$ show henrypp/simplewall
simplewall is a native Windows desktop application that functions as a personal firewall using the Windows Filtering Platform (WFP). It controls per-application network access via user-defined rules and blocklists, including built-in Microsoft spy/telemetry lists. The application provides a full GUI with tabs for applications, services, UWP packages, rules, network connections, and logs, along with a tray icon, notification popups, and a rule editor. It logs allowed/blocked connections to a CSV file and supports real-time network monitoring via TCP/UDP statistics (including ETW-based UDP accounting). Profiles are stored in XML format with optional compression and AES encryption, and filters can be installed permanently, temporarily, or at boot time. The architecture is a monolithic C/C++ Win32 application with a custom utility library ("routine") as a submodule. Key modules handle WFP filter lifecycle, WFP net event subscription, network connection enumeration, security descriptor management, and UI controls (listview, search bar, notifications). The code demonstrates deep Windows internals knowledge, including WFP version-specific callbacks, ETW session management, cryptographic hashing, and digital signature verification. While the application is actively maintained (latest beta v3.9.1 as of July 2026), it is tightly coupled to Windows APIs and contains workarounds for historical Microsoft bugs, leading to moderate technical drift risk. Strengths include comprehensive WFP integration, robust logging, and a well-organized codebase with reusable patterns for WFP security (ACL management) and ETW-based UDP monitoring. Weaknesses include reliance on a private library submodule, hardcoded service/port lookup tables, and Windows version-specific branches that may need adjustment for future releases. The project is suitable for developers seeking a reference implementation for WFP firewall development or a reliable Windows filtering tool.
The LLM identified 2 files worth highlighting for reuse:
This module manages Windows Filtering Platform (WFP) security descriptors for engine, provider, sublayer, and filter objects. It revokes excessive rights from default WFP ACLs, ensuring only the application and SYSTEM can modify filters. The implementation uses BuildSecurityDescriptorW and Fwpm*SetSecurityInfo0 and is self-contained enough to be extracted into any WFP-based project that needs to lock down its filter configuration against unauthorized changes.
Implements UDP traffic monitoring via Event Tracing for Windows (ETW) using the AFD provider. It creates an ETW session, subscribes to AFD events, processes them into a hash table keyed by UDP 5-tuple, and exposes polling/reading functions for byte counts. The pattern is reusable for any Windows application requiring per-flow UDP statistics without kernel modifications, and is isolated enough to be adapted independently.