A small, honest firewall that makes decisions by program instead of by port. No Windows Firewall involved.
What is Aspirers Firewall?
Aspirers Firewall is a lightweight Windows firewall built around a simple idea:
you should be able to decide which programs are allowed to access the network
without having to deal with complicated firewall rules, ports, or protocols.
Instead of creating rules such as "allow TCP port 443", Aspirers Firewall looks at
the program responsible for a connection and makes the decision based on your
application list.
For example, you can allow Firefox while blocking another application completely.
You can also use a blacklist if you prefer to allow everything by default and only
block specific programs.
The application provides a simple graphical interface where you can see running
programs, add them to your list, choose a filtering mode, and monitor network
activity in real time.
Aspirers Firewall does not modify or configure the built-in Windows Firewall.
It works independently, using the WinDivert driver to capture TCP and UDP
packets before deciding whether they should be allowed through.
Safety first: if Aspirers Firewall closes or crashes, network traffic is
allowed to flow again. The firewall is designed to fail open, so a problem
with the application should not leave you without internet access.
Two filtering modes
|
Mode
|
What happens
|
|
Whitelist
|
Everything is blocked except programs on your list.
|
|
Blacklist
|
Everything is allowed except programs on your list.
|
Whitelist mode is useful when you want tight control over network access.
Only applications that you explicitly add to the list are allowed to communicate
over the network.
Blacklist mode is more relaxed. Programs can access the network normally
unless you specifically add them to the blacklist.
If you are trying Aspirers Firewall for the first time, Watch Only is the
safest way to understand what the firewall will do before actually blocking anything.
Features
-
Per-program filtering: make firewall decisions based on the application
responsible for the traffic.
-
Live process browser: see running programs, process counts, and active
connections. Search and sort the list, then double-click a program to add or
remove it from your firewall list.
-
Whitelist and blacklist modes: choose between blocking everything except
your approved applications or allowing everything except selected applications.
-
Allow DNS: optionally allow applications to use DNS on port 53.
-
Allow local network: optionally allow communication with private,
link-local, and multicast addresses.
-
Watch Only mode: see what would be blocked without actually blocking it.
-
System tray support: minimize or close the main window while keeping the
firewall running in the background.
-
Live logging: see blocked traffic in the application and save the same
information to
blocked.log.
-
Hot reload: edit
config.txt while the application is running
and the configuration is automatically reloaded.
-
DHCP is always allowed: DHCP traffic is permitted so Windows can continue
to maintain its IP address.
-
Fail-open behavior: internal errors allow traffic through instead of
accidentally cutting off your network connection.
How it works
Aspirers Firewall works at the packet level, but you do not need to configure
individual ports or complicated networking rules.
-
WinDivert captures non-loopback TCP and UDP packets.
-
psutil is used to determine which running process owns the local port
associated with the connection.
-
The firewall checks the packet against its built-in exceptions and your
configuration.
-
DHCP traffic is always allowed.
-
If Allow DNS is enabled, DNS traffic is allowed.
-
If Allow local network is enabled, traffic to local, private,
link-local, and multicast addresses is allowed.
-
For everything else, the application is checked against your whitelist or blacklist.
-
Allowed packets are re-injected into the network stack. Blocked packets are dropped.
The firewall also keeps a short-term cache of recently closed connections.
This helps it continue identifying the correct application when the final packets
of a connection arrive after the process or connection information has already
disappeared from the normal process table.
Getting started
Requirements: Windows 10 or Windows 11 (64-bit) and administrator privileges.
If you are running the program from source, you also need Python 3.9 or newer.
The required Python packages can be installed automatically when the application starts.
Run from source:
python "Aspirers Firewall.pyw"
Windows will ask for administrator permission because packet interception requires
elevated privileges.
You can also build a standalone executable and run
AspirersFirewall.exe without starting the Python script directly.
