SecureWall v0.4.1

SecureWall v0.4.1

Website: https://secwall.org/

This is an unsigned alpha prerelease for exploratory testing. It fixes the service crash that made every v0.4.0 install fail with MSI error 1722, shows the logs when setup fails, and replaces the setup pages. It is not signed or end-to-end verified. The changes below were checked with unit tests, builds, installer checks and code review only; none of them has been tested on a live installation yet.

Changes

Service start fix

• v0.4.0's service stopped every time it started, so the install rolled back with MSI error 1722. It set a Windows Filtering Platform option through its dynamic session, which Windows refuses (FWP_E_DYNAMIC_SESSION_IN_PROGRESS). The service now sets that option through a short-lived ordinary session.
• That option (collect network events for inbound broadcast and multicast) is shared with other programs and survives reboots. The service now tries to put back the value it found when it stops normally; if that fails, the value it set stays.
• Firewall engine errors now include the Windows error text along with the code.

When setup fails

• The failure page has two buttons: Open SecureWall log opens %ProgramData%\SecureWall\logs\installer.log, and Open setup log opens the Windows Installer log. Every SecureWall setup now writes that log to %TEMP% (MSI*.LOG). Each opens in your default text viewer, so Ctrl+A and Ctrl+C copy the whole log for a report.
• When the SecureWall service fails to install or start, installer.log also holds the service's status and exit codes and the service.log entries written during that attempt. Before this it said only that the service did not start in time. Setup can also stop earlier, for example when TinyWall is still installed or SecureWall rejects its data folder; then the reason is in the setup log, in an earlier message, or in the Windows Application event log under source SecureWall.

Setup pages

• Setup shows its own pages: welcome, before you install, ready to install, progress, finished, cancelled and failed. They replace the main wizard pages inherited from TinyWall and WiX, including the "Remote Installations" page. Standard Windows Installer prompts (preparing, files in use, out of disk space, error messages) remain.
• The license page no longer asks you to accept the GNU GPL v3; the license itself says acceptance is not required to receive or run the program. The ready page shows the notice and a View license button.
• The cancelled page says that a rollback step can fail and leave external traffic blocked, and points to the recovery section of the README.

Other changes

• New icon set drawn for SecureWall, replacing the third-party icons inherited from TinyWall. A grey "?" shield marks the Unknown state (service unreachable).
• The Settings GitHub button and the About link open the SecureWall repository instead of upstream TinyWall.

Downloads and installation

Use SecureWall_x64.msi on Intel/AMD 64-bit Windows, SecureWall_arm64.msi on Windows on ARM, or SecureWall_x86.msi on 32-bit Windows. Verify the download against SHA256SUMS.txt. All installers are unsigned. Keep local console access and recovery installers available offline. Service loss can leave external networking blocked, including DNS and DHCP.

Upgrading. In-place upgrades and repair are still unsupported. If an earlier SecureWall is installed, remove it from Settings > Apps, then install v0.4.1. If a v0.4.0 install failed and its rollback finished, nothing needs removing. If setup then says that SecureWall service deletion is pending, or that an existing SecureWall service must be removed, rollback did not finish its cleanup: close Services and other service-management tools and restart Windows, then try again. If that does not help, follow failed first-install rollback at the local console. The existing %ProgramData%\SecureWall folder is reused if it passes validation. If v0.3.0 is installed, read the upgrade notes in v0.4.0 first.

Switching from TinyWall. Follow before switching first. Uninstall TinyWall with its own uninstaller and reboot before installing SecureWall; setup refuses to run while TinyWall or its firewall provider is still registered. To go back to TinyWall later, uninstall SecureWall first and follow rolling back to TinyWall.

Collect a diagnostic report

Read the live testing guide and coverage map. Download the source archive for this tag to obtain tools/diagnostics, or use a checkout of this tag. Run the collector with Windows PowerShell 5.1 as described in its README. It creates a local report and does not upload it.

Logs record software outcomes and observed filtering decisions. They do not prove packet delivery, absence of boot/crash leakage, installer rollback, hostile filesystem resistance or power-loss durability. The bundled blocklists do not automatically update. Review normal-use logs before drawing conclusions about live behavior.