SimpleDeFence 1.0.2

SimpleDeFence 1.0.2

Fixes from a full code review: security hardening, rules that did not do what they said, installer
repair and uninstall, and the tray and settings drifting from what the service had applied.

Install

Download SimpleDeFence_x64.msi below and run it, or let 1.0 or 1.0.1 offer you the update in-app.

Windows 10 version 2004 (build 19041) or newer, or Windows 11, 64-bit.

Verify the download if you like — the SHA-256 is published in
updates/update.json,
and the in-app updater checks it for you before running anything.

Get-FileHash .\SimpleDeFence_x64.msi -Algorithm SHA256

Security

• The service no longer writes logs where a standard user can redirect them. The interface now
  logs to your own profile, and the service's data and log folders are reset to administrators-only
  ownership and permissions, including a data folder someone else created first.
• A custom install folder that non-administrators can write to is locked down.
• Updates only come from this project. Download addresses must be HTTPS on this repository's
  GitHub locations, and an installer with a broken signature is refused.
• Address and port rules reject malformed values — a /256 prefix used to become /0 and
  match every address.
• The password box no longer accepts an empty password.

Fixed

• "Allow for 24 hours" lasts 24 hours. It ended after 19.
• Rules inherited by child processes match. They were installed with the wrong path format and
  never applied until the next full reload.
• A Repair from the installer keeps the firewall installed, and a failed uninstall rolls back
  cleanly.
• The installer's last page has an "Open SimpleDeFence" box, ticked by default. The app did not
  open after installing before.
• The update check no longer stalls the service while it downloads.
• The tray shows an unknown mode when the service is not answering, instead of the last one it saw.
  Switching to Learning from the tray asks first, like the main window.
• Settings and Rules switches go back to what the service holds when a change fails.
• Windows 11 is detected correctly, and several low-level path, adapter and filter reads are fixed.
• An error inside a Windows callback no longer stops the service.
• Exported connection logs cannot run as spreadsheet formulas.
• A configuration file the service refuses is kept as config.rejected instead of being overwritten
  by the defaults.

Upgrading

Installed 1.0 and 1.0.1 clients are offered this release in-app. Your configuration, rules and
password carry over.

Thanks

SimpleDeFence is GPLv3 and stays that way — no paid tier, no upsell. If it is useful to you,
Ko-fi, Buy Me a Coffee or the
Sponsor button on the repository helps keep it going.

SimpleDeFence began life as a fork of TinyWall by Károly
Pados. Please do not report SimpleDeFence issues to TinyWall or its authors.

SimpleDeFence 1.0.1

SimpleDeFence 1.0.1

Two interface fixes, both reported against 1.0. No change to filtering, rules or the service.

Install

Download SimpleDeFence_x64.msi below and run it, or let 1.0 offer you the update in-app.

Windows 10 version 2004 (build 19041) or newer, or Windows 11, 64-bit.

Verify the download if you like — the SHA-256 is published in
updates/update.json,
and the in-app updater checks it for you before running anything.

Get-FileHash .\SimpleDeFence_x64.msi -Algorithm SHA256

Fixed

Rows now highlight under the pointer. They never had, on any release. A list whose items are
not selectable and not clickable is treated by Windows as display-only, and its rows are never put
into the pointer-over state at all — so the highlight the Connections screen had been carrying
since v0.1.1 was unreachable code that had never once run. The giveaway was that hovering a row
would show its executable path in a tooltip while showing no highlight whatsoever: the pointer was
arriving, the row just was not something that could be hovered. The rows are interactive now, and
the highlight is also stronger, which matters on a screen where rows already carry a colour to say
whether traffic stayed on the local network.

Rules entries for uninstalled applications are struck through. A rule whose executable no
longer exists on disk — because the application was uninstalled after the rule was created — now
shows its name struck through in red, with a tooltip saying why. Previously it was
indistinguishable from a rule that was still doing something, so leftover entries accumulated with
nothing to mark them.

Upgrading

Installed 1.0 clients are offered this release in-app. Your configuration, rules and password carry
over; no reinstall or reconfiguration is needed.

