TinyWall is a free, open-source firewall for Windows that controls which applications may use the network. It works on a whitelist principle: anything not explicitly allowed is blocked. The program does this without asking the user about each new connection. It is aimed at individual PCs and small home or office setups rather than servers or managed networks.
Blocking without popups
Many personal firewalls interrupt the user every time an unknown program tries to connect. TinyWall shows no such prompts and does not announce blocked attempts as they happen. A program that has not been allowed simply cannot reach the network, and the user notices when it stops working.
Because it filters per application, TinyWall can separate two programs that use the same port, something a router’s port-based firewall cannot do. It controls outgoing traffic as well as incoming connections.
Whitelisting applications
Since everything starts blocked, the main task in TinyWall is adding exceptions:
- press a hotkey and click the window of the program that should get access;
- pick the program from a list of running processes;
- browse to its executable file;
- choose a Windows service or a Microsoft Store (UWP) app from the Manage window.
A ready-made list of special exceptions covers common software, and TinyWall suggests related executables that an application may also need. You can narrow an exception to a direction, specific ports or protocols, or restrict it to the local network only. Rules can also be temporary and expire after a set time. They can also work as blocking rules that keep a program offline even in more permissive modes.
When an allowed application still fails to connect, it usually depends on another executable. The Connections window lists established and blocked connections along with open ports. You can unblock a blocked entry there with a right-click.
Firewall modes and autolearn
Quick modes in the tray menu change the overall policy: normal whitelist filtering, allowing all outgoing traffic, blocking everything, or disabling the firewall. Autolearn mode temporarily lets all programs connect and records which ones did. When the mode ends, TinyWall turns those records into exceptions. It suits a freshly installed computer. You can review learned entries by timestamp and remove them afterwards. Autolearn does not create rules for system processes or Windows services.
Protection and blocklists
TinyWall guards Windows Firewall settings against changes by other programs, can lock its own settings with a password, and can protect the hosts file. TinyWall also supports boot-time filtering. TinyWall includes two optional blocklists. The domain blocklist uses a custom hosts file to stop connections to listed hosts, such as some ad servers. The older port-based list targets known malware.
Other options allow all LAN traffic so that shares, NAS drives and network printers keep working, or cut internet access while the display is in power-saving mode. TinyWall supports IPv6 and the Windows Subsystem for Linux.
How the firewall runs
A background service with elevated rights sends rules to the Windows Filtering Platform, so the filtering itself happens in the Windows kernel. TinyWall installs no drivers of its own, and its rules stay in effect even if the service stops or the tray icon is closed.
TinyWall is only a firewall, with no antivirus or intrusion-prevention modules. It should not run alongside another firewall. Some security suites’ web shields route traffic through their own process, which defeats per-application rules. The program sends no telemetry; the optional update check transmits only the installed version.
