Firewall Engine

Firewall Engine

CyberWall uses the Windows Filtering Platform (WFP) for kernel-level network filtering with a default-deny architecture.

---

How It Works

Architecture

CyberWall operates at two levels:

Layer	Technology	Description
Kernel	WFP (Windows Filtering Platform)	Intercepts network packets at the network layer
User	Windows Firewall COM API	Manages persistent firewall rules

Detection Methods

Method	Description
Event ID 5157	Real-time WFP drop detection via Security Audit log
TCP Polling	400ms connection polling for comprehensive coverage

Default-Deny Philosophy

Unknown connections are blocked by default:

1. App attempts network connection
2. WFP intercepts the connection
3. CyberWall checks for existing rules
4. If no rule exists → prompt or block
5. Your decision becomes a persistent rule

---

Firewall Modes

Ask to Connect (Default)

When an unknown app tries to connect:

• A popup prompt appears
• Choose Allow or Deny
• Option to remember the decision
• Auto-block timeout for unanswered prompts

Block All

Silently blocks all unknown connections:

• No prompts shown
• Known apps with rules still work
• Maximum security mode

Killswitch

Total network lockdown:

• Blocks all network traffic
• Only manually allowed apps work
• Emergency use

Disabled

No filtering:

• All connections allowed
• Monitoring still active
• Useful for troubleshooting

Mode Switching

Change modes from:

• System tray icon → right-click menu
• Settings window
• Main window toolbar

---

Rules

Rule Types

Type	Description
Allow	Permit all network access for the app
Deny	Block all network access for the app
Inbound	Allow/deny incoming connections
Outbound	Allow/deny outgoing connections

Creating Rules

Rules are created when:

• You respond to a popup prompt
• You manually add a rule in Settings
• You import rules from a backup

Smart Toolchain Rules

CyberWall automatically resolves companion executables:

• Git → Auto-detects git-remote-https, ssh, etc.
• Edge WebView2 → Maps host processes correctly
• Node.js → Detects npm, npx, node processes

Rule Storage

Rules are stored in:

%ProgramData%\CyberWall\rules.json

Rule Properties

Each rule stores:

Property	Description
App path	Full path to executable
App name	Display name
Verdict	Allow or Deny
Direction	Inbound, Outbound, or Both
Protocol	TCP, UDP, or Any
Remote address	Specific IP or Any
Remote port	Specific port or Any

---

Process Identity

How CyberWall Identifies Apps

Method	Description
File path	Full executable path
Package identity	UWP/MSIX package resolution
Digital signature	PE file signature verification
Product info	Version, company, product name

WebView2 Host Resolution

Maps Edge WebView2 processes back to their host applications:

• Browser extensions
• Electron apps
• WebView2-based desktop apps

---

Auto-Block Timeout

Configuration

When a prompt is not answered:

• Enabled — Auto-block after timeout
• Duration — 30 seconds to 30 minutes (default: 5 minutes)
• Action — Block the connection

Use Case

Prevents indefinite prompts:

• If you step away from the computer
• If a prompt appears during a fullscreen app
• Reduces unwanted background connections

---

Rule Management

Main Window

The main window shows all rules:

• Search and filter
• Enable/disable individual rules
• Delete rules
• Edit rule properties

Context Menu

Right-click a rule for actions:

Action	Description
Edit	Modify rule properties
Disable	Temporarily disable
Delete	Remove the rule
Open location	Show executable in Explorer

Import/Export

Backup and restore rules:

• Export to JSON
• Import from JSON
• Share rules between machines