Guard Your Net Firewall v0.99.129

GunWall 0.99.129

Upgrading? Press Check for updates in Settings, or run the installer over
the top. Rules, blocklists and settings are kept — they live in
%ProgramData%\GunWall, outside the application folder.

---

New

Who made each device on your network

Network scan → Vendor database downloads IEEE's public MAC registry and adds a
VENDOR column. About 4 MB, fetched only when asked, stored locally and never
bundled — so the data stays current instead of ageing with the binary.

IEEE publishes three registries with different prefix lengths — 24, 28 and 36
bits — and in the longer ranges the first 24 bits belong to IEEE, not to the
manufacturer. Matching is longest-prefix-first, so devices in those ranges show
their real vendor rather than a confidently wrong one.

Devices with randomised MAC addresses show no vendor, because none exists.

Name your devices

Double-click any row on the network scan to label it — My homelab, Door
CCTV, Kitchen speaker. Names appear in a YOUR NOTE column and persist
across scans and restarts.

Stored against the MAC address, not the IP, so a name follows its device when
the router hands out a different lease. A label that is wrong is worse than one
that is missing, because it gets believed.

Devices that randomise their MAC are warned at the moment you name them, with an
explanation of what to change if the label should stick.

Exempt an application from blocklists

App properties → Blocklists — for the browser you do development work in, or
anything that legitimately needs a domain a curated list blocks.

The exemption applies to kernel-level address blocking. Blocked names are still
refused by GunWall's own DNS resolver, which cannot tell which application asked;
the dialog says so rather than implying more. Exempt applications are marked in
the Applications list, because an exemption nobody can see is one they set once
and forget.

Version in the sidebar

Under Engage lockdown, where you already look to check state — rather than at
the bottom of Settings.

---

Fixed

Your theme choice was not restored on launch

Selecting the light theme saved correctly and was then ignored. Every launch
painted dark.

The save was never at fault. The theme was read from the settings store eight
lines before the store was loaded, so it received the built-in default with no
error and nothing to indicate the value was not yours. Affected every route to a
fresh process: closing and reopening, restarting Windows, and installing an
update.

An error dialog during full-screen games

Launching a game in exclusive fullscreen raised "An unexpected error
occurred: desktop composition is disabled."

Exclusive fullscreen makes Windows hand off desktop composition, and WPF's window
chrome answers by asking to redraw a border that no longer exists. It concerns the
window frame and nothing else — no rule, filter or kernel state is involved.

The dialog was effectively invisible: the connection prompt sits always-on-top and
this one does not, so it rendered underneath and stayed behind the game. The only
symptom that surfaced was a second loss of focus, indistinguishable from the
prompt that preceded it. It is now recognised and recorded quietly, with no
dialog.

Exporting diagnostics could destroy your VirusTotal API key

The export redacted the key by blanking it on the live settings object,
serialising, and putting it back. Correct on one thread — but the export runs in
the background for several seconds while the interface stays live, so anything
that saved during that window wrote the placeholder to disk as the real key.
Approving one application at a prompt was enough.

Redaction now happens on a copy. The bundle still carries no key, and the stored
one cannot be touched.

Your API key is also preserved across upgrades, uninstall (which asks, and
defaults to keeping it) and Reset to defaults.

Rules that pointed at nothing

Applications updating into versioned folders left rules behind holding kernel
filters that did nothing. One machine had sixteen, holding sixty-four filters, and
the list grew with every application update.

These are now removed at startup — but only when the volume proves them gone.
A program on an unplugged USB drive or an unreachable share is left alone, because
removing that rule would destroy a decision you made and you would have no idea
why. The filters go with the rule, so nothing is orphaned.

Traffic totals that disagreed with each other

A destination the GeoIP data could not place was counted in the total and then
discarded before reaching the country tables. The header could honestly read
"81 destinations across 3 countries" while twenty of those belonged to no
country at all, and nothing said so.

Now reported explicitly — "20 could not be matched to a country" — and when no
GeoIP data is present, the line says to download it rather than reporting zero
countries and leaving you to guess why.

Interface

• Dialog fields hid their own text. Forcing a fixed height on WPF UI's
  dropdowns and text boxes left twelve pixels for content, so a typed domain was
  squeezed out of view and the field looked empty while holding a value. Two
  earlier attempts changed the width, which was never the constraint.
• A pasted URL became a rule that matched nothing. Access rules stored values
  verbatim, so https://example.com/ sat in the list looking identical to the
  rule that worked while matching nothing, ever. Domains are now normalised and
  duplicates refused.
• The network graph shook where the trace left the chart. It overhung the
  right edge but began one step inside the left, so its endpoint flexed once per
  second.

