Best Free Firewall Protection

  Read this article in Spanish


Firewalls help monitor your system's communications between your network and the Internet, to help detect and prevent intrusions and attacks. They are particularly useful for controlling the activities of Internet facing applications.

Firewall products are arguably one of most cumbersome software and have a reputation of causing user angst - to find a suitable product that meets individual users' needs may involve a process of trial and error. A good firewall should be able to protect to user at a near-perfect level, while not being too intrusive or complicated to handle. The type of user may very well determine the functionality or feature set that is necessary for each individual user. In this article, we give you a selection of some of the best free firewall software, in our opinion, that is available. Our reviews and recommendations are made taking into consideration both editors' and site visitors' experience, opinions, and comments. As always, if you have more to share we would love to hear from you. Please refer to the comments section at the bottom of this page.

[show-hide toggle]

Review Index


Basic Firewalls

The built-in Windows firewall is a common choice since it passes all inbound tests (both stealth and open port) and doesn't have many popup alerts. It doesn't require a separate software installation, as it comes built-in with modern versions of Windows. Therefore, it is not likely to conflict with your other programs. And many average users may not reliably handle the popup alerts of the more complex firewalls on the market, especially at their max settings. Newer versions of Windows also feature an updated, improved version of Windows firewall than prior versions of Windows.

If you scan clean for malware, don't want/need the additional features of a third-party firewall, and are a relatively low risk user, then the Windows firewall could be a practical and useful solution.

Alternatively, you can replace the Windows firewall with a basic third-party firewall for greater control of outbound protection and additional features. Most simple two-way firewalls ask you to allow or deny Internet access for unknown programs. Many also automatically allow trustworthy apps and remember your decisions to become silent over time. However, these software require additional configuration of settings, especially at the outset.

Windows Built in Firewall  

A firewall built into Windows with no separate installation required.

Our Rating: 
License: Commercial
Built in to Windows, no separate installation needed, simple and easy to use, effective, passes all tests, no nagging or annoying pop ups, runs seamlessly and quietly in the background, significant improvements since initial version in XP. Likely suitable for most day to day use.
Primarily incoming connecting protection only. Advanced user interface is not user friend - this interface may not be suitable for beginner users. Would be very beneficial complemented by a third party tool such as Windows 10 Firewall Control. Windows XP's version is very basic and lacks any outgoing protection. May not provide adequate protection for "high risk" users.
Read full review...


A lightweight firewall solution that works with the built-in Windows Firewall.

Our Rating: 
License: Free
Lightweight basic firewall; simple yet effective. Non-intrusive program with no pop-ups. Ability to recognize associated processes when white-listing programs. This program could be a good choice for those not familiar with computers, as it does not require advanced knowledge to use.
No user dialog; everything is accessed from the pop-up menu. Not necessarily a bad thing, but may be different compared to what most are used to. Cannot select where to install the program. Requires .NET framework.
Read full review...

Windows 10 Firewall Control  

A good choice to supplement the Windows built-in Firewall and compatible with Windows XP and higher.

Our Rating: 
License: Free (Limited features)
Simple and effective; uses Window's built-in firewall platform so no third party kernel drivers are needed. Very small footprint. Three modes to choose from (Normal, EnableAll or DisableAll). Great for complementing Windows' built-in firewall.
May be a bit annoying to use at first since the user must configure the initial rules for all their applications; no training mode. The dialog box that pops up to allow/disallow a particular program has a lot of information, some of which may not be too user friendly to beginner computer users. Online manual could be more comprehensive.
Read full review...

ZoneAlarm Free Firewall  

A well-established inbound and outbound OS firewall solution suited for users of every level of experience.

Our Rating: 
License: Free (Limited features)
Solid inbound firewall, stealth mode, user friendly, customizable settings, anti-phishing protection, and hosts file lock.
Inadequate HIPS or program monitoring protection. No High setting for program access in Free version. In spite of available automatic update option, updates almost always must be performed manually. Help file designed for commercial version.
Read full review...

Firewalls with HIPS Protection

The following personal firewalls provide an advanced level of network and HIPS protection. Each firewall comes with default settings and, depending on the users' needs, may or may not require much adjustments.

It should be noted that firewall products in this section require more time to learn and configure, and are more complex to use than basic firewalls. There is also a higher risk of conflicts and problems arising on your system. Since firewalls are often praised for their security effectiveness at their max settings, users will likely have lower protection than mentioned by independent testing sources, such as Matousec, for practical day to day use. All of the product vendors seek to provide user friendly features, sometimes incorporating reduced levels of protection in their default settings by decreasing some HIPS monitoring. In other words, these firewalls may be more suitable for more advanced users, as well as those that are more "high risk".


