ZoneAlarm Free Firewall is a two-way personal firewall for Windows from Check Point. It sits between the PC and the network, filtering incoming connections and deciding which installed programs may reach the internet. The firewall is free to use and contains no antivirus engine; Check Point covers malware scanning in ZoneAlarm Free Antivirus and its paid suites.
Inbound and outbound filtering
The firewall checks incoming traffic against predefined rules. Real-time intrusion detection blocks unsolicited connection attempts so the PC is not exposed to scans from the network. Outgoing traffic gets the same attention. A program that tries to send data out, such as spyware, has to pass the firewall’s checks before it can connect.
Trusted, Public and Blocked zones
ZoneAlarm Free Firewall sorts networks and computers into three zones, and each zone carries its own security level.
- Public is meant for unknown networks and most wireless networks, including secured ones. Its default High level lets the PC use resources on the network while keeping other devices from reaching files or services on the PC.
- Trusted is for a home or office network the user knows and controls. The default Medium level guards Windows networking services but still lets the PC share resources with other computers on the network.
- Blocked holds hosts and networks that should never communicate with the PC. No traffic passes to or from this zone.
Users can add a host name, single IP address, IP range or subnet to any zone. The firewall can look up the IP address of a named host. Each zone’s level can be set to High, Medium or Off; Off disables the firewall.
The High and Medium rule sets can also be fine-tuned by protocol and port. Options include permitting outbound DNS and DHCP, allowing or blocking ping and other ICMP traffic, and blocking NetBIOS ports. Users can also open or close specific TCP and UDP ports or port ranges in either direction. A reset option restores the defaults.
Program access control
Besides filtering by address, ZoneAlarm Free Firewall controls which applications may go online. Programs carry separate permissions for outbound and inbound connections to the Trusted and Public zones, each set to allow, deny or ask. With the ask setting, the firewall shows an alert when the program first tries to connect or to act as a server. The user then decides whether to permit it.
Programs listed in Microsoft’s catalog of trusted Windows applications do not trigger these alerts in normal use. Component Control goes a level deeper: it watches the DLLs loaded into trusted processes, so malicious code cannot hide inside an approved program to slip past application control.
Protection against bypass techniques
Some malware tries to get around a firewall rather than through it. ZoneAlarm Free Firewall includes Advanced-Access Protection aimed at these methods. These include raw data access, timing attacks against the Windows kernel, and abuse of standard Windows service (SCM) and COM calls. A related setting stops untrusted programs from launching a trusted program to reach the internet on their behalf.
Early Boot Protection checks during startup whether the PC is loading a trusted operating system or a rootkit that has taken over the boot process. Anti-Bot detects bots in real time and blocks their communication, so an infected PC cannot be used for botnets, spam or data theft.
Wi-Fi and network detection
When the PC connects to a new network, the firewall places it in the Trusted or Public zone. On unsecured networks, the program watches running software for suspicious behavior.
Firewall log
ZoneAlarm Free Firewall records firewall events in a log and archives it every seven days. From a selected entry in the log viewer, the user can add the source IP address to the Trusted or Blocked zone. The user can also open an advisor page that explains the type of blocked packet.
Updates and compatibility
The firewall checks for and installs its updates automatically. It is designed to run alongside Microsoft Defender, but Check Point does not support it next to other anti-malware products. Users have to remove those products first. Malware scanning belongs to ZoneAlarm Free Antivirus and the paid suites, while anti-phishing and download sandboxing come with the paid suites.
