SecureWall v0.4.0 (alpha, unsigned installers)

SecureWall v0.4.0

Website: https://secwall.org/

This is an unsigned alpha prerelease. It adds fixes ported from upstream TinyWall, the fixes from a pre-switch security review, and the removal of Learning mode and the TinyWall update code.

Changes

Fixes ported from upstream TinyWall

• Password storage uses a stronger format (random 16-byte salt, SHA-256, 200,000 iterations) and a constant-time comparison. A password set by an earlier build still works and is converted to the new format the next time you unlock. The password file is readable only by SYSTEM and Administrators.
• SecureWall.exe /uninstall no longer fails in the password dialog while SecureWall is locked.
• The tray icon comes back when Explorer restarts while the controller runs elevated.
• Network Activity shows why a connection was blocked, and its context menu has Copy path and Open folder. Open folder selects the file in Explorer and never runs it.
• The Windows Defender special exception includes MpCmdRun.exe, Defender's command-line tool, which is used for signature updates.
• Dark-mode contrast, icon, focus and context menu fixes; Escape closes the Application Finder; the dead "Search on ProcessLibrary" item is gone.
• Several firewall-engine cleanup paths release their handles correctly after an error.

Security review fixes

• A failed automatic reload no longer stops the service for good and leaves the PC offline until someone restarts it or reboots. When nothing the committed policy relies on has changed, that policy stays in force and the service retries up to three times. Otherwise, including a failed rule expiry or a failed network adapter check, SecureWall withdraws its runtime permissions at once: external traffic is blocked, including DNS and DHCP, while the running service rebuilds its policy. After five failed rebuilds the service exits with an error and Windows restarts it after 5, 30 and 60 seconds. Windows applies the restart setting after the next reboot following installation.
• The always-on deny baseline is no longer registered under the service's name, so it should still load at boot when the service is disabled or set to manual (for example after a failed install). Microsoft's documentation is inconsistent on this point.
• If SecureWall rejects its own data folder as unsafe, removing this version from Settings > Apps now works: a SYSTEM-only emergency release stops and disables the service, restores Windows Firewall and audit settings, and deletes only SecureWall's firewall objects. The rejected folder is left in place as evidence.
• A failed first install rolls back without leaving the PC more open than before, and removes the service registration that used to make the next install fail. If the service cannot be stopped, rollback stops before cleanup and the registration stays. If Windows Firewall's rules cannot be restored, or SecureWall's firewall objects cannot be removed, the deny baseline stays and external traffic stays blocked until you fix the cause from the local console, as described in SECURITY.md.
• Optional startup checks (a leftover TinyWall service found after startup, a missing or locked hosts file, WSL adapter permits) are logged and reported instead of taking the firewall offline. Install and service start still refuse to run next to TinyWall.
• SecureWall uses its own firewall sublayers instead of TinyWall's and refuses to install or start when TinyWall's firewall provider or another program's filters are in its sublayers. The error names each object and how to remove it.
• The blocked-connection popup: Enter no longer allows; Allow stays disabled until the popup has been visible and unmoved for about a second and its risk checks have finished. Clicking Allow while locked asks for the password, then relocks afterward, including after a cancel or wrong password. A popup timing out no longer keeps SecureWall unlocked longer.
• Allowing a program no longer removes a "local network only" restriction from an existing rule for it, and a rule for one Windows service no longer replaces a rule covering all of svchost.exe.
• For a Windows service that has no service SID of its own, the popup disables Allow and explains how to give it one, instead of saving a rule that can never match. One unreadable service registration no longer disables Allow for every program.
• The optional AI lookup works without a manual exception for SecureWall.exe. While it is turned on, SecureWall adds a permit for SecureWall.exe limited to outbound TCP port 443, to any destination, from signed-in accounts; the SYSTEM service cannot use it. Endpoints on other ports are rejected. AI answers are size-limited and labeled as AI-generated.
• Address-scoped rules (local subnet, gateway, DNS) keep matching when rebuilding their address lists fails partway.
• Guard and maintenance failures are written to the Windows Application event log (event IDs 1000 and 1001). service.log and installer.log are rotated to .old.log instead of being cleared.
• Reinstalling delivers the shipped application database and blocklist: install replaces profiles.json and hosts.bck when they differ from the shipped copies. Your configuration, password and recovery files are not touched.

Removed

• The TinyWall update feed and update client are removed, not just disabled. SecureWall never contacts TinyWall's update server. Install new versions from a trusted MSI. An old AutoUpdateCheck setting in saved settings or an imported .tws file is ignored.
• Learning (Autolearn) mode is removed; blocked-connection prompts replace it. A saved configuration or imported TinyWall .tws file that starts in Learning mode loads in Normal mode. Rules learned by earlier builds stay until you delete them.

Emergency release logging

If the emergency release run during removal fails, each failed step now writes one Error event 1001 from source SecureWall to the Windows Application event log, followed by one summary event with the exit code. Before this, a failed removal showed only MSI error 1722 with nothing naming the step.

Downloads and installation

Use SecureWall_x64.msi on Intel/AMD 64-bit Windows, SecureWall_arm64.msi on Windows on ARM, or SecureWall_x86.msi on 32-bit Windows. Verify the download against SHA256SUMS.txt. All installers are unsigned. Keep local console access and recovery installers available offline. Service loss can leave external networking blocked, including DNS and DHCP.

Upgrading from v0.3.0. In-place upgrades and repair are still unsupported. Remove v0.3.0 from Settings > Apps, then install v0.4.0. The existing %ProgramData%\SecureWall folder is reused if it passes validation: your configuration and password carry over, and profiles.json and hosts.bck are replaced with the shipped copies. After upgrading, review your exception list. Earlier builds could learn an svchost.exe rule that allows all TCP and UDP ports for every hosted service; it is not removed automatically. v0.3.0 used TinyWall's sublayer GUIDs; if any of those sublayers are left behind and still belong to SecureWall, the v0.4.0 install or a later uninstall removes them. If the v0.4.0 installer fails with a generic error, check the Application event log for an Error from source SecureWall and stop there; do not change folder permissions to force the install. Removing v0.3.0 runs v0.3.0's own uninstaller, which has neither the emergency release nor the event log entries described above. If v0.3.0 rejects its data folder, its removal fails, the deny baseline stays, and nothing is written to the event log from source SecureWall (Windows Installer still logs the failed removal under its own source). In that case stop at the local console, keep %ProgramData%\SecureWall as it is, do not change its permissions, and follow legacy data and controller recovery.

Switching from TinyWall. Follow before switching first: export your TinyWall settings to a .tws file, copy %ProgramData%\TinyWall outside ProgramData, and save the SecureWall MSI and its hash offline. Uninstall TinyWall with its own uninstaller and reboot before installing SecureWall. This version also refuses to install if TinyWall's firewall provider (66CA412C-4453-4F1E-A973-C16E433E34D0) is still registered. If that happens, reinstall TinyWall, uninstall it again, reboot, and confirm netsh wfp show state no longer contains 66CA412C. To go back to TinyWall later, uninstall SecureWall first and follow rolling back to TinyWall.

Collect a diagnostic report

Read the live testing guide and coverage map. Download the source archive for this tag to obtain tools/diagnostics, or use a checkout of this tag. Run the collector with Windows PowerShell 5.1 as described in its README. It creates a local report and does not upload it.

Logs record software outcomes and observed filtering decisions. They do not prove packet delivery, absence of boot/crash leakage, installer rollback, hostile filesystem resistance or power-loss durability. The bundled blocklists do not automatically update. Review normal-use logs before drawing conclusions about live behavior.