A proactive multi-layer security solution with behaviour blocking and standard firewall protection.

Our Rating: 
License: Free
Effective proactive security and stealth, one of the lightest of all tested firewalls on memory, simple setup (no nags or ads!). Easily choose between 3 network profiles. Has a unique "email/system anomaly detection" feature, which trains over 7 days by default. Quick to respond to queries / feature requests.
No automatic installation mode (but it has a training mode in "Settings" > "Advanced"). The tray icon flashes for log events instead of network activity per se. Program may be more suitable for advanced users due to the complex user interface and features. Program is still supported, however there appears to be no active development or updates currently.
Read full review...

Comodo Firewall  

A good choice for lightly-skilled and advanced users seeking a full featured security suite.

Our Rating: 
License: Free
Its Defense+ HIPS performance exceeds commercial products and leads the class, it includes a "memory firewall" feature, and it allows you to quickly switch between Defense+ security modes and configurations. Includes automatic updates. Installation can automatically configure your PC to use the Comodo SecureDNS (but you can do this without installing CIS).
No built-in help. Despite not installing the AV component, the AV files are still placed in the Comodo program folder. Possible problems when uninstalling program; remnants of the program are sometimes left on the computer.
Read full review...


Both types of firewalls (basic and HIPS/proactive) both have their benefits and drawbacks. While HIPS software do offer greater protection and control of your machine, it naturally requires more user interaction and resources, making such software not the easiest to use. There are more settings to configure and it is more complex to use than the basic firewalls.

On the contrary, basic firewalls are generally simpler to use and may be easier for the user to adjust and learn how to use it. Comparatively, they do not offer as much protection as HIPS software; for example, they cannot detect suspiciously acting software behaviour, as it primarily filters incoming and outgoing internet traffic.

If you are an advanced computer user and/or are a "high risk" user, then the increased complexity of a HIPS firewall may be the best option for you, as it offers you the maximum protection available (in this regard). However, for most average users who use their computer for regular day to day use, a basic firewall is probably more than adequate. For these latter parties, a HIPS firewall may simply be going overboard as the increased features, complexity, and configurations are unnecessary.


Additional Tips / Precautions

  • Before installing new resident security products, including antivirus and firewall programs, consider making a full drive image. By creating a full drive image you are able to restore your entire computer back to a previous state in the event your system becomes completely unresponsive. Drive imaging allows you to recover from unintentional conflicts as well as severe malware infections. Everyone's system is unique and may have old, latent drivers that may be incompatible with whatever you are installing, causing problems with your system. Newer versions of Windows have a built in "Complete PC Backup and Restore" feature, or you can use a free drive imaging program
  • To cleanly uninstall your (third-party) firewall before installing a new one, you may consider using ZSoft Uninstaller to analyze before and after the installation. If you haven't used it on your current firewall, try Revo Uninstaller (or other vendor or Windows uninstaller), check for leftover services and drivers with Autoruns, and restart your computer.


Other/Unsupported Firewalls

The following firewalls are now unsupported by their vendors. This means they have been discontinued and/or are no longer offered by the software publisher. While they may still be available for download, they may contain undocumented bugs or stability/security issues that will not be addressed. These reviews are archived for information purposes only. Unless you run an older Windows system with no other current firewall programs available, we would suggest using another program that is currently active.

[show-hide toggle]


Related to Firewalls

Security Guides

Security Products

Inbound Vulnerability Tests

Outbound Vulnerability Tests

Learn More



This software category is maintained by volunteer editor Tim. Registered site visitors can contact Tim by clicking here.

Back to the top of the article.


Please rate this article: 

Your rating: None
Average: 4.3 (537 votes)


I've been using PrivateFirewall for a while now and i'm back here to see if i can't get something better.

I've gotten a lot of pop-ups, but that in itself is not a problem since i did put all the security settings to high.

The problem i'm having is that the pop-ups stay on screen and on-top of every other windows, for what seems an eternity, after i've clicked allow, now that is very annoying.

Also, this is a firewall and yet in all those pop-ups, i have yet to see the mention of a protocol, a url, an IP, a port or anything related to networking. Does that mean any program that i "allow" to run gets full network and internet access?

btw, i'm on Win XP if that makes a difference.

