Windows 11 can be made dramatically quieter and harder to snoop on with a single, tiny open‑source utility that sits on top of Microsoft’s Windows Filtering Platform (WFP) and forces strict outbound control: simplewall. The MakeUseOf feature that brought this tool back into the spotlight frames it as a 2MB, no‑nonsense app that flips Windows’ default networking model from permissive to
intentional and ships with built‑in telemetry blocklists and easy system‑hardening toggles.
Background / Overview
Windows ships with a robust kernel-level filtering API (the Windows Filtering Platform) but exposes it through legacy, often confusing UI layers. By default, Windows Defender Firewall and the platform assume convenience: outbound traffic is allowed unless a rule blocks it, making the platform permissive on purpose to avoid breaking typical consumer workflows. Microsoft documentation makes that choice explicit: Windows Defender Firewall “allows all outbound network traffic unless it matches a rule that prohibits the traffic,” and enterprise guidance even recommends allowing outbound by default in many deployments to simplify management. Simplewall is a lightweight front end for WFP that reverses that assumption: it favors a whitelist-first posture and presents a minimal UI where each new or unknown process attempting outbound connections can be allowed or denied. The project is open source, GPL‑3.0 licensed, and actively maintained on GitHub by Henry++ (henrypp). Why this matters: outbound controls are a different security dimension than antivirus. AV products focus on detecting and blocking malicious code and inbound attacks; strict outbound filtering prevents compromised processes and unwanted telemetry from phoning home or exfiltrating data. Microsoft itself provides network‑level protections (Network Protection, Defender features) aimed at blocking malicious domains, but those controls operate on different signals and threat models than a local strict whitelist of allowed processes.
What simplewall is — clear, practical facts
- simplewall is a user interface for the Windows Filtering Platform (WFP); it does not wrap or modify the built‑in Windows Defender Firewall but installs its own WFP filters to monitor and block traffic.
- The tool is free, open source (GPL‑3.0), and available as both an installer and a portable build on the project’s GitHub releases.
- It offers a whitelist mode by default (block everything not explicitly allowed), a realtime process list with on‑demand notifications, and an internal blocklist specifically aimed at telemetry / telemetry‑related IPs and Microsoft endpoints. Independent reviews and hands‑on guides note the blocklist and telemetry focused presets.
Two practical cross-checks:
- The GitHub README and releases show the project structure and features and identify the blocklist functionality and system rules.
- Independent coverage (technical blogs and reviews) describe the same whitelist workflow and telemetry block features in real‑world testing.
Download size — one small detail, two slightly different claims
The MakeUseOf piece described the download as a “2MB open‑source tool.” External mirrors and software directories report a small installer in the same ballpark — MajorGeeks lists 2 MB, while Softpedia and several mirrors report sizes under 1.2 MB for the installer or portable package depending on packaging (installer vs portable archive). That variance is normal: zipped or mirrored installers, portable builds, or wrapper pages will create slightly different published sizes. Treat the “2MB” figure as a convenient, approximate size rather than a precise technical guarantee.
How simplewall changes Windows security (deep dive)
Whitelist vs blocklist: the security model
- Windows Defender Firewall historically operates with a default‑allow outbound posture; administrators are expected to add outbound rules as needed. Microsoft documentation explains this is the recommended default for many deployments.
- simplewall flips this: default‑deny outbound where only approved processes make network connections. The benefit is straightforward: a zero‑trust‑like local posture prevents most unexpected background or post‑exploit communications unless the user consciously authorizes them. Several hands‑on articles and reviews highlight how this small behavioral change converts passive telemetry “chatter” into visible, actionable events.
Telemetry and blocklists
- simplewall ships with internal blocklists that target Microsoft telemetry and update endpoints for users who want to silence background diagnostic traffic at the packet level. In practice, this blocks IPs/domains used for telemetry and diagnostic services so packets never leave the machine — a stronger enforcement than toggling settings in Windows alone.
- Caveat: IP‑based blocklists are brittle; Microsoft’s endpoints can and do move between IPs or rely on CDNs. Several community discussions recommend using domain/wildcard endpoints when possible, or combining simplewall with other local resolvers (Pi‑Hole) for layered control. The simplewall project’s issue tracker and community threads discuss the limitations of IP lists and recommend domain-based strategies where supported.
System hardening features
simplewall doesn’t stop at per‑app rules; it offers system‑level toggles to:
- Block port scanning or discovery vectors.
- Restrict IP ranges and control packet download/upload behaviors.
- Enable logging and notifications for dropped connections to make troubleshooting simple for non‑experts. These toggles replicate what previously required PowerShell or enterprise tooling in a few checkboxes.
Installing and configuring simplewall — a practical guide
- Download the release from the official GitHub releases page (or the project homepage) and verify the checksum/signature if provided. Always prefer the project’s own release assets to third‑party mirrors.
- Run the installer or extract the portable build. Administrator rights are required because WFP filters are kernel‑level components. The app will prompt for elevation.
- On first run, enable Whitelist mode (the default recommended setting for privacy‑minded users). Expect a flurry of prompts as the system and user apps attempt their outbound connections. Allow only the apps and services you trust.