Thanks

SimpleDeFence is GPLv3 and stays that way — no paid tier, no upsell. If it is useful to you,
Ko-fi, Buy Me a Coffee or the
Sponsor button on the repository helps keep it going, and a bug report from a real install — like
both of the ones fixed here — is worth just as much.

SimpleDeFence began life as a fork of TinyWall by Károly
Pados. Please do not report SimpleDeFence issues to TinyWall or its authors.

SimpleDeFence 1.0

SimpleDeFence 1.0

The first full release. SimpleDeFence is a free, lightweight, secure-by-default firewall for
Windows: it blocks any application you have not explicitly allowed onto the network, installs no
kernel driver, and collects nothing about you or your machine.

Install

Download SimpleDeFence_x64.msi below and run it. There is no runtime to install first.

Windows 10 version 2004 (build 19041) or newer, or Windows 11, 64-bit.

Verify the download if you like — the SHA-256 is published in
updates/update.json,
and the in-app updater checks it for you before running anything.

Get-FileHash .\SimpleDeFence_x64.msi -Algorithm SHA256

What you get

• Five modes — Normal, Block all, Allow outgoing, Learning, Disabled — switchable from the tray
• A live connections view showing what is connected, what is listening, and what was blocked,
  with one click to allow anything in that list
• Application rules backed by a database of known programs
• Password protection for the running configuration
• Hosts-file blocklists and global hotkeys
• Sixteen languages, with right-to-left layout where the language calls for it

Since 0.1.7

This release closes the last of the reliability work that the 0.1.x series was tracking down, and
adds the faults found auditing the subsystems those releases had not yet reached.

The service could deadlock against its own request queue. The worker thread posted to a bounded
queue that only it consumes — on the inactivity lock, and again after an application-database
update. Either one could block permanently if the queue had filled while the timer was busy, which
left a service that answered nothing while still reporting itself as running. Both now run inline.

A client that stopped reading could park the control pipe. The wait that makes large replies
arrive intact had no time limit, and neither did the write before it, so one wedged client held the
service's only pipe worker and with it every other client. Both are now bounded, after which the
client is disconnected and the service carries on.

The connections screen asked the service for a path once per socket. Rows are per socket, the
answer is per process, and each request was a blocking round-trip through that same single worker —
so one browser holding eighty connections repeated the same lookup eighty times, every refresh. The
lookups are now made once per process.

The hosts blocklist reported success for work it had skipped. Enabling with no blocklist file
present left the settings page claiming it was active; disabling with no saved original left the
blocklist installed and told the caller it had been restored — including during uninstall, which
could leave a machine without the product but still using its hosts file. Both now report what
actually happened.

Windows audit policy is restored rather than switched off. The two Filtering Platform audit
subcategories the firewall log depends on are machine-wide settings. They were previously turned off
on shutdown regardless of how they had been found, which silently disabled auditing an administrator
or a Group Policy had enabled. Their previous values are now read and put back.

Upgrading

Installed 0.1.x clients are offered this release in-app. Your configuration, rules and password
carry over; no reinstall or reconfiguration is needed.

Thanks

SimpleDeFence is GPLv3 and stays that way — no paid tier, no upsell. If it is useful to you,
Ko-fi or the Sponsor button on the repository helps keep it going,
and a bug report from a real install is worth just as much.

SimpleDeFence began life as a fork of TinyWall by Károly
Pados. Please do not report SimpleDeFence issues to TinyWall or its authors.

SimpleDeFence 0.1.7 beta

Fixes the Blocked list. This is the one that actually gets the blocked apps on screen.

What was wrong

The control pipe wrote each reply and then disconnected without waiting for the client to take it. Disconnect() discards whatever has not been read yet, and Flush() does not stand in for waiting — it pushes bytes as far as the kernel buffer, 20 KB here, and returns. Everything past that was thrown away in flight.

Small replies fit and got through, which is why the app looked healthy: it connected to the service, showed no error, and listed connections normally. The firewall log does not fit — it is sent as one message, around 176 KB — so it lost that race every time. It is also the only thing the Blocked list is built from.