The kind of information you require can be found by clicking 'details' which is next to the 'options' button on the pop up.

See pages 12 & 16 in the PF guide, links in MC's post.

mmm ... now that's weird. I just opened Skype (that always gets me 2 pop-ups or more) and nowhere on the pop-ups can i see either "options" or "details". The only buttons are "Allow", "Train", "Terminate" and "Block".

I even removed Skype from the rules and yet all the pop-ups (much more numerous) i got had only the same 4 buttons.

I get four choices on both the firewall alerts and the process monitor alerts, 3 buttons (Allow, Block, Options) and a 'Details' link. I've only just started using it myself so I'm not sure I can help further, I just thought I would post about pages 12 & 16 (see also p23) as I had just been reading them in the manual. The manual is 62 pages long so you might find a reason in there why its not working for you.

I'm using PF on Windows 8 pro 64-bit so this is a difference but PF should support XP as well.

It's also worth noting that with most firewalls of this type, the nature, number and options possible from alerts will vary depending on how the initial configuration has been setup. Again, it is necessary to read the documentation thoroughly first and then decide which are the best options for your own requirements. MC - Site Manager.
Using any type of firewall with HIPS capability requires an understanding of how this operates and how to respond to alerts. Users should read the vendors documentation before installing the software to avoid setting rules that could be leave their system vulnerable. The PDF guide for Privatefirewall is located on this page. MC - Site Manager. Further reading.

I haven't read the documentation, but the pop-ups are clear enough.

You seem to have completely missed the point of my comment.

What i expect of a firewall is to be asked what program should have access to the network and the internet, trough what protocol (TCPIP, UDP, ...), to make outbound or accept inbound connections, from what URLs or IPs. That's the firewall's job. A firewall that's always asking about temp files created by portable software is more annoying then helpful.

The HIPS i need is to know what program is using svchost to access the internet or using firefox.

Do the Basic Firewalls offer that kind of control?

Sorry, but my reply was completely relevant, hence my suggestion to research these things before installing the software concerned. You are asking about firewall functions and yet commenting about process monitor alerts which are completely separate issues. HIPS related components and alerts are notoriously difficult to understand unless you have an advanced knowledge of Windows processes. In this respect, such users are better off employing safe surfing practices and using a pure firewall. With XP this is not a problem as you can run one of several excellent free firewalls that no longer function beyond XP or Vista. My own recommendations would be either Kerio 2.1.5 or Sygate. MC - Site Manager. You will need to Google around for Kerio and choose your own download source.

I was browsing around on Softpedia. And I discovered a rather interesting, um case of TWINS.

Here is the link to the screenshots of PrivateFirewall:


Now, check the screenshots for an older firewall called
Webroot Desktop Firewall:

Gee, I believe that when Webroot "disappeared", it became PriveateFirewall, either that or it is a clear case of copying.

Just thought I'd share that with the nice people here.

BTW, I have used PrivateFirewall in the past, excellent package. A wee bit too "chatty", or maybe that would be "naggy"?

Privatefirewall is the original code. Webroot licensed this technology for use in their own products. MC - Site Manager.

Since today's version of "ZoneAlarm Free" you can't install without checking the 2 following boxes ...

"Set Zonealarm Search as my default search provider for : Firefox"
"Set Zonealarm Search as my home page and new tab for : Firefox"


Anybody knows a good alternative with user rules ?
With user rules i mean you'll get a popup where you can decide to block or allow a program to send data to interenet.

Greets , Kuoi

I thought the same thing was happening as well, but it turns out you can install ZoneAlarm Free without changing your default search, home page, new tab or adding a toolbar. First of all, select Custom Install rather than Quick Install. Now on the next screen on the bottom left hand corner you should see "ignore all offers" - look closely, because they HIDE this option in a light blue text on the dark blue background (pretty sneaky...) This bypasses the popup screen that prompts you to check those boxes and installs it without making the changes.

I don't know why they're making this so difficult (I tried to have my sister install ZoneAlarm Free on a XP-based system that she got from a friend and didn't know about this, do I had her turn on the Windows XP firewall instead...) Having to search for a way to avoid making these kinds of changes to your browser's configuration isn't the most effective way to promote a product...

... but there is only 1 BIG button you can click on in the first window
"QUICK INSTALL : install with default settings"

... and I don't want to push that button because I don't want their browser hyjack !!!

