SecureWall v0.5.7

SecureWall v0.5.7

Website: https://secwall.org/

This is an unsigned alpha prerelease. A program that is also run by Windows services, such as Google Updater, can now be allowed from the blocked-connection popup in more cases, with an "Allow anyway" button.

Changes

Blocked-connection popup

• Allow anyway for programs that share their file with Windows services. In v0.5.6, Allow stayed unavailable for a program such as Google Updater's updater.exe when SecureWall could not confirm that the blocked process ran none of the services registered to that file. The popup showed "Shared Windows service host" even though SecureWall knew every one of those services. That happened when the block could not be matched to a Security audit event, when the process had exited before SecureWall listed its services, or when that list was unreliable. The popup now shows the program by name with "(program and Windows services)", names each service, and says SecureWall could not tell whether the program or one of those services made the connection. Allow anyway saves the same outgoing-only rule for that exact path as Allow outgoing does, and that rule also lets those services connect. The "Blocked apps not answered" list in the tray menu offers the same choice and wording.
• Still unavailable from the popup. Allow stays unavailable when the process runs more than one service, for svchost.exe, for programs in the Windows folder such as dllhost.exe, and when SecureWall cannot list every service that runs the file. Always allow is still not offered for programs whose file a service also runs.

Downloads and installation

Use SecureWall_x64.msi on Intel/AMD 64-bit Windows, SecureWall_arm64.msi on Windows on ARM, or SecureWall_x86.msi on 32-bit Windows. Verify the download against SHA256SUMS.txt. All installers are unsigned. Keep local console access and recovery installers available offline. Service loss can leave external networking blocked, including DNS and DHCP.

Upgrading from v0.5.2 through v0.5.6. Choose Check for updates in the tray menu or on the Maintenance tab in Manage, then Install.

Upgrading from v0.5.0 through v0.5.6 by hand. Run the v0.5.7 installer for the same architecture at the computer's own keyboard and screen. It upgrades in place and keeps rules, settings and the password. While the service restarts, connections to other computers are blocked, usually for under a minute, and open connections drop; blocks in that window show as "Blocked" in Network Activity and are not prompted. Do not restart or power off the PC while setup runs. If a step fails, setup rolls back to the installed version; In-place upgrade has the recovery steps.

Upgrading from v0.4.2 or older. These versions cannot be upgraded in place. Uninstall SecureWall in Settings > Apps once, then install v0.5.7, following the one-time uninstall steps in the v0.5.0 release notes.

Switching from TinyWall. Follow before switching first. Uninstall TinyWall with its own uninstaller and reboot before installing SecureWall; setup refuses to run while TinyWall or its firewall provider is still registered. To go back to TinyWall later, uninstall SecureWall first and follow rolling back to TinyWall.

Collect a diagnostic report

Read the live testing guide and coverage map. Download the source archive for this tag to obtain tools/diagnostics, or use a checkout of this tag. Run the collector with Windows PowerShell 5.1 as described in its README. It creates a local report and does not upload it.

Logs record software outcomes and observed filtering decisions. They do not prove packet delivery, absence of boot/crash leakage, installer rollback, hostile filesystem resistance or power-loss durability. The bundled blocklists do not automatically update. Review normal-use logs before drawing conclusions about live behavior.