portmaster

Portmaster is a free and open-source application firewall and privacy suite for Windows and Linux desktops. It aims to give users visibility and control over all network activity on their machine, with privacy-friendly defaults that work without configuration while still allowing detailed per-app and global rules. Core capabilities described in the README: - Monitor all network activity and block anything, with global and per-app settings. - Automatically block trackers and malware using filter lists. - Secure DNS with DoH/DoT support, including interception of stray DNS queries, split-horizon support and horizon validation against rebinding attacks. - Privacy Filter with allowed network scopes (localhost, LAN, Internet, P2P, inbound) and rules based on domains, IPs, countries and more. - Network History (paid) to record and search connection details in a local database, with auto-delete or on-demand deletion. - Per-app bandwidth visibility (paid). - SPN, a paid next-generation privacy network positioned between VPN and Tor, using onion encryption over multiple hops, with per-app routing choices and community-hosted nodes. Technical approach: Portmaster integrates into the network stack using nfqueue on Linux and a Windows Filtering Platform kernel driver on Windows. Packets are intercepted at the raw packet level so every packet can be seen and stopped. Connection ownership is determined with eBPF and /proc on Linux, and a kernel driver plus the IP Helper API on Windows. It supports special processes such as Snap, AppImage and scripts on Linux, and Windows Store apps and svchost.exe services on Windows. The core service runs as a system service while UI components run in user context; the main UI currently uses Electron but can also be opened in a browser. Data is processed locally on the device, except for the SPN, and updates plus intelligence data are signed and downloaded automatically. Documentation, installation guides, compatibility notes, architecture details, settings handbook and a developer API are available via the project wiki and docs site. The README also outlines a work-in-progress build process using Earthly and Docker, producing artifacts in ./dist.