English · Español
-2563EB?style=for-the-badge){kind=icon}
CyberWall is a modern, lightweight per-application firewall for Windows, built on the Windows Filtering Platform (WFP) and the Windows Advanced Firewall that ship with the operating system. Its default-deny model intercepts unknown network activity and asks whether each executable should be allowed once, always allowed, or blocked with a persistent rule. Real-time prompts, connection monitoring, rule management, traffic statistics, and clear application identity make outbound access easier to understand and control without installing a third-party kernel driver.
Free and open source (GPLv3): no ads, no tracking, and no data collection. Just enjoy it.
Most traditional firewalls either let everything out silently or bombard you with complex IP/port questions. CyberWall takes a simpler, much more effective approach: nothing accesses the internet unless you explicitly allow that specific program.
Here is how CyberWall protects your computer against real-world threats in plain terms:
| Threat Category | Protection Level | What CyberWall Does |
|---|---|---|
| Spyware & Keyloggers | 🟢 10 / 10 | Total Exfiltration Lock: Even if malware ends up on your disk, it cannot upload your passwords, keystrokes, or documents to an attacker's server without an explicit prompt. |
| Ransomware & C2 Beacons | 🟢 10 / 10 | Communication Blackout: Blocks unauthorized background scripts and payloads from contacting their command servers or downloading encryption keys. |
| Silent CLI & Script Attacks | 🟢 9.5 / 10 | Instant Interception: Catches terminal tools (curl, powershell, ssh, git) within milliseconds if they attempt unexpected outbound network transfers. |
| Unsolicited Inbound Probes | 🟢 10 / 10 | Automatic Rejection: External scanners and probes on local networks are dropped cold at the kernel layer. |
| Reverse Shells & Remote Access | 🟢 9.5 / 10 | Channel Severance: Hackers attempting to open a remote interactive backdoor find their outbound connection stuck in kernel limbo. |
Tip
Zero Stability Risk: Unlike other firewalls that install invasive third-party kernel drivers (often causing Blue Screens / BSODs after Windows updates), CyberWall does not install any driver at all. It detects blocked traffic through the WFP audit events and enforces the decisions with the firewall engine already built into Windows, so there is nothing to break after an update.
- Real-Time WFP Drop Detection: Event-driven kernel drop detection through the Windows Filtering Platform audit events (
Event ID 5157). Accurately intercepts short-lived CLI processes (git,curl,dotnet,ssh) within milliseconds. - Native Firewall Enforcement: Decisions are applied as per-application rules in the Windows Advanced Firewall (
HNetCfg.FwPolicy2), withnetshand PowerShell as fallbacks. No custom filter or driver is ever installed. - Crash-Safe Default Deny: The default-deny profile policy is restored by a scheduled task if CyberWall stops unexpectedly, so a crash can never leave the machine without connectivity.
- Smart Toolchain & Suite Rules: Automatically resolves and authorizes companion helper executables for developer suites like Git (
git.exe,git-remote-https.exe,git-remote-http.exe,ssh.exe, etc.). - Default-Deny / Whitelist Architecture: Enforces a strict inbound and outbound block-by-default policy, allowing only user-authorized applications.
- GlassWire-Style Toast Alerts: Sleek "First Network Activity" notification toasts with graphic direction badges (
↑ Outbound/↓ Inbound). - Dedicated Connection Log Viewer: Real-time event log with instant filtering (by program, IP, port, or PID), one-click clipboard copying, and direct log file access.
- Visual Theme Engine (
ThemeCard): Interactive visual cards with live UI previews and instant switching:- CyberWall: Deep obsidian/navy with electric neon cyan and emerald accents.
- Dark: Refined charcoal and neutral slate with vibrant indigo accents.
- Light: Crisp slate and pure white with royal blue accents.
- Native Windows 11 Chrome: Pure DWM-rounded corners with subpixel anti-aliasing buffers, custom title bar, and multi-monitor positioning grid.
- Built-in Auto-Update System: One-click GitHub Releases update checker with live download progress tracking, SHA256 verification of the downloaded installer, and silent installer execution.
- Dedicated About Modal: Interactive product overview, update manager, and direct access to CyberGems community channels.
- Fully Bilingual (EN / ES): Complete UI localization in English and Spanish with instant language switching.
- Persistent Rule Store: Rules are stored persistently in
%ProgramData%\CyberWall\rules.json, written atomically so a crash never truncates them. - System Tray & Background Daemon: System tray integration, minimize-to-tray, and optional support for running as a background Windows Service (SYSTEM). Only one host owns the firewall engine at a time: the open window takes precedence and the service resumes protection when it closes.
- Download the latest installer from Releases
- Run the
.exeinstaller and follow the setup wizard - Launch CyberWall. No .NET SDK needed to run it.
Note: Real kernel-level network filtering and firewall rule enforcement require Administrator privileges.
Windows may show a SmartScreen warning the first time you run the CyberWall installer: this is an unsigned hobby app, so Windows hasn't built reputation for the file yet. This is expected; the source is public so you can inspect exactly what it does.
