
Introduction
Firewalls help monitor your system's communications between your network and the Internet, to help detect, alert, and prevent intrusions and attacks. They are particularly useful for controlling the activities of Internet facing applications, ie. applications that access the internet.
Firewall products can be one of more cumbersome software products to use and have a reputation of causing user angst - to find a suitable product that meets individual users' needs may involve a process of trial and error. A good firewall should be able to protect the user at a near-perfect level, while not being too intrusive or complicated to handle. In this article, we give you a selection of some of the best free firewall software, in our opinion, that is available. Our reviews and recommendations are made taking into consideration both editors' and site visitors' experience, opinions, and comments. As always, if you have more to share on your experiences with the software products mentioned and/or freeware firewall products that you like, we would like to hear from you. Please refer to the comments section at the bottom of this page.
Firewalls come in two flavours; software based and hardware based. Software based firewalls (which is what we will cover in this article) reside on your machine, running in the background to keep a watch on things. To avoid potential conflicts, only install one software firewall. In order to achieve the best combination of protection, we would strongly suggest to use a hardware firewall (such as a router) in conjunction with a software firewall. Modern routers usually have a built-in firewall, helping to filter out content before it reaches your machine; consult your router documentation for more details. In situations where a hardware firewall is not available (eg. a public network), having a software firewall is even more crucial.
Basic firewall protection is critical for securing your PC. At a basic level, firewalls limit access to your system and personal information, and silently protect you from inbound threats. We review basic third-party firewalls as well as the built in Windows firewall, and look at features such as monitoring programs that request outgoing Internet connections (we call this "outbound protection").
Basic firewalls generally only have limited protection; proactive firewalls offer more extended protection, including HIPS or program monitoring (HIPS Explained), and watch for malicious behavior before malware gets a chance to take control of your PC or turn it into a botnet drone. They seek to achieve stronger "2-way" protection, preventing programs from broadcasting your personal information to the Internet. The downside of such firewalls are that it may be harder to use and/or require more memory consumption. Also, there is a greater risk of HIPS software causing conflicts, errors, or otherwise cause other issues with your PC.
Some kinds of malware are best detected by their behavior, so a proactive firewall (or firewall/HIPS combo) is a solid second layer of protection next to your antivirus program. Many of the top antivirus programs also provide behavioral blocking and extended scanning of network activity. Therefore, to best minimize the risk of malware on your PC, it is important to use a basic or proactive firewall protection, as well as antivirus software.
You can "upgrade" (for free!) your security by reading the documentation and learning about proactive firewalls or HIPS programs, or using other protection like least-privileged user accounts and/or Sandboxie or GeSWall. This information, and more, is available on various parts of our website; check the end of this article for related document links.
Review Index
Basic Firewalls
The built-in Windows firewall is a common and popular choice since it passes all inbound tests (both stealth and open port), doesn't have many popup alerts, and doesn't cause system performance issues. It also does not require a separate software installation, since it comes built-in with modern versions of Windows. The built-in Windows firewall has improved drastically from earlier versions of Windows; the latest iteration, Windows 10, now contains a very capable and reliable built-in firewall solution, which is named Windows Defender Firewall.
You can also replace the Windows firewall with a basic third-party firewall which can provide greater control of outbound protection and additional features. Most simple two-way firewalls ask you to allow or deny Internet access for unknown programs. Many also automatically allow trustworthy apps and remember your decisions to become silent over time. However, these software require additional configuration of settings, especially at the outset. With the improved functionality of the built-in firewall in Windows 10, such third party firewall solutions are decreasing in popularity.

Platforms/Download:
Version reviewed: n/a
Gizmos Freeware
Our Rating: 5/5 |
![]() |
Read more...
Platforms/Download: Windows (Desktop) |
Version reviewed: n/a
Gizmos Freeware
Our Rating: 5/5 |
Read more...

Windows 10 Firewall Control
A good choice to supplement the Windows built-in Firewall and compatible with Windows XP and higher.
