PyFirewall is a Windows desktop application that monitors network connections in real time and lets you manage Windows Defender Firewall rules for both incoming and outgoing traffic. It is aimed at Windows users who want per-application and global IP/domain control without leaving the desktop, combining live connection tracking with process attribution, connection-rate and upload-threshold alerts, and Auto-Block Protection in a single Tkinter interface. Unlike firewall front ends that only expose rule lists, PyFirewall pairs rule management with packet-level monitoring via Scapy and psutil, supports IPv4/IPv6 addresses and CIDR ranges, and can export connection data to CSV or move managed rules between machines with JSON.

• Live network connection monitoring with process attribution
• Incoming and outgoing connection visibility
• Per-application allow/block rules
• Global IP and domain allow/block rules
• IPv4 and IPv6 address and CIDR support
• Connection-rate and upload-threshold alerts
• Auto-Block Protection with temporary holds and cancellation prompts
• Filter All Connections mode for live filtering of new requests
• Configurable connection and alert history limits
• Sortable, resizable tables with saved column visibility and ordering
• CSV export for connection data
• JSON export/import for managed firewall rules
• System-tray support with close-to-tray behavior
• Optional automatic start at Windows login
• Dark and light theme support
• Optional startup update checks and a manual Check for Updates action
• Administrator elevation and single-instance guard on launch

• The application must be started with elevated privileges; without them, live traffic capture and Windows Defender Firewall rule management will not function.

• Tkinter is included with most standard Windows Python installers; custom or embedded distributions may need it enabled explicitly during setup.

• Npcap should be installed with its standard options so that loopback and non-loopback capture work as expected.

• The Python package dependencies can be resolved from the bundled requirements file:

• At least one active network adapter with IPv4 or IPv6 connectivity is needed to observe and manage connections.

• A writable application directory is required, since configuration is stored in firewall_config.json beside the program files.

PyFirewall is a Windows desktop tool and must run with Administrator privileges to inspect traffic and modify Windows Defender Firewall rules. Before installing, confirm the following prerequisites are present:

1. Obtain the latest PyFirewall release package and unpack it into a folder.
2. Keep all project files together in that same directory.
3. Right-click Install-PyFirewall.cmd and choose Run as administrator.
4. Follow the prompts for required components and startup options.
5. If the Npcap installer appears, complete it manually.
6. PyFirewall launches automatically once installation finishes.

1. Install Python 3.8+ with Tcl/Tk and pip.
2. Install Npcap.
3. Unpack the PyFirewall release package into a folder.
4. Open a Command Prompt or PowerShell window as administrator in the unpacked directory.
5. Install the Python dependencies listed in requirements.txt, then start the application entry point.

• Configuration is stored in firewall_config.json beside the application, so the install folder must remain writable by the account running PyFirewall.
• The application requires elevation on every launch; if it does not start from a shortcut, run the shortcut as administrator.
• Diagnostic output for unexpected errors is written to firewall_monitor_errors.log beside the application.

Launch PyFirewall from the desktop shortcut and approve the administrator elevation prompt. The application opens on the Connections view and immediately begins capturing traffic once Npcap is available.

The main window can be closed but will remain running in the system tray. Use Close from the tray menu to fully exit the application.

• Right-click a row in Connections to create an allow or block rule for the process or its remote address.
• Double-click a column divider to auto-size it; drag headers to reorder, and use the header menu to toggle column visibility. These preferences are saved.
• Use the filter box to narrow the table by process name, address, or domain.
• Export the current connection data to CSV from the view's context menu.

Rules can be scoped to a specific application or applied globally to an IP address, CIDR range, or domain. IPv4 and IPv6 are both supported. Changes are written as Windows Defender Firewall rules and verified after each transaction; failed writes are rolled back.

Rules can be exported to and imported from JSON for backup or transfer between machines.

When a connection exceeds the configured threshold within the time window, it is recorded in Alerts. With Auto-Block Protection enabled, PyFirewall prompts to block the application unless an existing rule already permits or denies it. Temporary holds can be cancelled from the prompt.

Enabling Filter All Connections sets the threshold to 1, so any new request is surfaced immediately.

Settings persist in firewall_config.json beside the application. Use Reset to defaults in the Settings view to discard all stored preferences and rules.

• Confirm Npcap is installed and its driver service is running. Reinstall it if the capture interface cannot be opened.
• Confirm PyFirewall is running as Administrator. Packet capture and firewall rule changes both require elevation.
• Check that the correct network interface is selected if capture appears to start but stays empty.
• Disable Filter All Connections temporarily to rule out an overly strict threshold hiding entries.

• Windows Defender Firewall may be managed by Group Policy. Domain-joined machines can override local rules.
• Verify the rule's direction (inbound/outbound) and profile match the connection you are testing.
• Application rules take precedence over global IP/domain rules; review both before assuming a rule failed.
• After a firewall profile change (for example, switching networks), PyFirewall re-applies saved profile settings — wait a few seconds and refresh the rules view.

• Confirm the application does not already have an Allow or Block rule; existing application rules suppress Auto-Block prompting.
• Temporarily disable Auto-Block Protection in Settings while investigating.
• Review the Alerts tab to identify which process and threshold triggered the prompt.

• Lower Max Connections / Alerts in Settings. Large histories increase redraw cost in the table views.
• Disable Filter All Connections when not actively live-filtering; a threshold of 1 records every new request.
• Export and clear connection data periodically using CSV export.

• PyFirewall writes firewall_config.json beside the application. Confirm the folder is writable and not read-only or under a protected location.
• If the file is corrupted, reset to defaults from Settings and reconfigure.
• Avoid running multiple instances simultaneously; each instance writes to the same configuration file.

• Startup update checks are optional. Disable Check for updates on startup in Settings if the network blocks the check.
• Verification failures during rule transactions are recorded in the error log rather than shown as dialogs; inspect it before retrying.

Unexpected errors are appended to firewall_monitor_errors.log beside the application. Before reporting an issue, gather:

firewall_monitor_errors.log # error tracebacks
firewall_config.json # current configuration (review before sharing)
Windows version and build # winver output
PyFirewall version # shown in the Settings tab
Npcap installed? (yes/no)
Running as Administrator? (yes/no)

Redact any private IP addresses, hostnames, or rule entries from the configuration file before sharing it.

Run Uninstall-PyFirewall.cmd as administrator and answer each prompt with Y or N.

The uninstaller may prompt you to remove:

• PyFirewall-managed firewall rules
• Saved Windows Firewall profile settings
• The scheduled task
• Desktop shortcuts
• Python and packages
• Npcap

The installer records which Python components were installed by PyFirewall, preventing any third-party dependency issues.

Prefer to remove things manually? Close PyFirewall from the system tray first, then delete the application folder to remove the program and its firewall_config.json.

Notes:

• Removing Python or Npcap may affect other applications that depend on them; skip those prompts if unsure.
• Firewall rules created by PyFirewall remain active until deleted, even after the application folder is removed.
• Restarting Windows after uninstallation ensures no tray process or scheduled task remains active.