---

Changed

• The connection map draws twice as many arcs — twenty rather than ten, so a
  destination dot on a busy machine is less likely to appear without the line
  explaining where it came from.
• Publisher identity is now Ox1d3x3 consistently across the application, the
  installer and Add/Remove Programs.

---

Install

File	For
GunWall-0.99.129.0-setup.exe	Recommended. Its uninstaller removes GunWall's kernel filters before deleting anything.
GunWall.exe	Portable. Run as administrator.

Requires Windows 10 (2004+) or Windows 11, 64-bit, with administrator rights.

SmartScreen will warn you. GunWall is deliberately not code-signed — a
certificate is a recurring cost this free project will not pass on. Verify the
checksums below instead:

certutil -hashfile GunWall-0.99.129.0-setup.exe SHA256

SHA-256

GunWall-0.99.129.0-setup.exe  5A7559FCA1D7D6821A84FED98274E2D1C5B99A68F006F64C7F29CFB4237EBFC6
GunWall.exe                   CB4910B005D58C59C79D4CC41F7805BD90A5D76A3195D9C94ACF717FCC76BC5B

Keep each file name and its hash on the same line — GunWall's updater reads this
section to verify downloads, and matches on the file name.

Running portable? Use Settings → Remove all GunWall filtering before deleting
the folder. The filters live in the Windows kernel and outlive it.

---

Known limitations

• Blocking a domain hosted on a large CDN is unreliable. GunWall blocks the
  addresses it has observed a name resolve to; large providers rotate faster than
  that. Domain blocking works well against trackers on stable hosts.
• A closed GunWall cannot prompt. Filters keep enforcing, so an unapproved
  program is correctly denied and simply fails. Enable Run at startup if that
  matters.
• IPv6 country and ASN enforcement is unverified in practice. The fixes are
  correct by inspection and share code with the IPv4 path, but no test machine
  here has routable IPv6. Reports welcome.
• Single elevated process. Service isolation is the last architectural item
  before 1.0, and is what separates tamper detection from tamper prevention.

---

Full history: CHANGELOG.md ·
Documentation: User Guide ·
Comparison: How GunWall compares

Problems? Settings → Export diagnostics and
open an issue. The bundle contains no
browsing history, no credentials and no personal data.

Guard Your Net Firewall v0.99.116

GunWall 0.99.116

Adds one-click updating, fixes three IPv6 enforcement bugs, and puts screen
shortcuts on the tray icon.

Upgrading from 0.99.113? Run the installer over the top. Your rules,
blocklists and settings are kept — they live in %ProgramData%\GunWall, outside
the application folder.

---

One-click update

Settings → Check for updates now downloads the release installer and runs it,
instead of opening a browser and leaving the rest to you. GunWall closes while the
installer works and your configuration is untouched.

This updater downloads code and runs it with administrator rights, so two things
guard that:

• The download host is pinned to this repository, checked before the request
  and again on whatever answers after redirects. A tampered API response cannot
  redirect an elevated install somewhere else.
• The checksum is verified. A file whose SHA-256 disagrees with the release is
  deleted rather than offered. A file with no published checksum is offered with
  that stated plainly, and the dialog defaults to No.

GunWall never replaces its own executable — it hands the file to the installer,
which closes GunWall before writing anything.

Fixed — IPv6 enforcement

Three guards were left behind when IPv6 support landed. Each was written when the
GeoIP table was IPv4-only and the kernel engine could not express a v6 address
block; both of those were fixed, and the guards were not. None of them produced
an error — they simply did nothing.

• Country and ASN rules ignored every IPv6 connection while the interface
  reported them as enforced.
• "Block direct connections" let IPv6 through entirely. An application under
  that scope could reach any IPv6 address, unresolved and unblocked.
• The GeoIP status lines reported one number, which silently meant IPv4 only.
  Both counts are now shown.

Verification note: the two enforcement fixes are correct by inspection and by the
shared code they now route through, but the test machine has IPv6 disabled, so
they are not yet confirmed in practice. If you have routable IPv6 and try them,
please say what you find.

Added — tray shortcuts

Right-clicking the tray icon now offers Applications, Connections,
Activity, Security and Settings, each opening GunWall directly on that
screen.

Documentation

• A full user guide — installing, configuring, every
  screen, and troubleshooting, in nineteen chapters
• An honest comparison with simplewall, TinyWall, Portmaster
  and GlassWire, including where each of them is the better choice
• Screenshots, and a rewritten README

---

Install

File	For
GunWall-0.99.116.0-setup.exe	Recommended. Its uninstaller removes GunWall's kernel filters before deleting anything.
GunWall.exe	Portable. Run as administrator.