Platforms/Download: Windows (Desktop) |
Version reviewed: 7.5
Gizmos Freeware
Our Rating: 4/5 |
Read more...

ZoneAlarm Free Firewall
A well-established inbound and outbound OS firewall solution suited for users of every level of experience.
Platforms/Download: Windows (Desktop) |
Version reviewed: 14.1.011.000
Gizmos Freeware
Our Rating: 3/5 |
Read more...
Firewalls with HIPS Protection
The following personal firewalls provide an advanced level of network and HIPS protection. Each firewall comes with default settings and, depending on the users' needs, may or may not require much adjustments.
It should be noted that firewall products in this section require more time to learn and configure, and are more complex to use than basic firewalls. There is also a higher risk of conflicts and problems arising on your system. Since firewalls are often praised for their security effectiveness at their max settings, users will likely have lower protection than mentioned by independent testing sources, such as Matousec, for practical day to day use. All of the product vendors seek to provide user friendly features, sometimes incorporating reduced levels of protection in their default settings by decreasing some HIPS monitoring. In other words, these firewalls may be more suitable for more advanced users, as well as those that are more "high risk". We would only recommend these firewalls for these users; for average daily users, basic firewalls are likely sufficient.

Comodo Firewall
A good choice for lightly-skilled and advanced users seeking a full featured security suite.
Platforms/Download: Windows (Desktop) |
Version reviewed: n/a
Gizmos Freeware
Our Rating: 3/5 |
Read more...
Summary
Both types of firewalls (basic and HIPS/proactive) both have their benefits and drawbacks. While HIPS software do offer greater protection and control of your machine, it naturally requires more user interaction and resources, making such software more complex. There are more settings to configure than basic firewalls.
On the contrary, basic firewalls are generally simpler to use and may be easier for the user to adjust and learn how to use it. Comparatively, they do not offer as much protection as HIPS software; for example, they cannot detect suspiciously acting software behaviour, as it primarily filters incoming and outgoing internet traffic.
If you are an advanced computer user and/or are a "high risk" user, then the increased complexity of a HIPS firewall may be the best option for you, as it offers you the maximum protection available (in this regard). However, for most average users who use their computer for regular day to day use, a basic firewall, especially the built in Windows Defender Firewall, is probably more than adequate. For these latter parties, a HIPS firewall may simply be going overboard as the increased features, complexity, and configurations are unnecessary.
Additional Tips / Precautions
- Before installing new resident security products, including antivirus and firewall programs, consider making a full drive image. By creating a full drive image you are able to restore your entire computer back to a previous state in the event your system becomes completely unresponsive. Drive imaging allows you to recover from unintentional conflicts as well as severe malware infections. Everyone's system is unique and may have old, latent drivers that may be incompatible with whatever you are installing, causing problems with your system. Newer versions of Windows have a built in "Complete PC Backup and Restore" feature, or you can use a free drive imaging program.
- To cleanly uninstall your (third-party) firewall before installing a new one, you may consider using ZSoft Uninstaller to analyze before and after the installation. If you haven't used it on your current firewall, try Revo Uninstaller (or other vendor or Windows uninstaller), check for leftover services and drivers with Autoruns, and restart your computer.
Other/Unsupported Firewalls
The following firewalls are now unsupported by their vendors. This means they have been discontinued and/or are no longer offered by the software publisher. While they may still be available for download, they may contain undocumented bugs or stability/security issues that will not be addressed. These reviews are archived for information purposes only. Unless you run an older Windows system with no other current firewall programs available and are unable to upgrade, we recommend using an active, supported program from the list above.
-
Online Armor Free's HIPS feature is mostly in its "Program Guard". It has a feature called "run safer" that allows you to selectively set risky applications (web browsers, office software, readers/viewers, instant messengers, email or news programs, multimedia software, download managers, etc.) to run as if under a limited user account (go to "Programs" tab > uncheck "Hide Trusted" > highlight a program and click "Run Safer"). It minimizes popup alerts over time with its automatic list of safe programs, your on-demand scans with its safety check wizard, and your responses to popup alerts -- especially in cases where you tell it to remember your decisions and have it treat programs as trustworthy.