You can try "Windows 7 Firewall Control": easy-to-use and effective! You can run it with native Windows Firewall on - so you don't need to disable in-built firewall.

You can opt out of these changes, or change them back after install. No one can help you with an alternative unless you tell us which operating system you have. MC - Site Manager.

MidnightCowboy: I'm seeing the same thing as Kuoi. The latest ZA upgrade only offers a Quick Install option; the Custom Install option has been removed. Maybe those choices show up later in the installation, but when I chatted with ZA tech support I was told that this is the new normal -- you cannot set or override the defaults during an upgrade. The tech said I'd have to completely remove ZA and reinstall to get the custom install option. I can back up my security settings, but would have to manually undo the changes they make to my search engine and home page. I'm going to stay with the current version of ZA.

Well, the OP did say install and not upgrade. Even so, most would regard this as a minor inconvenience considering the changes are so easily reversed and certainly no reason to move to a different firewall. MC - Site Manager.

Having your browser hijacked is a "minor inconvenience"?

No, it's a reason never to go near the guilty party ever again.

Posts like this are regarded as flaming or trolling and we are not alone in making this judgement. If you wish to debate this particular issue, please post it in the forum because further posts here will be deleted. MC - Site Manager.

What are your thoughts about older versions of firewall like Kerio Personal Firewall or Sygate? What I am looking for is a lightweight and easy to use firewall that won't bog down the computer as some people are still running xp pro and home with 512Mb of RAM. Any ideas or thoughts. I was thinking of installng "private firewall" as it possibly fits the bill as being light and easy.

Sorry for the delay in replying. If you're still searching for one, TinyWall might be a good one to consider, as it's quite low-resource usage. Of course Private Firewall, as you mentioned, would also be a good light one - and it has behaviour blocking functionality.

So much crying over Comodo being too complicated and confusing. It installs programs without the option to say no. For starters Comodo does not force you to install anything you don't want. Geekbuddy and Comodo Dragon are optional but I guess you didn't bother to look and read before you installed the software. That's Comodo's fault, right? It's the same garbage I still read in many security forums about how Norton Antivirus is this bloated pig of a piece of software that will never touch their machine. Yes. Yes, it was. Five years ago! Comodo is bloatware. It's too complicated. Why couldn't they leave it like it was? I know, change is hard.

Actually, version 6 is as close to install and forget it as this product has ever been. But even so, I will grant you it is far more complex than the install and configuration for Zone Alarm free. Comodo is actually a brilliant piece of software that an "IT Professional" would have no trouble installing and configuring. This very website has the best instructional you will find anywhere on the planet for setting CIS up and configuring it. Step by step it's all there, but you have to do some work. If you want easy then by all means install Zone Alarm free. It's a decent product and perfect for someone who is not a hands on type when it comes to computer security. Another option is to use the Windows 7 firewall, which is actually very good, and with a bit of work, can be configured to handle both inbound and outbound traffic. Is it easy to do? That depends on the individual. It should be for an "IT Professional" but you might have to some research, and actually read a bit. Does Comodo's suite have any flaws? Yeah, more than a few. I also hate the way version 6 was thrown out into the world with what seemed like a very short beta test cycle. What I cannot stomach is the crying over what Comodo is not. Tell me it did a horrible job protecting your computer and back it up with facts. The last time I looked the entire Comodo suite was "FREE" and is easily one of the best security solutions available to the home user. It is not everyone's cup of tea. I'll buy that, but please stop the cry baby bashing of a product that does not suit your particular needs.

I have used Zone Alarm for years because it always hid my computer, and stop change programs from going out until I okay them again. While Zone Labs owned the program it was super. Then Central Point bought them out and the bloat started. Eventually vsmon.exe became so nasty it was slowing my whole system. It occurred to me then that I wanted Zone Alarm to hide my computer and stop changed programs from going out. I don't need my firewall to do any thing else. I now use Zone Alarm 4.5.x, the last Zone Labs release before the Central Point buyout and will not update it as long as I still have my XP machines.

I am a long time user of Comodo software. And I like it a lot. There are several Comodo security products and one needs to specify which product is being discussed. CIS (Comodo Internet Security) is an all-in-one package including anti-virus, firewall, defense+, sandbox, etc. Then they have other software that provides only one or two of these functions. Pick what you need.

In the past Comodo CIS has been criticized for generating too many alerts, as compared to other packages. The new CIS v6 has almost eliminated all popups for its default configuration. I think that is a good step while at the same time retaining optional settings for those who have advanced needs.