That is why the list appeared to flicker: just after the service started, while the log was still nearly empty, the reply was small enough to arrive. Once the log had content, it never arrived again.

Fixed

The server now waits for the client to drain the reply before disconnecting, which is what the disconnect contract asks for. Covered by a test that sends a 500-entry reply through a real pipe and checks the end of it, since a truncated message loses its tail first.

Also in recent betas

• A log that cannot be read is no longer reported as a firewall with nothing to report (0.1.6).
• Blocked events are recorded in every mode, not only while learning (0.1.4).
• A failure in one section of the Connections screen no longer empties the other two.
• The Blocked list reaches back an hour by default, and that is now a setting.

If you are installing for the first time

SimpleDeFence is a whitelist firewall: in Normal mode it blocks all outbound traffic except what you have allowed, so a fresh install will cut apps off until you allow them. Switch to Allow outgoing from the tray icon first if you would rather not lose connectivity while setting up, then allow apps from Rules → Add exception, which has process, window and file pickers.

SimpleDeFence 0.1.6 beta

Fixes the regression in 0.1.4 that left the Blocked list empty.

What 0.1.4 broke

0.1.4 got the blocked events flowing, then lost them in transit.

It raised the firewall's event ring from 500 entries to 5000. But the whole ring is sent as one pipe message on every read, as indented JSON, and read back in 4 KB chunks with a one-second deadline on each chunk:

ring	payload	4 KB reads
500	176 KB	42
5000	1.68 MB	429

A service busy blocking things is exactly the one that cannot service 429 timed reads, so the reply stopped arriving — and a reply that did not arrive was reported as "nothing blocked". The symptom was a Blocked list that worked for a second or two after the service started, while the ring was still nearly empty, and was empty ever after.

On a whitelist firewall that has just blocked everything on the machine, that leaves no way back.

Fixed

• The ring is back to 500 and now holds only drops — the allowed events were discarded by every reader anyway, and were evicting the blocked entries worth seeing.
• A log that could not be read is no longer reported as a quiet firewall. The section now says the list could not be read from the service, instead of claiming nothing was blocked.
• The read deadline for continuing chunks of a reply already in flight is now ten seconds instead of one.
• A failure while rebuilding the list could empty the section with no error shown. Now reported.
• The empty-state no longer promises "the last 5 minutes" — that window is a setting, and defaults to an hour. All sixteen languages.

If you are installing for the first time

SimpleDeFence is a whitelist firewall: in Normal mode it blocks all outbound traffic except what you have allowed, so a fresh install will cut apps off until you allow them. Switch to Allow outgoing from the tray icon first if you would rather not lose connectivity while you set it up, then allow apps from Rules → Add exception, which has process, window and file pickers.

SimpleDeFence 0.1.4 beta

Fixes the Connections screen showing no applications.

The bug

The Blocked section could be empty for ever on any installation never put into Learning mode — with nothing anywhere to say why. No error, no banner, and the Connected and Open lists working normally beside it.

The two Windows audit subcategories that make the Filtering Platform report what it dropped were switched on and off by the firewall-mode switch, and by nothing else. A service that started in Normal mode never enabled them at all, and leaving Learning mode switched them back off. Without them the WFP callback is never called, the event log stays empty, and the section has nothing to show. That audit policy now belongs to the service for its whole lifetime.

Also fixed

• One failure anywhere in the connections gather emptied all three sections — including Connected and Open, which are built from a local API and never needed the service. Each section is now gathered on its own.
• A service that stopped, or one that refuses to be queried, could abort the entire gather.
• Blocked attempts stamped a fraction of a second ahead of the reader's clock were silently discarded, and an attempt that is not listed cannot be released.
• The Connected and Open lists are kept when the service is unreachable, instead of blanking the screen behind an error.

Changed defaults

• The Blocked list now reaches back an hour instead of five minutes — five expired sooner than most people notice an app is broken and go looking for the reason. Configurable.
• The event ring behind it holds 5000 entries instead of 500, so ordinary broadcast traffic no longer evicts the application block worth seeing.

