blocking; last build 2022 |
| NetLimiter | Per-application blocking plus bandwidth limits and quotas | Conditionally free |
The straightforward choice: SimpleWall
SimpleWall does one thing well. It sits on the Windows Filtering Platform — the same layer the built-in firewall uses — and gives you a readable list of applications with allow and block decisions, plus notifications when something new tries to connect.
Because it uses WFP rather than installing its own network driver stack, it is light and it does not fight with Windows. It is open source, it is still updated, and it does not try to sell you an upgrade. For a workstation where you want outbound control and visibility, it is the first thing to try.
What it is not: a managed, policy-driven firewall for a fleet. Rules live on the machine. There is no central console.
Comodo Firewall Free: capable, but check the date
Comodo bundles a firewall with HIPS and an auto-sandbox for unknown programs, which is more defence in depth than a rule list alone. It is genuinely free.
The caveat is maintenance. The last release is from December 2024, and the vendor does not state Windows 11 support. A firewall is kernel-level software: running an unmaintained one on a platform it was never certified for is a real risk, not a theoretical one. If you are on Windows 10 and want the extra layers, it is defensible. On Windows 11, prefer SimpleWall.
Seeing before blocking
Writing firewall rules without knowing current traffic produces either a policy that blocks work or one that allows everything. Spend a week watching first.
GlassWire Lite shows traffic per application and per remote host with history. Be clear about the limitation: the free tier monitors, it does not block. Use it to build the picture, then implement the decisions in SimpleWall or the Windows firewall.
Blocking and shaping together
NetLimiter blocks connections per application and also caps bandwidth and sets quotas. That combination is useful when the real requirement is “this may run, but not at full speed during the day” rather than a flat allow or deny. It is conditionally free.
Building an outbound policy that holds
- Observe for a week. GlassWire Lite, no rules yet. Note which applications legitimately reach the internet and where they go.
- Write down the allow list. Browser, mail client, update services, backup agent, remote support agent, line-of-business applications. Anything you cannot explain is a question, not an exception.
- Block by default, allow the list. SimpleWall makes this practical; the built-in Windows firewall can do it too, with more clicking.
- Expect a week of noise. Something legitimate will be blocked. Keep notifications on so you can see and fix it quickly.
- Record why each rule exists. A rule with no recorded reason survives forever because nobody dares delete it.
- Review quarterly. Remove rules for software that is no longer installed.
Log what the firewall decides
A blocked connection is a signal. Windows Filtering Platform events land in the Windows event log, and collecting them centrally turns scattered noise into something you can search when an incident starts.
- EventSentry Light — collects Windows event logs from your servers and alerts on rules.
- Graylog — a full log platform when you need search and correlation across many hosts.
- LogExpert — for reading large exported logs quickly, without a server.
Where a host firewall is the wrong tool
Per-machine firewalls protect a machine. They do not segment a network, they cannot be audited centrally, and a user with local administrator rights can turn them off. If you need enforced segmentation, central policy or evidence for an auditor, that belongs on the network — a managed firewall or Group Policy-driven Windows Firewall rules — not on individually configured desktops.
FAQ
Is there a good free firewall for Windows 11?
SimpleWall. It is open source, actively maintained and built on the Windows Filtering Platform.
Is Comodo Firewall still safe to use?
It is free and functional, but the last release is from December 2024 with no stated Windows 11 support. On Windows 11, choose something maintained.
Can GlassWire Lite block connections?
No. The free tier is monitoring only; blocking is a paid feature.
Do I need a third-party firewall at all?
The built-in Windows firewall is a good engine. Third-party tools mainly add convenience: readable per-application rules and prompts for new outbound connections.
How do I limit a program instead of blocking it?
NetLimiter sets per-application speed limits and transfer quotas, which is often a better fit than a flat block.
