-
Notifications
You must be signed in to change notification settings - Fork 0
FAQ
General questions about CyberWall features, configuration, and troubleshooting.
CyberWall is a per-application firewall for Windows powered by the Windows Filtering Platform (WFP). It uses a default-deny architecture that intercepts unknown network connections and prompts you to allow or deny them.
Yes. CyberWall is completely free and open source under the GPLv3 license.
WFP operates at the kernel level and requires elevated privileges to install firewall filters and monitor network traffic.
No. CyberWall works alongside Windows Defender Firewall. It uses the same WFP layer but provides per-application prompts and a more user-friendly interface.
| Mode | Description |
|---|---|
| Ask to Connect | Prompt for each unknown app |
| Block All | Silently block unknown apps |
| Killswitch | Block all network traffic |
| Disabled | No filtering |
Ask to Connect is recommended for most apps. It provides security while letting you control which apps can access the network.
Killswitch is total network lockdown. All traffic is blocked except for apps you've explicitly allowed. Useful for emergency situations.
Rules are created automatically when you respond to prompts. You can also manually add rules in Settings → Rules.
CyberWall automatically resolves companion executables. For example, if you allow Git, it will also allow git-remote-https, ssh, and other Git helper programs.
Yes. Go to Settings → Rules, right-click any rule to edit its properties.
Export rules to JSON: Settings → Rules → Export. You can import them later or on another machine.
Check these settings:
- Remember decision — Make sure to check "Remember" when responding
- App version change — CyberWall re-prompts if the app updates
- Different connection type — Inbound vs outbound may have separate rules
After the auto-block timeout (default: 5 minutes), the connection is automatically blocked. You can adjust the timeout in Settings.
Yes. Create a rule for the app with "Allow" verdict and "Remember" enabled. No more prompts for that app.
Every blocked or allowed connection is logged with: timestamp, app name, protocol, remote IP/port, direction, and action.
Click the Log button in the main window, or right-click the tray icon → View Log.
Yes. The log viewer has an export function to save logs as CSV.
- Ensure you're running as Administrator
- Check if .NET 10 runtime is installed
- Verify Windows Event Log service is running
- Check if firewall is enabled in Settings
- Verify mode is set to "Ask to Connect"
- Ensure the app doesn't already have a rule
- Check if "Block All" or "Killswitch" mode is active
- Look for the app in the rules list and verify it's allowed
- Temporarily switch to "Disabled" mode to test
- Reduce TCP polling frequency in advanced settings
- Clear old connection logs
- Restart CyberWall
CyberWall is designed to coexist with Windows Defender Firewall. Third-party firewalls may conflict — test with only one enabled.
No. WFP filtering operates at kernel level with minimal overhead. Network speed impact is negligible.
Typically 50-100 MB RAM, depending on the number of rules and log entries.
CyberWall has minimal performance impact. You can whitelist your game apps to avoid prompts during gameplay.
Open an issue on GitHub Issues with:
- CyberWall version
- Windows version
- Steps to reproduce
- Expected vs actual behavior
- Fork the repository
- Create a feature branch
- Submit a pull request
- Describe your changes in the PR description
UI strings are in src/CyberWall.Common/I18n/. Submit a PR with your translation.
See the Donate section on the main README.