Note

This build enables the Filtering Platform Packet Drop and Filtering Platform Connection audit subcategories while the service runs. That is what makes the Blocked list work; it also means more entries in the Windows Security log.

SimpleDeFence 0.1.3 beta

SimpleDeFence 0.1.3 beta

Everything on main since 0.1.2, in one installer. 0.1.2 remains usable; this
release adds no fix that makes it urgent to replace.

Changes

• A configuration that is present but refused now says so. Three things can make
  the service decline a config file it can plainly see: it cannot be opened at
  all (an ACL, or another process holding it), it fails its authentication tag
  (altered, truncated, or written under a different key), or it is in the
  superseded format on an installation that has already migrated away from it,
  which is refused as a downgrade rather than accepted. All three used to hand
  back exactly what a first run gets - default settings - with no log line and a
  status display reporting a healthy firewall. The firewall actually in force
  was not the configured one, and nothing anywhere said so. Each case is now
  written to the log, naming what was found and noting that the file was left
  alone, and raises a degraded state so the interface says the firewall is
  running on defaults rather than on your settings. The wording is translated
  into all sixteen interface languages.
• The file is still never rewritten or deleted in any of those cases, so a
  configuration refused for a reason you can fix stays there to be fixed.
• A configuration the pre-3.0 XML reader throws on is reported the same way. It
  throws rather than falling back, and that exception used to be caught and
  discarded, which is the same silence by a different route.
• The update descriptor advertises this release, so 0.1.2 installations will be
  offered it.

Verified

• The test suite passes: 209 tests, six of them new and covering each ending the
  configuration reader can reach, including the one where a file is present but
  locked - previously indistinguishable from no file at all.
• CI is green on the commit this installer was built from, across both toolchains
  and both configurations.
• The installer in this release was built from that same commit and reports
  version 0.1.3.

Not verified

• This installer has not been installed on a machine. 0.1.2's install and
  uninstall cycle was exercised end to end; nothing in this release touches the
  installer, the service lifecycle, or the control pipe, but that is reasoning
  rather than a test run.
• The new degraded-state banner has not been watched appearing in front of a
  live service holding a genuinely unreadable configuration. What is covered is
  the layer below it: the reader's verdict, under test, for each way a file can
  be refused.

Known issues

• On a standard user account the GUI runs unprivileged and cannot command the
  service; it says so and offers to restart elevated.
• The installer is not code-signed.

SimpleDeFence 0.1.2 beta

SimpleDeFence 0.1.2 beta

A fix release. 0.1.1 should be replaced rather than kept: the service ran and
the firewall worked, but nothing could talk to it.

Fixes

• The control pipe refused every request. The service authorized a caller by
  impersonating it and only then read the request, which Windows does not
  permit - ImpersonateNamedPipeClient fails until the server has read from the
  pipe. The check therefore threw on every request, and a failure to establish
  who is calling is treated as a refusal, so the refusal was total. The service
  still reported itself as Running, which is why the symptom was a GUI that
  could not connect while asking whether the service was installed and running.
  The request is now read before the caller is authorized.
• The uninstall failed part-way through and rolled back. It asked the service
  to stop over that same pipe, ignored the answer, waited fifteen seconds and
  then failed the whole transaction - leaving the product registered and half
  removed, with stopping the service by hand in services.msc the only way out.
  It now checks the answer, falls back to the service control manager, and
  continues with removal rather than rolling back.
• The update descriptor advertised 0.1.0, which is below the 0.1.1 it was meant
  to supersede, so no installed client would ever have been offered an update.

Verified

• A clean install and a normal uninstall were run on a Windows 11 machine with
  no leftover configuration. The service starts, registers its firewall
  objects, and logs no exceptions for the whole cycle; the uninstall completes
  in about four seconds and removes the service, the product registration, the
  install directory and every firewall object.
• The GUI has still not been exercised on a real desktop. The control pipe was
  confirmed through the same client code the GUI uses, not through the window.