Build your own .exe:
pip install psutil pydivert pystray pillow pyinstaller
python -m PyInstaller --onefile --noconsole --uac-admin --icon logo.ico --name AspirersFirewall --collect-all pydivert --collect-all pystray "Aspirers Firewall.pyw"
The executable will be created at
dist\AspirersFirewall.exe.
The --collect-all pydivert option is required because the
packaged application needs the WinDivert driver files.
Tip: if pyinstaller is not recognized as a command,
use python -m PyInstaller instead.
How to use Aspirers Firewall
The basic workflow is simple:
choose what you want to control, select a mode, test the configuration,
and then start filtering.
1. Open the Running Processes tab
When the application opens, go to the Running Processes tab.
This screen shows the programs currently running on your computer.
Depending on the application, you may see more than one process belonging
to the same program.
Use the search box to find a specific application and sort the list to make
it easier to navigate.
The list can show information such as the executable name, the number of
running processes, and active network connections.
2. Add programs to your list
To add a program to your firewall list, simply double-click it
in the Running Processes tab.
Programs that are already on your list are highlighted, making it easy to
see which applications are currently selected.
You can also manage your entries from the My List tab.
This is useful when you want to review your configuration or remove an
application that you no longer want to control.
You can add an executable using its full path or simply its file name.
C:\Program Files\Mozilla Firefox\firefox.exe
A full path matches that specific executable location.
A simple file name such as firefox.exe matches programs with
that executable name regardless of their location.
3. Choose your mode
At the top of the application, choose between Whitelist and Blacklist.
If you choose Whitelist, the programs on your list are the programs
you want to allow. Everything else is blocked unless it matches one of the
built-in exceptions or enabled options.
This mode is useful when you want to know exactly which applications are
permitted to access the network.
If you choose Blacklist, the programs on your list are the programs
you want to block. Everything else is allowed normally.
This mode is useful when you only want to stop a few specific applications
from accessing the network without creating a complete allow-list.
4. Use Watch Only before blocking anything
If you are using whitelist mode for the first time, do not immediately
start blocking traffic.
Instead, enable Watch Only first.
Watch Only allows the firewall to observe network traffic and record what
it would block, without actually dropping the packets.
This gives you a safe way to discover which programs on your computer are
using the network. Open your browser, launch the applications you normally
use, check for updates, visit websites, and perform your usual activities
while watching the log.
If something important appears in the log, you can add the corresponding
application to your list before enabling actual blocking.
This is especially useful on Windows because many applications and background
services may communicate with the network without being immediately obvious.
5. Check the Log tab
The Log tab shows network activity detected by the firewall.
When using Watch Only, the log shows traffic that would have been blocked.
When the firewall is actively filtering, it shows traffic that has actually
been blocked.
The same information is also written to blocked.log, which can be
useful if you want to inspect the activity later.
If an application stops working after enabling the firewall, the Log tab is
one of the first places you should check. It can help you identify which
executable is responsible for the blocked traffic.
6. Decide whether to allow DNS
The Allow DNS option allows applications to send DNS traffic on
port 53 regardless of the application list.
DNS translates domain names such as example.com into IP addresses.
If you are testing a strict whitelist, allowing DNS can make the setup easier
because applications can continue resolving domain names even before you have
added every application to your list.
If you want the strictest possible per-application control, you can leave
this option disabled and explicitly allow the applications that need network
access.
7. Decide whether to allow local network traffic
The Allow Local Network option allows applications to communicate with
private, link-local, and multicast addresses.
This can be useful for devices and services on your local network, such as
network printers, local media devices, discovery protocols, or other computers
connected to the same network.
Local network traffic and internet traffic are not the same thing.
This option is mainly intended to allow local-network communication while
the firewall is filtering external traffic.
8. Start the firewall
Once you have reviewed your configuration, press Start.
If you are using whitelist mode, make sure you understand that applications
not on your list will be blocked.