Requires Windows 10 (2004+) or Windows 11, 64-bit, with administrator rights.

SmartScreen will warn you. GunWall is not code-signed — a certificate is a
recurring cost this free project will not pass on. Verify the checksums below
instead:

certutil -hashfile GunWall-0.99.116.0-setup.exe SHA256

SHA-256

GunWall-0.99.116.0-setup.exe  - 306C16B76C5A50BEF8AFA26DF896524E9FCBF8199FFC2B24B02367B273364888
GunWall.exe   - 62D3C93E4925723A68C11B16EBF620AFB0CC5B81441C36B75971A6DB8D48EF01                

Keep the file name and its hash on the same line. GunWall's updater reads this
section to verify the download, and matches on the file name so the portable
build's checksum cannot be picked up by mistake.

Running portable? Use Settings → Remove all GunWall filtering before deleting
the folder. The filters live in the Windows kernel and outlive it.

---

Full changelog: CHANGELOG.md ·
Problems: open an issue with a
diagnostics export from Settings → Export diagnostics

Guard Your Net Firewall v0.99.113

GunWall 0.99.113 -- first public beta

A zero-trust application firewall for Windows 11, built directly on the Windows
Filtering Platform. Free, MIT-licensed, no account, no telemetry, no ads.

Download ·
GunWall-0.99.113.0-setup.exe for the installer, or GunWall.exe to run portable.

---

What it does

Every application must be approved before it reaches the network. Anything without
a rule is denied by the kernel and raises a prompt showing who is asking, where
they are going, and what is known about them — publisher, signature status,
destination country and network operator, and a VirusTotal verdict if you supply a
key.

Beyond that:

• Ordered custom rules matching on address, port, protocol, direction, domain,
  country or ASN
• A curated system-rule library — stealth mode, block inbound, block SMB,
  NetBIOS, Telnet and RDP, allow common services, with kernel coverage shown
• A local DNS resolver with DNS-over-HTTPS, a fail-closed default,
  CNAME-cloaking defence, and blocklists with an explicit allow level
• Per-application domain blocking, so blocking a tracker cannot disconnect
  anything else that shares its address
• Live visibility — connections, packet log, per-application bandwidth, a
  connection map, and a network scanner that identifies devices by name, likely
  operating system and gateway role
• Lockdown to cut all traffic instantly, and snooze to pause enforcement
  for a set period
• Rule profiles for switching whole rulesets

Getting the machine back

A firewall you cannot turn off is a trap. GunWall's filters are persistent by
design — they survive closing the app, a crash and a reboot — so every exit is
verified against the kernel rather than against GunWall's own reporting:

Route	What it does
Protection switch	Removes every filter. Rules are kept for when you switch back on.
Remove all GunWall filtering	Removes filters, clears the hosts file, restores adapter DNS, and clears saved rules.
Uninstaller	Runs the above automatically, checks it succeeded, and stops and warns if it did not.
GunWall.exe --unblock	Restores the machine from a command prompt when the interface will not open.

You can confirm any of these independently:

netsh wfp show filters file=%TEMP%\gw.xml

Before you install

• Windows 10 (2004+) or Windows 11, 64-bit, administrator rights.
• Expect prompts for the first ten minutes. Default-deny means every program
  asks once.
• SmartScreen will warn you. GunWall is deliberately not code-signed — a
  certificate is a recurring cost this free project will not pass on. Verify the
  SHA-256 published with the release instead:
  certutil -hashfile GunWall.exe SHA256
• If you run portable, use Remove all GunWall filtering before deleting the
  folder. Filters live in the kernel and outlive the folder. The installer's
  uninstaller does this for you.

Known limitations

• Blocking a domain hosted on a large CDN is unreliable. GunWall blocks the
  addresses it has observed a name resolve to; large providers rotate faster than
  that. Domain blocking works well against trackers on stable hosts.
• A closed GunWall cannot prompt. Filters keep enforcing, so an unapproved
  program is correctly denied and simply fails. Enable Run at startup if that
  matters to you.
• Single elevated process. Service isolation is the last architectural item
  before 1.0.
• Tested on a small number of machines. Your Windows build, VPN and security
  software are combinations nobody has tried.

Reporting a problem

Settings → Export diagnostics (.zip) and open an issue. The bundle contains the
session log, your settings with secrets removed, active rules and network
configuration — no browsing history and no personal data.

Describe what you saw rather than what you think caused it. A full-window
screenshot helps for anything visual.

github.com/ox1d3x3/gunwall/issues

---

The complete history of every change is in https://github.com/ox1d3x3/gunwall/blob/main/CHANGELOG.md