Asks once, remembers
The first time an app tries to connect, you see who made it, where it's going and on which port. Click Allow or Block, for the whole app or just one address, host or domain, and keep it forever or only until the app quits.
Outbound firewall for Windows Know which apps are calling home.
Most firewalls only watch what comes in. PacketHound sniffs out what goes out: the first time an app tries to connect to the internet, it asks you to Allow or Block, and remembers your answer.
Every connection, your call
PacketHound turns Windows Firewall into an "ask me first" firewall for outgoing connections, without drowning you in questions about Windows itself.
Windows stays quiet
Windows' own components are allowed automatically, so you're only asked about the apps you installed, not about hundreds of system services.
Hard to fool
A program only counts as Windows if it lives in a Windows folder, is owned by the system and carries a valid Microsoft Windows signature. Copying malware into System32 doesn't get it a free pass.
Watches risky tools
Malware loves PowerShell, curl, certutil, mshta and rundll32 for downloading payloads. PacketHound still asks before those connect, even though they're part of Windows.
Built on Windows Firewall
No kernel driver, nothing hidden. Every decision is an ordinary Windows Firewall rule you can see in wf.msc, and it keeps working even when PacketHound is closed.
Never steals your typing
Prompts appear on top without taking keyboard focus, so you can't answer one by accident while you're typing.
Rules at a glance
Flip any app between Allow and Block with one switch. Search, sort, see when each decision was made, and clear out rules for programs you've uninstalled.
See what was blocked
The activity log shows every blocked attempt with its hostname, port and what happened next. Not sure yet? Decide later, and come back to it from the Rules tab.
Screenshots
Click any picture to see it full size.
How it works
No drivers, no background service of its own: PacketHound builds on the firewall that's already part of Windows.
-
Unknown apps are blocked
PacketHound switches Windows Firewall's outgoing default to block, so a program without a rule can't reach the internet.
-
PacketHound notices
Windows logs each blocked attempt. PacketHound watches that log, checks whether the program is part of Windows, and allows it quietly if so.
-
You decide
For everything else you get a prompt showing the app, its publisher and where it's connecting. Your answer becomes a firewall rule, for the whole app or one destination, kept forever or until the app quits.
Good to know
- The first attempt fails. PacketHound learns about an app because its connection was blocked, so after you click Allow the app has to try again. Most do so automatically; a browser just needs a refresh.
- Installers. Some installers give up after that first blocked attempt. After you allow one, PacketHound offers to pause protection for 5 minutes so you can run it again. Signed installers and updaters it has seen before are let through before they even start.
- Rules cover the whole app by default. You can limit one to an IP address, host or domain instead. Windows Firewall only matches IP addresses, so PacketHound adds a name's addresses as the app uses them; the first connection to a new address may need a retry. Sites that share an address (common with CDNs) share the rule too.
- "Until the app quits" means every process has ended, not just that its window is closed. Some apps keep running in the background after you close them: browsers such as Edge and Chrome, and apps that sit in the system tray like Discord or Steam. Their temporary rule stays until the last process exits. In Edge, you can turn off Startup boost and Continue running background extensions and apps when Microsoft Edge is closed under Settings › System and performance; in Chrome, the background-apps setting is under Settings › System. Tray apps usually quit from their tray icon's menu.
- Work PCs: if your organisation manages firewall settings through Group Policy, those settings win.
Questions
Is PacketHound free?
Yes. There's no trial, no account and no adverts. If you find it useful, you can buy me a coffee.
Is PacketHound open source?
Yes. The full source code is on GitHub, under the GNU General Public License v3. You don't have to take our word for what PacketHound does: you (or someone you trust) can read exactly how it works, or build it yourself.
Does PacketHound send my data anywhere?
No. PacketHound doesn't collect anything and has no analytics. It looks up the names of the servers apps try to reach (a normal DNS lookup), so it can show you "example.com" instead of a bare IP address, and once a week it asks this website whether there's a newer version. That request contains nothing about you or your PC, and you can turn it off. See the privacy page.
Windows says "Windows protected your PC". Is it safe?
That's Microsoft SmartScreen's warning for programs it hasn't seen many people download yet. Click More info, then Run anyway. You can check the file is exactly the one published here by comparing its SHA-256 checksum with the one on the download page.
Why does it need administrator rights?
Changing Windows Firewall settings and reading the Security event log both require them, so Windows asks you to confirm when you start PacketHound. If you let it start when you sign in, it starts without asking.
What happens when PacketHound isn't running?
Your rules keep working: they're ordinary Windows Firewall rules. When you exit, PacketHound asks whether to keep blocking apps that don't have a rule yet. Either way, apps you blocked stay blocked.
I blocked something by mistake. How do I undo it?
Open PacketHound from the notification area, find the app on the Rules tab and flip its switch to Allow. Or delete the rule, and PacketHound will ask about the app again next time.
Can I pause it?
Yes. Right-click the tray icon and choose Pause protection, for 5 minutes, 15 minutes, an hour, or until you turn it back on. A timed pause turns protection back on by itself. While paused, apps without a rule can connect freely; your Block rules still apply.
An installer says it failed. What should I do?
Its first connection was blocked before you could answer, and some installers give up straight away. Click the notification PacketHound shows after you allow it (or right-click the tray icon › Pause protection › For 5 minutes) and run the installer again. Protection turns back on by itself. Next time, PacketHound recognises that installer and lets it through before it starts.
What does "Decide later" do?
The app stays blocked and is listed on the Rules tab under Waiting for your decision, where you can decide any time. PacketHound also asks again after 10 minutes if the app is still running, or the next time it connects.
Does it work alongside my antivirus?
Yes. PacketHound uses Windows Firewall, which works alongside Microsoft Defender and most antivirus software. If a third-party security suite has replaced Windows Firewall with its own, PacketHound can't work, because there's no Windows Firewall to manage.
How do I uninstall it?
From Windows Settings › Apps. The uninstaller asks whether to delete PacketHound's firewall rules, then puts Windows Firewall's settings back the way they were before you installed it.
How do I report a bug or suggest a feature?
Open an issue on PacketHound's GitHub page (you'll need a free GitHub account). For a bug, say which version of PacketHound and Windows you're using and what happened. The log in C:\ProgramData\PacketHound often helps.
Put your PC on a lead
Free for Windows 10 and 11. Installs in a minute, uninstalls cleanly.