Run the wizard and have it search your PC for known programs to allow/block/ask. In this case, Online Armor relies on you to respond to alerts for unknown programs. For the curious or paranoid user, it uses excellent popup messages when it automatically allows a program to connect online and, optionally, when it automatically trusts a program/process to run (these alerts don't require user action and they can be enabled/disabled in the interface with "Options" > "Firewall", and "Programs" > "Options"). For example, I noticed a message when it auto trusted a key logger test, but after I set the tester to untrusted, it gave very informative and detailed security alerts (and then it passed the test and logged the tester in the interface under the "Key Logger" tab, but it only logged the key logger after the test was untrusted). You can even close both its tray tools from its right-click context menu. They are not needed for the firewall and HIPS components to continue running and protecting.
-
AVS Firewall differs from other regular ones in that it comes with additional protection modules; namely a registry defender, a banner blocker, and parental control options – it is something like a suite. The firewall itself does not have as many configurable options as some of the firewalls listed on this page, but the standard selections are still there – off, which turns off the firewall; custom, which allows you to set your own connection rules; and high, which blocks all connections.
Each section of the program is displayed clearly; navigation is through the menu on the left. Alerts are generally clear and straightforward, as is configuration.
The registry defender protects the registry from being modified, with the option of only protecting select categories. The parental control limits the list of websites that can be accessed, but you must manually add each website to be trusted, ie. You cannot block specific websites; you can only allow certain websites. The anti-banner component blocks undesirable web page content including ads, flash banners, pop-ups and the like. All three of these additional modules can be disabled independently as desired. AVS Firewall also comes with a monitoring utility so you can check the size of network traffic which is sent and received by each application.
During installation of this firewall, the installer automatically installs the AVS Software Browser; there is no option to opt-out of installing this, but the program can be removed separately after installation with no effect on the actual firewall program. The installer also has a pre-checked option to install AVS Registry Cleaner, and it is recommended that it is unchecked so the installer does not install it. Therefore, while the software has some additional features not found in your everyday firewall program, most of those features can be found in other third party programs.
-
Outpost Firewall Free by Agnitum software technology is a good choice for users who want highly flexible protection without sacrificing usability. It appears to be built with average users in mind, judging by the care taken to simplify alert messages and make it easy to adjust intrusion prevention (or HIPS) monitoring. For example, it remembers your responses to popup alerts without the need to set "trusted" rules (like in Comodo/Online Armor), and like Online Armor it notifies you when it automatically allows an application to access the Internet (especially helpful during the learning phase).
The free version lacks many extras of the pay version, however, such as automatic updates and the ability to break active connections. The HIPS component is called "Host Protection" in the interface. It provides four default levels of protection, which can be easily set with a slider and additionally customized item by item by advanced users. The default "optimal" setting only monitors the "most dangerous activities" (such as memory injections, driver loads, and a healthy list of system critical features -- auto starts, shell extensions, and internet settings) instead of all program activities. But these "optimal" settings lack protection from keyloggers, direct disk accessing, DNS API request monitoring, etc. You can check the types of reduced monitoring in "Settings..." > "Host Protection" > "Customize...".
Agnitum has now been acquired by Yandex. As a result, Agnitum has discontinued support and sales of the Outpost product line.
-
A former commercial product, Privatefirewall is now unrestricted freeware. It is a proactive multi-layer security solution, offering behaviour blocking technology alongside standard firewall protection. Using Behavioral-based Monitoring, it features zero-hour virus, spyware, and malware protection, process and application security, and registry protection, just to name a few. It is definitely a feature-packed firewall/HIPS solution.
