PacketHound makes Windows Firewall ask before apps go online

PacketHound is a Windows tool that turns the built-in Windows Firewall into an "ask me first" firewall for outgoing connections. Its page pitches it against firewalls that, in its words, mostly watch only what comes in: PacketHound watches what goes out. The first time an app tries to reach the internet, a prompt shows who made the app, where it is going and on which port. You click Allow or Block, for the whole app or for just one address, host or domain, and you choose whether the answer lasts forever or only until the app quits.

The mechanism is deliberately plain. PacketHound switches Windows Firewall's outgoing default to block, so a program with no rule cannot reach the internet. Windows logs each blocked attempt, and PacketHound watches that log. For each attempt it checks whether the program is part of Windows, and if so it allows it quietly. Everything else gets a prompt showing the app, its publisher and its destination. The answer becomes an ordinary firewall rule.

To avoid flooding the user with questions about system services, Windows' own components are allowed automatically. A program counts as Windows only if it lives in a Windows folder, is owned by the system and carries a valid Microsoft Windows signature, so, the page says, copying malware into System32 does not earn it a free pass. There is one exception: PowerShell, curl, certutil, mshta and rundll32, which malware likes to use for downloading payloads, still trigger a prompt even though they belong to Windows.

The page says there is no kernel driver and no background service of its own. Every decision is a normal Windows Firewall rule visible in wf.msc, and it keeps working even when PacketHound is closed. Prompts appear on top without taking keyboard focus, so you cannot answer one by accident while typing. The interface lets you flip any app between Allow and Block with one switch, search and sort rules, see when each decision was made, and clear out rules for uninstalled programs. An activity log lists every blocked attempt with hostname, port and outcome. If you are not sure, you can leave an app undecided: it stays blocked and is listed on the Rules tab under "Waiting for your decision", and PacketHound asks again after 10 minutes if the app is still running, or the next time it connects.

The tool is free for Windows 10 and 11, with no trial, no account and no adverts; the author invites a "buy me a coffee" donation. The full source code is on GitHub under the GNU General Public License v3. On privacy, the page says PacketHound collects nothing and has no analytics. It does a normal DNS lookup of the server names apps try to reach, so it can show "example.com" instead of a bare IP address, and once a week it asks the PacketHound website whether a newer version exists. That request contains nothing about the user or the PC and can be turned off.

Some practical points from the page's FAQ. Windows asks you to confirm when you start PacketHound, because changing Windows Firewall settings and reading the Security event log both need elevated rights; if you let it start at sign-in, it starts without asking. Installers may give up because their first connection is blocked before you can answer; the fix is to click the notification after allowing it, or right-click the tray icon and choose Pause protection for 5 minutes, then run the installer again. Pause protection is also offered for 15 minutes, an hour, or until you turn it back on, and while paused, apps without a rule can connect freely but your Block rules still apply. When you exit, PacketHound asks whether to keep blocking apps that do not have a rule yet; apps you blocked stay blocked either way. Windows SmartScreen may warn about the installer because few people have downloaded it yet; the page says to click More info, then Run anyway, and offers a SHA-256 checksum on the download page for verification. Uninstalling is done from Windows Settings; the uninstaller asks whether to delete PacketHound's rules and then restores Windows Firewall's settings to how they were before. PacketHound works alongside Microsoft Defender and most antivirus software, but cannot work if a third-party security suite has replaced Windows Firewall with its own.

Key facts

• PacketHound sets Windows Firewall's outgoing default to block, then prompts Allow or Block the first time an app tries to connect, showing the app, publisher, destination and port.
• Windows components are allowed automatically (Windows folder, system-owned, valid Microsoft signature), but PowerShell, curl, certutil, mshta and rundll32 still trigger a prompt.
• Decisions are ordinary Windows Firewall rules visible in wf.msc; there is no kernel driver or background service of its own, and the rules keep working when PacketHound is closed.
• Free for Windows 10 and 11 with no trial, account or adverts; source code is on GitHub under GPLv3.
• The page says it collects nothing and has no analytics; it does DNS lookups of server names and a weekly update check that can be turned off.

Why it matters

Most people never see which programs on their PC make outgoing connections, and the page argues that most firewalls only watch what comes in. PacketHound puts a first-connection prompt on top of the Windows Firewall that is already installed. The design choice that stands out is that it adds no driver and no service: it flips the outgoing default to block, reads the log of blocked attempts and turns each answer into a standard firewall rule.

Who it affects

Windows 10 and 11 users who want to know and control what their installed apps talk to, including people who want an extra check against malware that uses built-in tools such as PowerShell, curl, certutil, mshta and rundll32 to download payloads. It does not help anyone who runs a third-party security suite that has replaced Windows Firewall, since PacketHound then has nothing to manage.

How to use it

Install it (free, Windows 10 and 11) and confirm the Windows prompt at start. From then on, each new app that tries to connect triggers a prompt where you choose Allow or Block, for the whole app or one address, host or domain, permanently or until the app quits. Change your mind from the Rules tab with one switch, or delete the rule and PacketHound will ask again. Undecided apps stay blocked and are listed under "Waiting for your decision". For installers that fail because their first connection is blocked, use Pause protection from the tray icon (5 minutes, 15 minutes, an hour, or until turned back on) and run the installer again. Uninstall from Windows Settings, Apps; the uninstaller offers to delete the rules and restores the earlier firewall settings.

How solid is it

Everything above comes from PacketHound's own product page, so these are the project's claims about itself. The page says the full source is on GitHub under GPLv3, so anyone can read or build it, and that every decision is a visible Windows Firewall rule. The page names no author or developer, only a "buy me a coffee" link, and gives no version number, release date or download count. No independent audit, security review or benchmark is mentioned.

Risks and caveats

The default-deny approach means a new program is blocked until you answer, so some installers give up before you can respond and need a paused-protection retry. While protection is paused, apps without a rule can connect freely, though Block rules still apply. PacketHound needs Windows' administrator confirmation at start, because changing firewall settings and reading the Security event log require it. Windows SmartScreen may warn about the installer, which the page attributes to few people having downloaded it so far. It cannot work if a third-party suite has replaced Windows Firewall. The page does not cover inbound connection filtering.

“No kernel driver, nothing hidden. Every decision is an ordinary Windows Firewall rule you can see in wf.msc, and it keeps working even when PacketHound is closed.”

— PacketHound product page