Commenters debate the utility of application firewalls like Simplewall and Windows Firewall Control, highlighting trade-offs between granular control and the annoyance of alert fatigue or update-related disruptions. Simultaneously, there is significant criticism directed at the new tool's marketing copy as AI-generated slop and skepticism regarding its development process.
60 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4henrypp
simplewall
C2017–2025
henrypp / simplewall
simplewall
Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.
28Distinct people
31Mentions
1Explicit recommenders
9.3KGitHub stars
What to know before exploring
What it is
Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
If you are looking for a simple and light firewall (but still better than Windows Firewall), I recommend using Simplewall. It does not require a kernel extension and works with…
alibert used a recommendation phrase. One indexed comment matches. This is a phrase match, not a verdict.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- evilsocket/opensnitch · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 12:54:37 PM UTC.
Mentions over time
HN mentions by year31 dated mentions
Observed mentions: 2017-12-08 19:33:30 UTC to 2025-12-23 09:32:54 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 4 | 2 | 2 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 4 | 1 | 3 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 8 | 0 | 8 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 6 | 1 | 5 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
simplewall
Definitely for advanced users.
Description:
Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.
The lightweight application is less than a megabyte, and it is compatible with Windows 7 SP1 and higher operating systems.
You can download either the installer or portable version. For correct working you are require administrator rights.
Nota bene:
Keep in mind, simplewall is not a control UI over Windows Firewall, and does not interact in any level with Windows Firewall. It works
over Windows Filtering Platform (WFP) which is a set of internal API and system services that provide a platform for creating network filtering
applications. Windows Filtering Platform is a development technology and not a firewall itself, but simplewall is the tool that uses this technology.
Features:
Simple interface without annoying pop ups
Rules editor (create your own rules)
Internal blocklist (block Windows spy / telemetry)
Dropped packets information with notification and logging to a file feature (win7+)
Allowed packets information with logging to a file feature (win8+)
Windows Subsystem for Linux (WSL) support
Windows Store support (win8+)
Windows services support
Free and open source
Localization support
IPv6 support
To activate portable mode, create "simplewall.ini" in application folder, or move it from "%APPDATA%\Henry++\simplewall".
System requirements:
Windows 7, 8, 8.1, 10, 11 64-bit/ARM64
An SSE2-capable CPU
KB2533623 KB3063858 update for Windows 7 was required
Donate:
Bitcoin (BTC)
Ethereum (ETH)
Yandex Money (RUB)
Paypal (USD)
GPG Signature:
Binaries have GPG signature simplewall.exe.sig in application folder.
Public key: pubkey.asc (pgpkeys.eu)
Key ID: 0x5635B5FD
Fingerprint: D985 2361 1524 AB29 BE73 30AC 2881 20A7 5635 B5FD
Reviews of idiots:
Look at them, he does not know about .gitmodules and how to use, lol.
PS: Without idiots we are not to be fun, yeah!
Installation:
When install rules, you can choose two modes:
Permanent rules - rules are working until you disable it manually.
Temporary rules - rules are reset after the next reboot.
Uninstall:
When you uninstall simplewall, all previously configured filters stay alive in system.
To remove all filters created by simplewall, start simplewall and press "Disable filters" button.
Command line:
-install - enable filtering.
-install -temp - enable filtering until next reboot.
-install -silent - enable filtering without prompt.
-uninstall - remove all installed filters.
Rules editor:
simplewall have two types of custom user rules rules:
Global rules: rule applied for all applications.
Special rules: rule applied only for specified applications.
Rule syntax format:
To set rule applications, open rule and then navigate to "Apps" tab.
Rule syntax format:
IP addresses 192.168.0.1; 192.168.0.1; [fc00::]
IP addresses with port 192.168.0.1:80; 192.168.0.1:443; [fc00::]:443;
IP ranges 192.168.0.1-192.168.0.255; 192.168.0.1-192.168.0.255;
IP ranges (with port) 192.168.0.1-192.168.0.255:80; 192.168.0.1-192.168.0.255:443; (v2.0.20+)
IP with prefix lengths (CIDR) 192.168.0.0/16; 192.168.0.0/24; fe80::/10
Ports 21; 80; 443;
Ports ranges 20-21; 49152-65534;
To specify more than one ip, port and/or host, use semicolon.
