Using Ferrite.

On this page: Install · First start · Switches worth knowing · Where Ferrite keeps things · The command line · Updates · Uninstall · Help

Install

Ferrite runs on Windows 10 and 11, 64-bit. Download the installer from the download page, which also shows how to check its SHA-256 and what to click if Windows warns about an unknown publisher.

The installer asks for admin rights once. It then sets up four things:

• The app, which runs as a standard user.
• Ferrite’s background service, a Windows service named “Ferrite Engine Service”. It runs as LocalSystem, starts with Windows, and restarts itself if it stops. It does the blocking, so your rules keep working when the app is closed.
• A packet-capture driver (WinDivert), which the service uses to see connections. How enforcement works says what it does and what it doesn’t.
• The ferrite command, added to your system PATH. Open a new terminal to use it.

If the installer finds another personal firewall already on the PC, it tells you and installs in Cooperative Mode: the other firewall keeps enforcing, and Ferrite shows what it decides. You can change that later under Settings ▸ Engine & service.

First start

The first time you open Ferrite, it asks once. “Turn on protection” blocks trackers and ads and encrypts your DNS lookups. “Not now” leaves your DNS as it was, and the Overview screen offers to turn it on later. DNS protection never starts by itself.

If a VPN handles your DNS, Ferrite stands down its DNS filtering and says so on the DNS screen. If you are upgrading from 1.0.x with DNS protection already on, it stays on, and Ferrite asks once whether to keep it.

Switches worth knowing

• Bypass prevention, under Protection ▸ DNS ▸ What gets blocked: stops apps from using their own encrypted DNS to skip your lists. It starts off. How it works.
• Download threat lists, under Settings ▸ Engine & service: whether Ferrite fetches the public threat lists it flags connections with.
• What goes over the network, under Settings ▸ Data & storage: the app’s own list of every kind of connection it makes. How to check it on the wire.
• License: paste your FERRITE_ key in the License panel to unlock Pro on that device, or start the 3-day trial there.

Where Ferrite keeps things

• The program: C:\Program Files\Ferrite. The app, the service, the command-line tool, the driver and the third-party license texts.
• Your data: C:\ProgramData\Ferrite, a folder only administrators can change. It holds your rules (rules.toml, signed by rules.toml.sig), your choices as signed files (protection.json, allowed.json, tier.json, dns-settings.json), and an encrypted record of threats stopped or flagged (threat-activity.dpapi, the latest 200 for 30 days). A signed file that does not verify is ignored, and what it guarded stays off, so more is blocked, never less.

None of it is sent anywhere. The full list of what Ferrite stores and what can leave your PC is on the verify page.

The command line

After install, ferrite --help works from any new terminal. The commands:

• ferrite status: engine status, mode, data source and live counters;
• ferrite rules: your rules, and rules add, delete, enable, disable to change them;
• ferrite stats, ferrite intel, ferrite logs: totals, threat-feed stats and the live feed;
• ferrite service: manage the Ferrite service (needs admin);
• ferrite tui: a read-only terminal dashboard.

Every read command takes --json for scripts and --watch SECS for a refreshing view. The exit codes are 0 for success, 2 if the firewall is not running, 5 if access to the pipe was denied, and 1 for any other error. The read commands need an elevated terminal, because the pipes they read carry an admin-only access list; changing rules with rules add/delete/enable/disable works without elevation, through the running service.

Updates

Ferrite checks for updates itself. Updates are cryptographically signed, and Ferrite will not install an unsigned or invalidly-signed one. While an update swaps the files, the installer leaves Ferrite’s filters in place, so enforcement does not lapse.

Uninstall

Remove Ferrite from Windows Settings ▸ Apps, or run uninstall.exe in the install folder. The uninstaller stops and removes the service, removes Ferrite’s filters from Windows, removes the capture driver, and takes ferrite off your PATH.

It then asks “Also remove your Ferrite data?” Yes deletes your rules, settings and logs in C:\ProgramData\Ferrite. No, the default, keeps them, so a later install picks your rules back up. A silent uninstall (/S) keeps them too; add /PurgeData to the uninstaller’s command line to remove them as well.

Help

Write to admin@ferritesec.com. Pro includes priority email. The FAQ covers plans, trials, license keys and what Ferrite sends over the network.

Download Ferrite free See pricing