While there is a decent help file available, the user interface can be a bit confusing and overwhelming. There are many configurable settings, and sorting through them may require some time. To help out with that there is a information menu on the right of each screen which explains what each section is for. Training mode allows all actions within a 180-second interval, which is ideal for installing or running programs for the first time. On the first run after installing however, Privatefirewall still managed to disable Panda Cloud Antivirus, the antivirus software on my test system, even with Training mode activated. Adding Panda Cloud Antivirus to the allow list seemed to solve this issue.
It is also possible to set different security levels for the Internet and the Network. Various levels of protection (High, Low, and Custom) can be separately specified for Internet Access and Network Security (ie. file and printer sharing). This is useful for, say, when one needs to access the internet via a network they don't quite trust. In addition, there are three profiles you can choose: Home, Office, and Remote. You can set appropriate settings for each one and easily switch between them as needed; this is particularly useful for portable computers which connect to many different networks. Another useful feature is that it is possible to block all outbound email; simply click the 'Block Outbound Email' icon in the main user screen and all outbound email should be blocked.
Overall, Privatefirewall is a very effective firewall; it ranks among the top products on Matousec. However, the graphic interface and usability is perhaps more suitable and tailored for the more advanced users. Beginner computer users may want to consider another firewall instead, but if you are comfortable with the basics of Windows & firewall software, you should definitely consider Privatefirewall.
Other Unsupported Firewalls for Windows 95-Vista
- Sygate Personal Firewall (Windows 2000/XP/2003)
- NetVeda Safety.Net (Windows 95/98/Me/NT/2000/XP, requires registration)
- Ashampoo FireWall Free (Windows 2000 SP4, XP SP2)
- Filseclab Personal Firewall (Windows 95/98/Me/NT/2000/2003/XP, 32-bit)
Related Products and Links
Related to Firewalls
- Comprehensive List of Firewalls (PBSLW)
- Best Free Intrusion Prevention and Detection Utility (HIPS)
- HIPS Explained
- Matousec Proactive Security Tests Analyzed
Security Guides
- Security Advice Wizard
- Probably the Best Security List in the World
- Gizmo's Guide to Securing Your PC
- Safe Computing in Under an Hour
- Best Free Security Diet Plan
- How to Stay Safe While Online
- How to Improve Security When Using a Public Terminal
Security Products
- Best Free Antivirus Software
- Best Free Browser Protection Utility
- Best Free Adware/Spyware/Scumware Remover
- Best Internet Safety Check Freeware
- Best Free Software Update Monitor
- Best Free Encryption Utility
- Best Free Anonymous Surfing Service
- Best Free Drive Imaging Program
- Best Free Password Manager
Inbound Vulnerability Tests
- Nessus (open ports test, vulnerability scan)
- GRC ShieldsUp! (stealth test)
- Audit My PC (open ports test)
- Nmap Online (open, closed, filtered, unfiltered ports test)
- Security Space (open ports test)
- Symantec Security Scan (open ports test)
- SecurityMetrics (stealth test)
Outbound Vulnerability Tests
- Matousec Proactive Security Challenge (testing suite results)
- Matousec SSTS/BSODhook (a suite of tests for experts). It may receive antivirus warnings, but they are false positives.
Learn More
- How Firewalls Work
- Wilders Security: Firewall Questions for Beginners
- Microsoft: Firewall FAQ
- US-CERT: Understanding Firewalls
- OnGuard Online (threat information)
Editor
This software category is maintained by volunteer editor Tim. Registered site visitors can contact Tim by clicking here.
Back to the top of the article.
Comments
Midnightcowboy,
I,m sure your view is held by all the software company's, that package these extra pieces of software in with their download. If it makes them feel better blaming the consumer, then more power to'em.