IPv4 CIDR blocks:
Address format
Mask
a.b.c.d/32
255.255.255.255
a.b.c.d/31
255.255.255.254
a.b.c.d/30
255.255.255.252
a.b.c.d/29
255.255.255.248
a.b.c.d/28
255.255.255.240
a.b.c.d/27
255.255.255.224
a.b.c.d/26
255.255.255.192
a.b.c.d/25
255.255.255.128
a.b.c.0/24
255.255.255.0
a.b.c.0/23
255.255.254.0
a.b.c.0/22
255.255.252.0
a.b.c.0/21
255.255.248.0
a.b.c.0/20
255.255.240.0
a.b.c.0/19
255.255.224.0
a.b.c.0/18
255.255.192.0
a.b.c.0/17
255.255.128.0
a.b.0.0/16
255.255.0.0
a.b.0.0/15
255.254.0.0
a.b.0.0/14
255.252.0.0
a.b.0.0/13
255.248.0.0
a.b.0.0/12
255.240.0.0
a.b.0.0/11
255.224.0.0
a.b.0.0/10
255.192.0.0
a.b.0.0/9
255.128.0.0
a.0.0.0/8
255.0.0.0
a.0.0.0/7
254.0.0.0
a.0.0.0/6
252.0.0.0
a.0.0.0/5
248.0.0.0
a.0.0.0/4
240.0.0.0
a.0.0.0/3
224.0.0.0
a.0.0.0/2
192.0.0.0
a.0.0.0/1
128.0.0.0
0.0.0.0/0
0.0.0.0
IPv6 CIDR blocks:
IPv6 CIDR blocks
FAQ:
Q: Are internet connections blocked when simplewall is not running?
A: Yes. Installed filters are working even if simplewall is terminated.
Q: What apps are blocked in default configuration?
A: By default, simplewall blocks all applications. You do not need to create custom rules to block specific applications.
Q: Is it safe to use simplewall with Windows Firewall?
A: Yes. You do not need to disable Windows Firewall. These two firewalls work independently.
Q: How can i disable blocklist entirely?
A: Open Settings -> Blocklist and then click the radio buttons labeled Disable.
Q: Where is blacklist mode?
A: Blacklist was removed many days ago for uselessness. But if you need it, you can still configure it.
Solution: Configure blacklist mode in simplewall:
Open Settings -> Rules
Uncheck Block outbound for all and Block inbound for all options.
Create user rule (green cross on toolbar) with block action, any direction, Block connection name and empty remote and local rule.
You can assign this rule for apps whatever you want to block network access.
Q: Why does my network icon have an exclamation mark?
A: When you are connected to a network, Windows checks for internet connectivity using Active Probing. This feature is named as NCSI (Network Connectivity Status Indicator). You can resolve this problem in one of the following ways:
Solution 1: Enable NCSI through internal system rule:
Open System rules tab.
Allow NCSI rule (enabled by default).
Solution 2: Disable NCSI through system registry:
Create Disable NCSI.reg and import it into registry.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NetworkConnectivityStatusIndicator]
"NoActiveProbe"=dword:00000001
"Disabl
Read the full README on GitHubWhat Hacker News says
31 sources1. Linux → https://github.com/evilsocket/opensnitch
2. Windows → https://www.glasswire.com/
3. Windows (open source) → https://github.com/henrypp/simplewall
4. Windows → https://safing.io/
In Snitch – A friendlier ss/netstatIt is definitely in win11. Might be less on win10. Maybe try using something like simplewall [0], which shows prompts for every network request that phones home
[0] - https://github.com/henrypp/simplewall
In The Windows Subsystem for Linux is now open sourceFor those looking for something similar, try SimpleWall:
https://github.com/henrypp/simplewall
It's deny by default, you get a popup when something wants to make a connection, then you can allow. Pre-built binaries available. It's my go-to since many years
In TinyWall is a free, feature-rich, and lightweight firewall for WindowsArchived and it looks like he just doesn't want to maintain it anymore.
https://github.com/henrypp/simplewall
In Is SimpleWall Firewall tool compromised?Simplewall Has Been Discontinued
54 points · Open discussion[SimpleWall](https://github.com/henrypp/simplewall)
In Little Snitch: Network Monitor and Application Firewall for macOSYou could install WPD (https://wpd.app/), use Simplewall (https://github.com/henrypp/simplewall) and a pihole on the network to block a lot, but it's still sad that we need to do this.
Apple alternatives include LuLu (https://github.com/objective-see/LuLu)
On Linux you can use Opensnitch (https://github.com/evilsocket/opensnitch)
In Windows users report appearance of unwanted HP appI’m very happy with SimpleWall: https://github.com/henrypp/simplewall
In Brute-forcing a macOS user’s real name from a browser using mDNSHorrifying. That's exactly why simplewall [0] is among the first programs I install on Windows. Then I block stuff like compattelrunner.exe, devicecensus.exe, explorer.exe, the various Intel / Nvidia driver-related bullshit background processes the first time they attempt to connect to a remote server.
https://github.com/henrypp/simplewall
In I Still Use Windows 95 (2008)As a huge fan of simplewall [0] by Henry++ on Windows, I'm looking forward to testing OpenSnitch on Debian, it looks like it could be the former's counterpart.
