SimpleDeFence 1.0

SimpleDeFence 1.0

The first full release. SimpleDeFence is a free, lightweight, secure-by-default firewall for
Windows: it blocks any application you have not explicitly allowed onto the network, installs no
kernel driver, and collects nothing about you or your machine.

Install

Download SimpleDeFence_x64.msi below and run it. There is no runtime to install first.

Windows 10 version 2004 (build 19041) or newer, or Windows 11, 64-bit.

Verify the download if you like — the SHA-256 is published in
updates/update.json,
and the in-app updater checks it for you before running anything.

Get-FileHash .\SimpleDeFence_x64.msi -Algorithm SHA256

What you get

• Five modes — Normal, Block all, Allow outgoing, Learning, Disabled — switchable from the tray
• A live connections view showing what is connected, what is listening, and what was blocked,
  with one click to allow anything in that list
• Application rules backed by a database of known programs
• Password protection for the running configuration
• Hosts-file blocklists and global hotkeys
• Sixteen languages, with right-to-left layout where the language calls for it

Since 0.1.7

This release closes the last of the reliability work that the 0.1.x series was tracking down, and
adds the faults found auditing the subsystems those releases had not yet reached.

The service could deadlock against its own request queue. The worker thread posted to a bounded
queue that only it consumes — on the inactivity lock, and again after an application-database
update. Either one could block permanently if the queue had filled while the timer was busy, which
left a service that answered nothing while still reporting itself as running. Both now run inline.

A client that stopped reading could park the control pipe. The wait that makes large replies
arrive intact had no time limit, and neither did the write before it, so one wedged client held the
service's only pipe worker and with it every other client. Both are now bounded, after which the
client is disconnected and the service carries on.

The connections screen asked the service for a path once per socket. Rows are per socket, the
answer is per process, and each request was a blocking round-trip through that same single worker —
so one browser holding eighty connections repeated the same lookup eighty times, every refresh. The
lookups are now made once per process.

The hosts blocklist reported success for work it had skipped. Enabling with no blocklist file
present left the settings page claiming it was active; disabling with no saved original left the
blocklist installed and told the caller it had been restored — including during uninstall, which
could leave a machine without the product but still using its hosts file. Both now report what
actually happened.

Windows audit policy is restored rather than switched off. The two Filtering Platform audit
subcategories the firewall log depends on are machine-wide settings. They were previously turned off
on shutdown regardless of how they had been found, which silently disabled auditing an administrator
or a Group Policy had enabled. Their previous values are now read and put back.

Upgrading

Installed 0.1.x clients are offered this release in-app. Your configuration, rules and password
carry over; no reinstall or reconfiguration is needed.

Thanks

SimpleDeFence is GPLv3 and stays that way — no paid tier, no upsell. If it is useful to you,
Ko-fi or the Sponsor button on the repository helps keep it going,
and a bug report from a real install is worth just as much.

SimpleDeFence began life as a fork of TinyWall by Károly
Pados. Please do not report SimpleDeFence issues to TinyWall or its authors.