- Enable the Telemetry and Updates blocklists if you want to suppress known Microsoft telemetry and update endpoints — test Windows Update and other required services after enabling to prevent accidental blocking. If Windows Update fails, simplewall includes a built‑in “Allow Windows Update” toggle to restore necessary rules.
- Turn on logging and notifications to catch false positives quickly. When an app fails to connect, simplewall notifies you — click Allow to permit it and automatically add an exception to the whitelist. This immediate feedback loop is why users report low breakage after the initial setup.
Numbered troubleshooting checklist:
- If a legitimate Windows service fails after enabling blocklists, use the “Allow Windows Update” or relevant System Rules in the app to restore service-specific rules.
- Temporarily switch simplewall to “Alert” or permissive mode to see which rules interfere, then convert the necessary items into explicit allow rules.
- Keep the portable installer or a restore image handy — aggressive core or system rule changes can require a clean restore if you lose remote access.
Strengths — what simplewall delivers well
- Surgical outbound control. It closes the common gap where AV and native firewall defaults allow outbound telemetry and exfiltration by default. For users who want granular control over what leaves their machine, this is the simplest practical tool.
- Tiny footprint and open source. The project is small, actively developed, and auditable; the code and release history are public on GitHub (GPL‑3.0). That combination is rare for kernel‑adjacent Windows tooling and valuable for trust.
- Actionable notifications. The UX is designed for quick feedback: when something is blocked, you see it and decide instantly — much friendlier than digging through Windows Firewall logs. Reviewers note that this lowers the barrier for users who would otherwise avoid outbound firewall policies altogether.
Risks and limitations — be explicit about tradeoffs
- Usability friction. A default‑deny outbound posture requires decisions for every new networked application. That friction is intentional security and privacy tradeoff; casual users may find it annoying until their whitelist matures.
- Supply‑chain & source hygiene. Any tooling that installs kernel‑level filters must be obtained from official channels and verified. Community tools have occasionally been mirrored by malicious sites; always download from the project’s GitHub Releases and verify checksums. This is a general risk that applies to many small open‑source tools.
- IP blocklist brittleness. Blocking by IP is effective but fragile; Microsoft changes endpoints and CDNs, so IP lists can break legitimate services inadvertently. Using domain‑based indicators or layered DNS‑level controls is a more durable approach where possible. simplewall’s own issue discussions note this limitation and recommend using wildcard/domain endpoints where supported.
- False positives & reputation flags. Small security utilities sometimes trigger heuristic detections on multi‑engine scanners. Past community reports show simplewall (and related privacy tools) occasionally flagged by a small number of engines — often benign, but a reason to verify binary integrity before trusting an installer. In practice this is often a heuristic noise issue, not proof of malicious intent, but it’s still worth validating.
How simplewall fits with other defenses
- simplewall is complementary to Microsoft Defender / Windows Security, not a replacement. Defender protects against many inbound threats and offers network protection and web filtering for malicious domains; simplewall fills the outbound control gap and enforces process-level intent. Use both: Defender for broad EDR/AV and simplewall for strict outbound policy.
- For enterprise or centrally managed fleets, group policy, Microsoft Endpoint Manager, or full EDRs provide richer policy, visibility, and centralized rule distribution. simplewall is best for single‑device hardening, lab machines, or privacy‑minded power users rather than scale-managed enterprise deployments.
Alternatives and complements
- TinyWall, Portmaster, and other lightweight wrappers for host firewalls offer similar functionality with different tradeoffs (TinyWall for minimalism, Portmaster for cross‑platform UI and DNS filtering). Compare features and trust models before committing to a single tool.
- Network-level controls (Pi‑Hole, DNS‑level blocking, router‑based filters) complement local WFP controls by blocking known telemetry domains at the resolver or gateway level, reducing reliance on brittle IP lists. Combine resolver blocklists with simplewall for best coverage.
Verdict — who should install simplewall, and how to be safe
Simplewall is a high‑value tool for users who care about privacy and want deterministic control over what leaves their PC. It is:
- Ideal for privacy‑minded power users and technicians who want an auditable, open‑source WFP front end.
- Useful for isolating lab machines, blocking telemetry on home systems, and quickly locking down outbound channels after a suspected compromise.
Not ideal for:
- Users who cannot tolerate the initial workload of approving new apps.
- Managed enterprise endpoints that require centralized policy and vendor‑backed support; in those cases, use organizational tooling and carefully-tested policies.
Practical safety checklist before using simplewall:
- Download only from the project’s official GitHub releases and verify the checksums.
- Create a system restore point or a full image backup before applying system‑wide filters.
- Enable logging and notifications; keep a second device or remote console available when testing aggressive rules.
Conclusion
The MakeUseOf piece that re‑highlighted simplewall captured the right core idea: a tiny, open‑source tool can change the default security posture of Windows from permissive to intentional and reduce background telemetry and unwanted data exfiltration effectively. That observation is borne out by the project’s README, community reviews, and Microsoft’s own documentation about WFP and firewall defaults. Use simplewall as a surgical addition to your security toolkit — it’s not a full replacement for Defender or enterprise EDR, but for a single machine it is a pragmatic, low‑cost way to stop many unwanted connections at the source while reclaiming control of your PC’s network behavior.
Source: MakeUseOf
I made Windows 11 more secure with this 2MB open-source tool