Hi there! After hearing much fanfare about Tinywall here and there I decided to create a 7x64 ISO with RT7Lite with firewall service turned on and give it a shot, being a bit of firewall compulsive as of late and after years of Comodo I just wanted to test it out... not a bad effort if you ask me, learning mode is a nice feature, but still needs a bit of polishing in terms of Gui and some weird behaviour, I noticed has a tendency of losing user settings and whitelists, reverting to default, this happened a couple of times, though it might just be hardware-depending, and does not have a confirm-upon-exit button, but that's not a major issue... the major drawback for me is that despite what's been said it's a bit of a resource hog, loads 2 processes floating around 25 MB each often peaking at 65+ which is nothing to fret about on 8Gb machines but could be a pain in the arse on older hardware, especially for something that's supposed to be feather-light... Comodo and Online Armor for instance both open up 4 processes, summing up roughly 50Mb during heavy usage. I ended up rolling back to Online Armor, which feels good for my needs, but if I had to pick up the main selling points of Tinywall they'd be its small and clean installer, learning mode, lack of conflicts with other software whatsoever, ease of use and no congestion on net performance
Cheers
I gave Private Firewall a test drive the other week, for a few days.
The GUI is ugly as anything but aside from that I liked it quite a lot. I found it quite easy to set up and use, the volume of pop ups is nothing too fazing if you're a long-term Comodo user and I found the whitelisting procedure somewhat quicker and smoother. The program as a whole seemed a lot lighter on resources than CIS.
The reason I went back to CIS was that I couldn't work out how to get PF working with proxies ... when I tried to use a PAC it seemed to confuse PF to the point of a system-hanging volume of log entries and the program I was trying to use not connecting.
Before that I tried TinyWall ... I really really like this one. It's so unobtrusive and simple that it's bordering on charming : )
I like the approach very much - refuse internet access to positively everything unless I say otherwise (it does have an included whitelist of Windows processes). I kept it for a week or so but on the whole I think it still needs some work - for instance whitelisting while it's pretty well implemented (the option to just click on an open window is great), doesn't allow multi-selection so if you whitelist by browsing files/running processes it can be a bit of a pain to do them all individually. For instance whitelisting all the execs that Avast needs to have net access means selecting one, closing the dialog, selecting the next, closing the dialog, etc etc. It can also be a time consuming process of trial and error working out exactly what processes a program does need access for in order to work. The promised ability to recognise child execs as belonging to a parent program didn't work for me either.
Drag and drop functionality would be a good addition, as would resizable dialogues.
Lastly it crashed on me several times while I was trying it out, which while it doesn't leave you "unfirewalled" (as TW is just a front-end GUI and hardener for the native Windows FW) is still not a great selling point.
I'll definitely be keeping my eye on any future development though. Meanwhile, back to CIS : )
Thanks for the write-ups Tim.
Some people seem to have had a few problems uninstalling Privatefirewall - how about you? Also, do you know if there's a removal tool that works with Vista?
As long time number one Comodo has been beaten by Privatefirewall for the top spot, would it be possible to do an installation and setup guide for Privatefirewall along similar lines to Chiron's excellent guide for Comodo Firewall?
Hi,
Nice Article
but can we use any firewall for small business.
like one server is installed with firewall only and then provide internet surfing from that server to other system.
is there any free firewall there for 20-30 system.
please reply.
http://www.endian.com/en/community/overview
I just tried installing zone alarm free with their
zafwSetupWeb_120_104_000, but it requires
you to use ZONE ALARM SEARCH as your home page's search site and as your home page and new tab for all browsers, and as your default search provider for all browsers.
That's just freakin' nuts!
I would like to see version 7 of Online Armor tested. I understand, that you do not consider [edited out]. I just installed it (I bought it 2 years ago) and it seems that the Learning mode got removed completely. Though TinyWall is not bug free. From the beginning (2.0, maybe also 1.2, if I remember correctly) it loses it settings from time to time. That should be mentioned as well. Even though it is still the best GUI for the Windows Firewall.
Hi,
I have noticed that Online Armour
looks like they NO longer offer their firewall as freeware!
They have updated their page.
That says it no longer free..