[0]: https://github.com/henrypp/simplewall
In OpenSnitch in Debian ready for prime timeI use OpenSnitch on Linux which is great, and if you are looking for similar software for Windows I can recommend simplewall.
https://github.com/henrypp/simplewall
In OpenSnitch in Debian ready for prime timeMy point is that if it's just Tor Browser without Tor, then there's functionally no reason to have that build be incompatible with Windows 7.
Unless they deliberately coded it in like
if OS=Win7/Win8 ; then Crash ; else Run
Which would be a dick move, especially because Firefox, on which Tor Browser and Mullvad Browser are based, still supports Windows 7.
---------
Now to your point.
It is absolutely possible to run Windows 7 reasonably securely.
Well..., depends on your usecase.
But the way in which I keep it secure might be a little cumbersome to some.
My router runs PFSense with Suricata, and I encrypt my DNS traffic.
I run a combination of Peerblock(while no longer maintained, it works splendidly in whitelist mode)[1], and Simplewall Firewall[2].
I run a combination of uMatrix(which again, while no longer maintained, it works gre
Read the rest
at in whitelist mode)[3], and NoScript[4] on my Firefox web browser which I run inside Sandboxie[5].
There are also various services that are insecure and must be turned off - UPnP, Print Spooler, RDP etc.
I run mostly FOSS software.
The few proprietary closed source software(Games, Sublime Text) that I do run, I run them in SandBoxie or QEMU.
Here are my reasons for not upgrading:
I've modified my `UXTheme.dll` to significantly change my "Desktop Environment" to suit my workflow, and I've heard from people I know to be credible, that latter Windows versions(8 onwards) break system UI modifications when they update, and they don't work quite as well afterward.
My modified Win7 UI is way too important to my workflow.
Python have stopped releasing binaries for Win7 after 3.8.10[6] but I'm okay with it. If I do need the newer Python versions for something, I'll just use my Linux Desktop or run Linux in a virtual machine for a Python quickie.
Windows 7 is extremely stable. While not as stable as Linux, I often have uptimes of over 350 days, before a BSOD, by which point I can foresee a crash coming and reboot.
To lean into your metaphor, Microsoft is now shipping operating systems with "open windows" everywhere(way more open windows than my "insecure" Windows 7 has), and we, as users, are having to rebuild the ISOs they release, to make them more "privacy friendly"(yes I'm aware of the difference between privacy and security but they're really interchangeable here), and even then, we're having to use 3rd party "de-bloaters" and Batch/Powershell scripts off of Github, just so the majority of those proverbial windows are closed back up again.
This really shouldn't have to be the case, but it is.
Microsoft have decided that they would rather their bread be buttered by advertisers than by the actual users of their software.
With Windows 7, I know there's an open window that I can't shut, but I have an electrified fence surrounding my compound, with security cameras and loaded turrets pointed towards that open window and other open windows in my house.
I know where Windows 7's security limitations are, and I can mitigate against that, elsewhere.
But I will admit, I don't go around recommending laypeople to use Windows 7 though, as the barrier to securing it is high. Even after securing it, the user has to be careful.
In my humble opinion, Windows 7 was the last true Microsoft Operating System. It simply does what is asked of it, and moves out of the way.
All Microsoft need have done was support Powershell, DirectX, give Win7 a "security updates as a service" business model(which I would've gladly paid for), and make WSL for it(Cygwin is excellent but WSL would be nicer).
I know there is 0Patch, a 3rd party company who sell security updates for Windows 7, but I would've appreciated official Microsoft security updates.
I would switch to Linux, if there was a robust equivalent to Autohotkey on Linux, and the games I want to run, worked on it.
So yeah, I still run Windows 7.
I can't see myself ever upgrading to another Microsoft OS, ever again.
And I am, and I cannot emphasize this enough, exceedingly happy with it.
[1] https://www.peerblock.com/
[2] https://github.com/henrypp/simplewall
[3] https://github.com/gorhill/uMatrix
[4] https://noscript.net
[5] https://github.com/sandboxie-plus/Sandboxie
simplewall[0] is my #1 install on a new machine. Little different, but it'll still alert you to the requests, allow for timers, per application/route rules etc.
[0]: https://github.com/henrypp/simplewall
In Little Snitch MiniSimpleWall?
https://github.com/henrypp/simplewall
In What does "Copy clean link" mean?Showing the 15 most recent of 31 sources. Enable JavaScript to search and browse every indexed mention.