Windows Firewall is strict about incoming connections and relaxed about outgoing ones, so admins who want to control what leaves a PC reach for a second tool. Two free, open-source ones come up in almost every search: SimpleWall and TinyWall. Both block outbound traffic by default, both are tiny, and they are built on completely different ideas. This comparison is based on the vendor and GitHub pages as checked on 20 October 2026, not on our own testing.
The short answer
Choose SimpleWall if you want to see every new connection attempt, write rules by address, port and protocol, and control services and Store apps one by one. Choose TinyWall if you want a firewall that stays quiet: you allow programs from a list or by clicking their window, and it protects the Windows Firewall settings from tampering. For a lab PC or a privacy-focused workstation, SimpleWall gives more control. For a machine used by someone who is not an administrator, TinyWall is easier to live with.
SimpleWall and TinyWall compared
| Feature | SimpleWall | TinyWall |
|---|---|---|
| Licence | Free, open source (GPL v3) | Free, open source (GPL v3); vendor page: no ads, no artificial limitations |
| Current version | 3.8.7 stable (August 2025); 3.9 and 3.9.1 are pre-releases (July 2026) | 3.5 (7 June 2026) |
| Windows support | 7 SP1, 8, 8.1, 10, 11; 64-bit and ARM64 | Not listed on the vendor page; 3.5 added ARM support |
| How it filters | Writes its own Windows Filtering Platform filters; does not manage Windows Firewall | Blocks any application you have not explicitly allowed; no kernel drivers or components |
| Default behaviour | Outbound blocked once filtering is enabled | Unlisted applications blocked |
| Prompts | Notification with Allow / Block on first attempt | No intrusive pop-ups by design |
| Rules | Per app, plus custom rules by address, port, protocol; IPv4 and IPv6 | Per application; temporary rules |
| Services, Store apps, WSL | All supported | UWP supported |
| Telemetry blocklists | Built in | Blocklists |
| Tamper protection | No | Yes |
| Portable mode | Yes (empty simplewall.ini) | Not stated |
SimpleWall: more control, more setup
SimpleWall is a small program that talks to the Windows Filtering Platform directly and leaves Windows Firewall untouched, so inbound protection keeps working in parallel. Its GitHub README describes it as “definitely for advanced users”, and that is fair. Once filtering is on, nothing goes out until you allow it, and a first-run enable without preparation will break the browser, Windows Update or the VPN client within minutes.
What you get in return is a lot of visibility: services and Store apps listed separately, WSL traffic, custom rules, timers that allow a program for a limited time, logs of dropped and allowed packets, and blocklists for Windows telemetry. Version 3.9.1 adds network speed statistics, but it is still marked as a pre-release on GitHub, so most deployments stay on 3.8.7. One thing to know before you uninstall: filters stay active after the application is closed or removed until you press “Disable filters”. The SimpleWall page has a safe first-setup order.
TinyWall: quiet by design
TinyWall sits in the system tray and blocks network access for applications you have not explicitly allowed. The vendor lists simple configuration, a very small footprint, tampering protection, blocklists, temporary firewall rules, UWP support and boot-time filtering. It installs no drivers or kernel components, which the vendor presents as a stability advantage, and it collects no data and has no telemetry. Version 3.5 (June 2026) added ARM devices and a dark mode interface. The source is on GitHub under GPL v3.
The trade-off is that you see less. There are no per-connection prompts and no custom address-and-port rule editor comparable to SimpleWall’s. Treat it as an allow-list for programs, not a rules engine.
Other free options
Comodo Firewall is free, including for business use, and adds sandboxing, but its last release announcement is from December 2024 and the vendor’s stated requirements stop at Windows 10. If you mainly want to watch traffic instead of blocking it, see GlassWire and our GlassWire alternatives comparison.
How to choose
- You want to see and decide each new connection. SimpleWall.
- You want custom rules by address, port or protocol. SimpleWall.
- You need to block Windows telemetry endpoints. SimpleWall has built-in lists; check that you do not block Windows Update by accident.
- The PC belongs to a non-technical user. TinyWall: no prompts, and tamper protection.
- You manage dozens of PCs. Neither has a central console. Use Windows Firewall rules through Group Policy and keep these tools for individual machines.
Neither program has been tested by us yet: we have not installed them. Check both on a test machine, with your VPN and remote-support tools running, before rolling out. For the wider picture, see our guide to free firewall software for Windows, and for licence questions free IT tools safe for commercial use.
FAQ
SimpleWall vs TinyWall: which is better?
Neither is better for every case. SimpleWall offers more control and visibility; TinyWall is quieter and simpler. Both block outbound traffic by default and are free and open source.
Is SimpleWall safe?
It is open source under GPL v3 and its code and releases are public on GitHub. Download it only from the GitHub repository of the author, henrypp. As with any firewall, wrong rules can cut off network access, so test before deploying.
Is SimpleWall open source?
Yes. The project describes itself as free and open source and uses the GPL v3 licence.
Is TinyWall free?
Yes. The vendor describes it as 100% free with no ads and no artificial limitations, and the source is under GPL v3. Check your own company policy on open-source software before deploying it.
What is a good SimpleWall alternative?
TinyWall is the closest free one on Windows. Comodo Firewall is another free option, but the vendor lists support only up to Windows 10 and the latest announcement is from December 2024.
Can I run SimpleWall and TinyWall together?
We do not recommend it: two tools that both block outbound traffic make it hard to tell which one caused a failure. Pick one per machine.
