Fort Firewall is a free, open-source firewall that controls network access for Windows programs through its own Windows Filtering Platform driver. It identifies applications by executable path, applies connection rules, and records traffic. A separate Windows service can keep filtering when nobody signs in.
Program paths and actions
The Programs window assigns Allow, Block, Ask, or Kill Process to individual applications. You can add an executable directly or create wildcard entries for folders and their descendants. Parent processes can pass their network settings to child processes; changes affect children that start afterward.
Fort can also make a Windows service run in its own process, then identify it by service name. Each program can block inbound traffic, outbound traffic, or Internet access while allowing the LAN. Local network traffic bypasses program checks by default unless you enable local network filtering.
When a program first connects
Auto-Learn permits new programs and adds them to the list. Its timer then switches to Block, if not allowed. Other modes allow unknown programs, block them, or ask for a decision.
Ask to Connect pauses a connection while you choose an action. Allow once covers one outbound connection; Allow Process covers that process until it exits or a timer expires. Fort blocks the connection if its decision timeout expires. Inbound connections require process permission or evaluation through the current settings.
Filters and rule order
A filter combines local or remote addresses, ports, protocols, direction, and network area. Rules can also match Public, Private, or Domain network profiles. The filter dialog builds conditions, while a text editor accepts ranges, subnets, and nested conditions.
Application rules attach to programs or groups. Global rules run before or after application checks, and preset rules supply reusable subrules. The first condition that decides a connection stops later checks. A Terminating Rule supplies an action when no condition matches. Consequently, an earlier global rule can decide before a program’s Block action.
Weekly groups
Groups provide a shared switch for several programs and can apply a common rule. Tray controls turn groups on or off. Time Periods attach weekly intervals to groups, rules, speed limits, or statistics collection, including intervals that cross midnight.
When users enable group blocking, Fort blocks a program when none of its groups is active. Exclusive groups narrow this further: at least one exclusive group must be active. Earlier filtering decisions can bypass the group check.
Shared bandwidth limits
A named Speed Limit caps downloads or uploads. You assign it through each program’s Network Filters settings. Programs that share the same limit divide its bandwidth rather than receiving separate allowances.
Limits can follow a Time Period and add latency or simulated packet loss. A queue holds waiting packets; overflow causes drops, which counters display. Both filtering and the speed limiter must be on. Fort does not limit LAN traffic under its default local-network behavior.
Address lists in Zones
Zones collect addresses from inline text, a local file, or a downloadable list. A custom URL supplies another list source. Update Zones loads the addresses, and a downloader schedule refreshes them automatically.
For an application, a rejected zone blocks matching addresses. An accepted zone allows matches immediately and excludes addresses outside its accepted zones. A new zone remains empty until an update. Empty or disabled accepted zones still restrict the application, so their state affects connection decisions.
Traffic totals and connection reasons
The Traffic window totals each program’s downloads and uploads in hourly, daily, monthly, and overall views. A separate live graph plots bandwidth. Download quotas can raise alerts and optionally switch on Internet blocking; users must reverse that block themselves.
The Connections log lists endpoints, protocol, direction, action, and the reason for each decision. The reason can identify the rule or zone responsible. Global, program, and rule switches govern logging. Defaults record blocked connections and clear the log when the service restarts. Copy as Filter turns a connection into rule text.
Testing a connection decision
The Filter Simulator takes a program path, protocol, direction, endpoints, and network profile. It evaluates current settings without making the connection, then shows the action, reason, and deciding rule or zone. A log entry can fill these inputs automatically. The simulator checks paths only, so it excludes settings that a parent process passes to a child.
Password and command controls
A password protects configuration windows, alerts, statistics, and most command-line operations. Unlock periods can last until window closure, session lock, program exit, or a time limit.
Commands control the running instance’s filter mode, program actions, groups, rules, and zone updates. They can export or import configuration, settings, and statistics. Separate commands save rule text to a file or replace it after validation.
