The built-in Windows Firewall is good at blocking incoming connections and rather relaxed about outgoing ones. By default almost every program on your PC may talk to the internet, and you rarely see who is calling home. SimpleWall flips that logic: nothing goes out until you allow it. It is a small, free, open-source tool by Henry++ that manages the Windows Filtering Platform (WFP) directly — the same low-level engine Windows Firewall itself is built on.
The author’s own description is honest: “definitely for advanced users”. Used carefully, it is one of the most effective ways to see and control outbound traffic on a Windows workstation.
SimpleWall at a glance
| Stable version | 3.8.7 (August 2025) |
|---|---|
| Preview versions | 3.9 and 3.9.1 (July 2026), published as pre-releases |
| Licence | Free, open source (GPL v3) |
| Supported Windows | 7 SP1, 8, 8.1, 10, 11 — 64-bit and ARM64 |
| Size | Under 1 MB |
| Rights needed | Administrator |
| Integrity | Binaries are signed with the author’s GPG key |
How it differs from Windows Firewall
SimpleWall is not a nicer interface for Windows Firewall and does not touch its rules. It creates its own WFP filters. In practice that means:
- Outbound traffic is blocked by default once filtering is enabled. Each program must be allowed explicitly.
- A notification appears the first time a blocked program tries to connect, with Allow / Block buttons. No constant pop-ups after you decide.
- Windows Firewall keeps working in parallel, so you do not lose inbound protection.
What you can control
- Classic desktop programs, Windows services and Microsoft Store apps, each as a separate entry.
- WSL (Windows Subsystem for Linux) traffic.
- Custom rules by address, port and protocol, including IPv6. Since 3.9 a rule can hold up to 1024 characters.
- Built-in blocklists for Windows telemetry and update endpoints, based on the WindowsSpyBlocker project. Each list can be set to block, allow or ignore.
- Timers: allow a program for 5 minutes or an hour, after which it is blocked again automatically.
- Logs of dropped packets (Windows 7+) and allowed packets (Windows 8+), with optional writing to a file.
- Network statistics with connection speed, added in 3.9.1.
Download and install
- Click the Download button at the top of this page and unpack the archive.
- Run the installer, or use the portable build: create an empty file named
simplewall.iniin the program folder, and all settings will be stored there instead of%APPDATA%. - Start SimpleWall as administrator. It opens with filtering off, so nothing is blocked yet.
Safe first setup
Most people who give up on SimpleWall do so in the first ten minutes, because they enable filtering and the browser, Windows Update and the VPN client all stop working at once. A calmer order:
- Before enabling filtering, open the Apps list and tick the programs you know you need: browser, mail client, VPN, remote support tool, your antivirus.
- Check the Services tab. At minimum DNS client (
dnscache), time sync (w32time) and the update services you rely on should be allowed, otherwise name resolution or updates will fail. - Choose what to do with the telemetry blocklists. Blocking update endpoints can stop Windows Update; many admins block telemetry but allow updates.
- Enable filtering. For the next day, answer the notifications as they appear. After that the rule set is usually stable.
- Export the profile (
profile.xml) once you are happy. You can copy it to other PCs with a similar setup.
Where it fits, and where it does not
Good use cases:
- A privacy-conscious workstation where you want to know every program that goes online
- Kiosk PCs, lab machines or VMs that should reach only a few addresses
- Checking what a new piece of software actually connects to before trusting it
Not a good fit:
- Central management of many PCs. There is no console or group policy integration; use Windows Firewall with GPO or an endpoint product.
- Users who are not comfortable reading notifications about processes and ports.
- Inbound protection on servers — that stays the job of Windows Firewall.
Common problems and fixes
| Problem | What to do |
|---|---|
| No internet at all after enabling filtering | Click Disable filtering, then allow the browser and the DNS client service before enabling it again. |
| Windows Update fails | Allow the update-related services, and set the update blocklist to “allow” instead of “block”. |
| The same notification keeps coming back | A known bug fixed in 3.9.1 (pre-release); on 3.8.7 create an explicit rule for the program. |
| Settings lost after moving the folder | Use portable mode (simplewall.ini in the program folder) or copy the profile from %APPDATA%Henry++simplewall. |
| Planning to uninstall | Turn filtering off first, then uninstall, so no SimpleWall filters remain active. |
SimpleWall vs. alternatives
| Tool | Compared to SimpleWall |
|---|---|
| Windows Firewall with Advanced Security | Can block outbound too, but every rule is manual and there are no prompts when a new program connects |
| TinyWall | Also free and built for outbound control, but it manages the built-in Windows Firewall and deliberately shows no pop-ups — you allow programs by picking them, not by answering prompts |
| GlassWire | Strong on traffic graphs and history; free edition has limited firewall features |
| Comodo Firewall | Full security suite with HIPS; heavier and more intrusive |
| Portmaster | Modern interface and per-app DNS filtering; larger install and its own driver |
SimpleWall vs. TinyWall
These two are the tools people compare most often, and both are free. The difference is in how you work with them day to day.
| Feature | SimpleWall | TinyWall |
|---|---|---|
| How it filters | Talks to the Windows Filtering Platform directly | Manages rules of the built-in Windows Firewall |
| New program tries to connect | Can show a notification so you decide on the spot | No pop-ups by design; the program stays blocked until you allow it |
| Allowing a program | Tick it in the list or answer the notification | Pick the process or window, or use a hotkey |
| Portable use | Yes | Installed as a service |
| Best for | People who want to see and decide about every outbound connection | People who want a quiet, set-and-forget firewall |
If you like to know what is calling home, choose SimpleWall. If prompts annoy you and you would rather allow programs once and forget, TinyWall is the calmer option.
FAQ
Is SimpleWall free?
Yes, it is free and open source under GPL v3.
Does SimpleWall replace Windows Firewall?
No. It works alongside it. Windows Firewall keeps handling inbound rules; SimpleWall adds strict control of outbound connections through WFP.
Which version should I use?
3.8.7 is the latest stable release. 3.9 and 3.9.1 add network statistics and bug fixes but are still marked as pre-releases.
Does it work on Windows 11 ARM laptops?
Yes, ARM64 builds are provided.
Can it block Windows telemetry?
Yes, with the built-in blocklists. Check Windows Update afterwards, because some endpoints are shared.
Is there a portable version?
Yes. Put a simplewall.ini file in the program folder and all settings will stay there.
SimpleWall or TinyWall — which is better?
Neither is better in general. SimpleWall suits people who want to see and approve outbound connections; TinyWall suits people who want no prompts at all. Both are free.
Where do I get the official SimpleWall download, and how do I check it?
SimpleWall is developed by Henry++ in the open-source repository henrypp/simplewall on GitHub. Whatever build you use, compare the version number with the latest stable release (3.8.7) and check that the binary carries the author’s GPG signature before you run it as administrator. The Download button at the top of this page is the quickest start.
What is new in SimpleWall 3.9 and 3.9.1?
Versions 3.9 and 3.9.1 (July 2026) add network statistics and bug fixes, and a custom rule can now hold up to 1024 characters. Both are published as pre-releases, so for a production PC the stable 3.8.7 is the safer choice.