Known issues

• On a standard user account the GUI runs unprivileged and cannot command the
  service; it says so and offers to restart elevated.
• The installer is not code-signed.

SimpleDeFence 0.1.1 beta

SimpleDeFence 0.1.1 beta

Beta. The GUI changes in this release have not been exercised on a real
desktop yet - the tray icon in particular is new Win32 interop that has
never been run - so treat it as a test build rather than an upgrade.

Security

• The control pipe between the service and the GUI could be taken over by
  any local process. The server destroyed and rebuilt its pipe for every
  request, leaving the name unowned in between; whoever claimed it in that
  gap received the GUI's next message, and the unlock message carries the
  configuration passphrase in cleartext. The instance is now permanent,
  and the client verifies the pipe is owned by LocalSystem before it
  writes anything.
• The pipe admitted Authenticated Users - every account that can log on -
  with an image-path comparison standing in for authorization, which any
  copy of the shipped GUI satisfies because the GUI and the service are
  the same executable. It is now restricted to Administrators and SYSTEM,
  and the server requires the caller's effective token to hold the
  Administrators role.
• The GUI elevates when it can. Its privilege level used to depend on how
  it was launched: elevated from the logon task, unprivileged from the
  Start Menu.
• Learning mode auto-whitelisted svchost.exe, granting every service that
  shares that host unrestricted TCP and UDP access, permanently.
• The service followed directory junctions while stripping ACLs as
  LocalSystem, in a tree it also grants users write access to.
• The updater verified the downloaded installer and then launched it as
  two separate steps, and could not launch it at all.

Fixes

• Auto-update never worked on any install: clients asked for a module
  name for an architecture this project does not build.
• Exception merging could delete a rule or duplicate one depending on
  insertion order.
• The tray icon had no exception boundary at its native window callback.

Changes

• Own tray implementation; the H.NotifyIcon.WinUI dependency is gone.
• Connection rows highlight on hover and show the executable's full path.
• Allow asks which policy to apply instead of applying the widest one.
• Dialogs, menus and flyouts follow the app's light/dark setting.
• The install directory drops from 396 files and 229 MB to 326 and
  177 MB; the installer from 75.5 MB to 54.3 MB.

Known issues

• On a standard user account the GUI runs unprivileged and cannot command
  the service; it says so and offers to restart elevated.
• The installer is not code-signed.

SimpleDeFence 0.1.0 (beta)

First public beta of SimpleDeFence — a free, lightweight, non-intrusive firewall for Windows.

It sits in the notification area and blocks any application you have not explicitly allowed onto
the network. It installs no kernel drivers, so it cannot destabilise the system, and it collects
no data about you or your machine.

Rather than replacing the Windows firewall, it drives it: rules are applied through the Windows
Filtering Platform by a background service running as LocalSystem, while the interface is a
separate unelevated process that talks to it over a named pipe. Closing the window does not stop
protection.

Please read before installing

This is a beta, and it is firewall software. In Normal mode everything is blocked except what
you have allowed, so expect to allow applications by hand before they can reach the network — and
be ready to switch to Disabled from the tray icon if something you need stops working. Try it
somewhere you can afford to lose connectivity before you put it on a machine you depend on.

What's in it

• Five modes — Normal, Block all, Allow outgoing, Learning, Disabled
• Application rules with a built-in database of known programs
• A live connections view, with configurable auto-refresh and optional logging to disk
• Password protection for the running configuration
• Hosts-file blocklists, updated on request
• Global hotkeys for allowing an executable, a running process or a visible window
• English and Brazilian Portuguese interfaces

Requirements

• Windows 10 version 21H2 (build 19044) or newer — x64
• No .NET install needed; the build is self-contained

Download

SimpleDeFence-0.1.0-x64.msi

SHA256  2719D9A15C0975CA5668F190081316DDB13619354E6855E540707C4EF4223C58

The installer is unsigned, so SmartScreen will warn on first run. Verify the hash above before
installing if that matters to you.

Credits

Built on TinyWall by Károly Pados as its original code
base, under the GPLv3 — which this project also carries. See LICENSE.txt and the origin table in
the README.