Always enjoy this site - Keep up the good work
Steve
Just FYI, I clicked the ZoneAlarm download link and went to major geeks, then click that link and ended up getting redirected to a link for anti-virus+firewall. Not interested in their anti-virus so I went to the ZoneAlarm site and downloaded it through them.
As Windows Firewall Notifier been tested?
http://wokhan.online.fr/progs.php?sec=WFN
I found it trough How to geek here: http://www.howtogeek.com/113641/how-to-extend-the-windows-firewall-and-e...
It seems to do the same thing as Windows 7 Firewall Control, but it's even smaller and maybe the pop-ups and manuals are better, i don't know.
It's nearly portable.
Hi, I followed the links in Paxmilitaris's post and found that Windows Firewall Notifier has gone open source and is now being hosted on CodePlex - http://wfn.codeplex.com/
It's not easy to tell though if it's still being developed and updated ... on WoKhan's site the download is v1.8.0 (which links straight to CodePlex)and the date given is 28/4/12. However at the bottom of the old page, v1.7.0 has the same release date while the date on CodePlex for v1.8.0 is 11/11/13.
One to watch perhaps and see if it goes anywhere as an open source project. I'll probably give it a whirl sometime as I'm looking to start using W7 native firewall again.
There is now way to block a range of IP's with PrivateFirewall, such a shame.
I would like to see Binisoft Windows Firewall Control tested. Online Armor is now in the beta phase of version 7. Version 6 has been out since a year or so. Sphynx Windows 7 Firewall Control is at version 5, version 6 is in beta testing. Maybe the tests can be update (OA 6, W7FC 5, BiniSoft).
Can you please till me if "Comodo Firewall" is still the best choice as free firewall software or not, i am asking because in your review i noticed that you rated "PrivateFirewall" with 4.5 stars and "Comodo Firewall" with 4, so i want to know if "PrivateFirewall" is the best choice now or not, or it is still "Comodo Firewall"?
I follow your review for my choice so i want to know which is the best now.
And thank you so much for your review.
Been running Comodo for years now and can't complain. However recently I have encounters issues when running Comodo 6 with Avast 7. When I started my PC (Win 7 64bit) Avast woulkd load but sometimes Comodo would not (about 33% of the time). Until Comodo loaded (i.e. the tray icon appeared) I was unable to browse the internet, email and software updates (well AVAST update) worked fine but internet browsing would not. Tried the various solutions on both the Comodo and AVAST forums, added both programs as exceptions to each other, disable the behavior blocker on AVAST, then swapped and disabled Comodo's instead, then turned it off on both, none of it solved the problem.
I have run the AVAST & Comodo combination for years and this problem only occurred when both were updated to their newest versions. I have also had this problem on multiple computers.
My solution in this case was to drop Avast and replace it with BitDefender, paid version on my main PC and the new free version (which as real-time protection) for the others.
Has anyone else had this issue, would be interested to know how you guys fixed it if you did?
I'm using online armor for the first time and it seems to be a good program.
However, I installed the KM Player and tried to uninstall KM because it stole a bunch of my file associations, but it wouldn't uninstall until I exited online armor altogether. Seems they don't play well.
I'm a little confused as to which is the best HIPS firewall. According to the quick selection guide, Private Firewall is the new number one yet, in the detailed review of each HIPS firewall, in the 'Firewalls With Strong HIPS Protection' section, it says "Comodo Firewall is the best choice for users seeking a full featured security suite".
Is it simply that the quick selection guide has been updated but the detailed reviews haven't, because those for Comodo and PrivateFirewall look just the same as when Comodo was still number one? Thanks.
Wonderful reviews and information. Terrific site. One thing that seems
missing although I might be missing the obvious and that is do any of these
free firewalls provide any level of any kind of support.
I'm one week from expiration of Comodo commercial so a prompt response would be much appreciated. I found support from Comodo somewhat erratic.
thanks
Hugh
Pages