If the firewall detects that whitelist mode has an empty list, it warns you
before starting because an empty whitelist means normal network traffic will
be blocked.
Important: an empty whitelist means nothing is allowed except
traffic covered by the built-in exceptions or enabled options.
If you are unsure, use Watch Only first.
9. Keep it running in the background
Aspirers Firewall can run in the system tray.
Minimizing or closing the main window can leave the application running next
to the Windows clock while it continues to monitor and filter traffic.
This makes it possible to configure the firewall once and then leave it
running quietly in the background.
If you need to stop filtering, use the application's controls or the
system tray menu to stop the firewall.
A simple recommended workflow
If you are not sure where to start, the following workflow is a straightforward
way to build a whitelist:
- Open Aspirers Firewall as administrator.
- Go to Running Processes.
- Enable Watch Only.
- Choose Whitelist.
- Use your computer normally: browse the web, open the applications you use,
and perform your usual tasks.
- Check the Log tab to see which applications generate network traffic.
- Add the applications you actually want to allow to My List.
- Enable Allow DNS or Allow Local Network if you specifically
need those exceptions.
- Turn off Watch Only.
- Start the firewall and test your normal applications again.
If something stops working, check the Log tab. You can then decide whether
the blocked application should be added to your list or whether one of the
optional exceptions should be enabled.
This approach lets you build your firewall configuration gradually instead
of trying to guess every program that needs network access beforehand.
The configuration file
Aspirers Firewall stores its settings in a plain-text config.txt
file next to the program.
You can edit the configuration from the application or open the file manually
with a text editor.
Example:
# Firewall configuration
@mode=whitelist
@dns
@lan
C:\Program Files\Mozilla Firefox\firefox.exe
chrome.exe
Lines beginning with # are comments and are ignored.
@mode=whitelist enables whitelist mode, while
@mode=blacklist enables blacklist mode.
@dns enables the DNS exception, and @lan enables
the local-network exception.
You can then add applications using either their full executable path or
just their file name.
The configuration is automatically reloaded while the application is running,
so you do not necessarily need to restart the firewall after editing the file.
Command-line options
-
--start starts traffic filtering immediately when the application launches.
-
--hidden starts the application minimized to the system tray.
For example:
AspirersFirewall.exe --start --hidden
These options can be useful if you want Aspirers Firewall to start automatically
with Windows and immediately begin using your saved configuration.
Limitations
-
Filtering decisions rely on local port lookups. A connection that opens and
closes extremely quickly may not be associated with its owner in time and can
therefore be treated as an unknown application.
-
Traffic from processes that cannot be identified is treated as unlisted.
-
Only TCP and UDP traffic is filtered.
-
Aspirers Firewall is a hobby-grade project and is not intended to replace a
complete commercial security or endpoint-protection suite.
-
Some antivirus or security products may flag PyInstaller executables that load
a packet-capture driver. Adding an exclusion for the application folder may
resolve such warnings.
Troubleshooting
The program will not start
Make sure you are running it with administrator privileges. If you have
antivirus or endpoint-security software installed, it may be preventing
the WinDivert driver from loading.
I lost my internet connection
Stop the firewall or close the application. Because Aspirers Firewall is
designed to fail open when it is no longer running, network traffic should
be allowed again.
If you are using whitelist mode, check that your browser and other required
applications are on the list. Also check whether you need to enable
Allow DNS.
A program is being blocked even though it is on my list
Check the Log tab and look at the executable path reported by the firewall.
Try using the application's full path instead of its file name, or try the
file name instead of the full path.
This can happen when an application has multiple executables or when the
executable you added is not the same one actually making the connection.
pyinstaller is not recognized
Use:
python -m PyInstaller ...
instead of:
pyinstaller ...
Credits
Aspirers Firewall is built with WinDivert, PyDivert,
psutil, pystray, and Pillow.
Thanks to the developers and maintainers of these projects for making the
underlying technology available.
Aspirers Firewall. Your network, your rules.