To continue:
See how to run the installer (step by step)
Windows shows this warning for any installer without a paid code-signing certificate; it does not mean the file is unsafe. Do not click "Don't run":
- Run the installer. Windows may show the blue "Windows protected your PC" dialog.
- Click the small More info link.
- Click Run anyway. The installer starts normally.
You can verify the file independently: compare the SHA with the GitHub release, scan it on VirusTotal, or build from source. More details: SmartScreen guide on the website.
- Platform: Windows 10 / 11 (x64)
- Framework: .NET 10 + WPF (Native UI)
- Filtering Core:
fwpuclnt.dll(WFP User-Mode API), Windows Advanced Firewall (HNetCfg.FwPolicy2), and Security Audit Event Log (EventLogWatcher).
CyberWall.slnx
├── src/CyberWall.Common/ -> Core models (AppRule, ConnectionEvent), I18n strings, settings
├── src/CyberWall.Service/ -> WfpEngine, WfpBlockWatcher, RealFirewall, ConnectionMonitor, RuleStore
├── src/CyberWall.UI/ -> Frameless WPF UI, ThemeCard controls, ConnectionPopup, TrayService, Dialogs
└── tests/CyberWall.Tests/ -> Unit tests for rules, packages, settings, translations and rule names
Only needed if you want to work on CyberWall or build it yourself; regular users can skip this section.
- Windows 10/11 (x64)
- .NET 10 SDK
# Build solution
dotnet build
# Run the tests
dotnet test
# Run with Administrator privileges (Real WFP filtering)
.\dev-admin.ps1
# Run standard dev session (Simulated filtering if non-elevated)
.\dev.ps1Note: Real kernel-level network filtering and firewall rule enforcement require Administrator privileges.
- Kernel Interception: When an application without an existing rule attempts to make an outbound or inbound connection, Windows Filtering Platform safely holds the connection at the kernel level.
- Instant Event Capture:
WfpBlockWatcherreceives the drop event in real-time, resolves the NT kernel device path (e.g.\device\harddiskvolume3\...) to a standard Win32 file path (C:\...), and debounces duplicate triggers. The audit policy it enables is restored when CyberWall stops. - Interactive Prompt: A non-intrusive frameless popup appears in your chosen monitor corner showing the application icon, name, protocol, destination endpoint, and graphic direction badge (
↑ Outbound/↓ Inbound). - Rule Enforcement: CyberWall applies the selected decision to the pending process as a Windows Firewall rule. Allow always and Block save a persistent rule to
rules.jsonand update the firewall engine, while Allow once keeps the decision for the current session only. - Policy Recovery: While protection is on, a scheduled task watches a heartbeat file. If CyberWall dies, the task restores the original firewall policy and removes the rules it left behind, so the machine never stays locked down.
After countless hours building and refining CyberWall for my own use, I recently decided to share it with the world along with my other open-source tools in CyberGems.
If you’d like to support future updates, I’d truly appreciate it. Your donation helps keep development going, roll out new features, speed up updates and bug resolution, and enhance documentation quality. You can also show your support by starring the repo on GitHub. Thank you! 🙏
Crypto donations (BTC, ETH, USDT, LTC): click to view addresses
| Asset | Address | QR |
|---|---|---|
| BTC | |
 |
| ETH | |
 |
| USDT (ERC20 / BEP20) | |
|
| USDT (TRC20) | |
 |
| LTC | |
 |
⚠️ Send only the selected asset on the indicated network. Using the wrong network will result in permanent loss of funds.
CyberWall is distributed under the terms of the GNU General Public License v3.0. See LICENSE for the full license text.
Copyright (C) 2026 CyberGems
For frequently asked questions, troubleshooting guides, and detailed configuration instructions, visit the FAQ or the online documentation.
Thanks for using CyberWall! 🎉
Made by CyberGems
More free, open-source, privacy-first apps from CyberGems:
| App | Description |
|---|---|
| 🕐 CyberClock | Desktop clock with analog & digital display, calendar, timer, stopwatch and relaxation module. |
| 📢 CyberFeeds | High-performance, local-first RSS and Atom reader built for speed, privacy and clean reading. |
| 🚀 CyberLauncher | Windows application launcher with hot corners, scheduler, system monitor and integrated terminal. |
| 💻 CyberManager | Lightweight, high-performance task manager, virtualized and NT-native, a powerful Task Manager alternative. |
| 📝 CyberNotes | Privacy-focused note-taking app with rich text, folders, tabs and bcrypt-protected local storage. |
| ⚡ CyberPaste | Privacy-first clipboard manager for text, code, images, HTML and files. |
| 📸 CyberSnap | Screen capture and annotation suite with vector tools, high-speed OCR, screen recording and color picker. |
| ⭐ CyberTray | High-performance tray launcher with hotspots, system monitoring, process manager and PIN-protected file vault. |
| 💫 CyberViewer | Full-featured image viewer and editor engineered for casual and power users. |