Which kind of Windows firewall tool fits?
The tools in this space are built for different jobs. This page compares the kinds by what they can do, not by brand. Where a kind of tool varies from product to product, the table says so rather than guessing.
| Built into Windows | Ferrite | Other kinds of tool | |
|---|---|---|---|
| What it is for | Baseline protection on every Windows PC | Seeing and controlling what each program on one PC connects to | Varies: monitors show activity, DNS filters block names, privacy suites bundle a firewall with other tools |
| Cost | Free, part of Windows | Free forever; Pro from CA$99/yr (≈US$71) | Varies, from free to subscription |
| Live view of which program is connecting | Not in the firewall itself (Resource Monitor shows live connections separately) | Yes, on every plan: each connection named to its program, or shown as Unknown program | Monitors and privacy suites: usually. DNS filters: no, they see names, not programs |
| Block by program | Yes (a program rule, in advanced settings or PowerShell) | Yes, on every plan, through Windows' own filtering platform | Varies: monitors often only watch, privacy suites usually can, DNS filters can't |
| Rules by address, port, country, time of day | Address and port: yes. Country and time-of-day rules aren't built in | Yes, on every plan (country rules cover most countries; the 16 largest are flagged not enforced) | Varies |
| Reads inside connections (server names, fingerprints) | No | Pro reads inside 30+ protocols; every plan names 100 | Varies; many don't |
| Stops apps using their own encrypted DNS | No built-in feature; you can write rules by hand for known resolvers | Yes, on every plan: Bypass prevention (you turn it on) | DNS filters can't: that traffic never reaches them. Others vary |
| Look-back history | An optional log file, off by default; no built-in viewer | 90 days on every plan; Pro adds SQL queries and a replay timeline | Varies |
| Where your connection data goes | Stays on your PC | Stays on your PC: zero telemetry, which you can check on the wire | Varies. A DNS filter necessarily sees your lookups; check the one you use |
| What it installs | Nothing: it is part of Windows | An app, a background service and a bundled packet-capture driver (WinDivert) | Varies |
The firewall built into Windows
It’s already on every Windows PC, it’s free, and it does real, system-level filtering — that’s not nothing. It was built as baseline protection rather than a tool you check daily: the firewall itself has no live view of what’s connecting right now (Resource Monitor does that separately), program rules live in an advanced-settings console or PowerShell that few people open, and it has no concept of reading inside a connection or of apps bringing their own encrypted DNS. If you’ve never configured it beyond the default, you’re not missing a hidden feature; that is the intended experience.
Traffic monitors
Tools in this group show which programs are using the network, and some can also block. They suit you if you mainly want to see before you decide. What differs between products is whether they can block at all, whether they keep history, and where their data goes, which is why the table says “varies”. Check those three before you pick one.
DNS filters
A DNS filter works on name lookups: it can refuse to answer for an advertising or malware domain, for every device that uses it. That is useful and cheap. It can’t tell which program asked, can’t block by address or port, and doesn’t see an app that brings its own encrypted DNS and skips it. Ferrite includes its own DNS lists and a switch that stops that bypass; here is how it works.
Privacy suites that include a firewall
These bundle a firewall with broader privacy tools, such as anti-tracking and sometimes a VPN-like network of their own. They fit if you want one product for all of it. Ferrite is narrower on purpose: it is a host firewall for one PC, and it does not include a VPN.
Where Ferrite specifically differs
- Bypass prevention for DNS. Ferrite blocks an app that tries to skip your DNS with an encrypted lookup of its own, and shows which program tried. It is on every plan and starts off; see the full explainer.
- Reading inside connections (Pro). Every plan names 100 protocols. Pro reads inside 30+ of them (the TLS server name, JA3 and JA4 fingerprints, HTTP headers, SSH banners) and lets you write rules on what it finds. Ferrite does not decrypt HTTPS; see what it names, and how.
- History you can query. Ferrite keeps 90 days of connection history on every plan, and on Pro real SQL analytics (DuckDB) and a replay timeline read it, entirely on your PC.
- Zero telemetry, either way. Nothing about your connections leaves your machine, on Free or Pro. See how to check that yourself.
Where Ferrite does not fit
- One PC, not a network. Ferrite protects the machine it is installed on. It doesn’t filter your network for other devices or manage a fleet.
- Windows 10 and 11 only, today. macOS and Linux are on the roadmap.
- It installs a kernel driver. Per-app blocking runs on Windows’ own filtering platform, but Ferrite also bundles a third-party packet-capture driver (WinDivert) that loads on every install; here is what it does. If you won’t run a third-party driver, Ferrite is not for you.
- Free has limits. Up to 25 rules and 100 blocked sites of your own; Pro lifts them.
- It is not a VPN or an antivirus.