# PacketHound (Firewall) PacketHound is a free outbound [[Firewall]] for Windows 10 and 11 (x64 and ARM64). The first time an app tries to reach the internet, it asks you: Allow or Block? Then it remembers your answer. Why does that matter? Windows Firewall cares about incoming connections. By default, any program on your machine can phone home, and you never know it. PacketHound flips that: outgoing traffic is blocked by default, and you decide app by app. ## How it works The design is what I like most. There's NO kernel driver and NO background service of its own. PacketHound sits on top of the built-in Windows Firewall: - It switches Windows Firewall to block outgoing traffic by default - Every decision you make becomes an ordinary Windows Firewall rule, visible in `wf.msc`. The rules keep working when PacketHound is closed, or even uninstalled (it asks whether to delete them) - It watches the Windows Security event log for blocked attempts, and shows the prompt from there - Windows components are allowed quietly, but only if they're in a Windows folder, owned by the system AND signed by Microsoft. Risky built-in tools (PowerShell, curl, certutil, mshta, rundll32) still get a prompt, since malware likes to abuse them There's a catch that comes with this design: Windows Firewall rules match IP addresses, not names. So when you allow a domain, PacketHound adds its addresses as the app uses them, and apps on shared addresses (CDNs) share the rule. Also, the first attempt of a new app fails, so the app has to retry after you allow it (refresh your browser, for instance). ## Features - Decisions per app or per IP, host or domain, for ever, for an hour, for the rest of the day, or until the app quits - Rules list with one-click Allow/Block switches, search, sorting, and cleanup of rules for uninstalled programs - Activity log of blocked attempts (hostname, port, result), kept across restarts - Prompts that don't steal keyboard focus - Quiet mode: block new apps silently for 30 minutes to 3 hours, and get asked afterwards - Timed pause (5 to 60 minutes): apps without rules can connect, Block rules still apply - Installer and update handling: a 5-minute pause for installers that give up after a block, and earlier decisions carried over when an update only changes the version folder It's free (no trial, no account, no ads), [[Open Source]] under the [[GNU General Public License (GPL)|GPL v3]], and collects no data. The only network calls it makes itself are DNS lookups (to show hostnames instead of IPs) and a weekly update check that you can turn off. The site doesn't name the developer. It needs admin rights, and it won't work if a third-party security suite replaces Windows Firewall. Group Policy wins on managed machines. ## Compared to Simplewall [[Simplewall (Firewall)]] solves the same problem (default-deny for outgoing traffic, per app) in a different way: it talks to the Windows Filtering Platform directly, so its rules live in its own engine, next to Windows Firewall. PacketHound stays inside Windows Firewall, so you can inspect and keep every rule with the standard Windows tools. Simplewall is tiny (under 1 MB) and has a built-in blocklist for Windows telemetry; PacketHound is a 68 MB download, but its prompts are friendlier and it knows about installers, updates and "living off the land" binaries. If you want something you can audit without trusting a third-party filter engine, PacketHound's approach is easier to reason about. ## References - [PacketHound](https://packethound.app/) - [Source code](https://github.com/packethound-app/packethound.app) ## Related - [[Firewall]] - [[Simplewall (Firewall)]] - [[Fort (Firewall)]] - [[OpenSnitch]]