PacketHound brings Little Snitch-style outbound firewall control to Windows

An ask-first firewall for outgoing traffic

PacketHound, a free utility for Windows 10 and 11, has drawn attention on the Hacker News front page for bringing the kind of outbound connection control long associated with Little Snitch on the Mac to Windows. According to the project's website, the first time an installed application tries to reach the internet, PacketHound shows a prompt identifying the app, its publisher, the destination and the port, and asks whether to allow or block it. The answer is remembered either permanently or until the app quits, and can apply to the whole program or to a single address, host or domain.

Windows' own components are waved through silently, so users are not flooded with questions about system services. The site is specific about how that trust is earned: a program only counts as Windows if it sits in a Windows folder, is owned by the system and carries a valid Microsoft signature, so dropping malware into System32 earns no special treatment. Dual-use tools that malware frequently abuses for downloading payloads — PowerShell, curl, certutil, mshta and rundll32 — still trigger a prompt even though they ship with Windows.

Built on Windows Firewall, not beside it

The tool installs no kernel driver and runs no background service of its own. Instead, it switches Windows Firewall's default outbound policy to block, so any program without an existing rule cannot get out. Windows logs each blocked attempt; PacketHound watches that log, quietly approves verified Windows binaries, and prompts for everything else. Every decision becomes an ordinary Windows Firewall rule that you can inspect in wf.msc, and enforcement keeps working even when PacketHound itself is closed.

Small usability details are documented on the site: prompts appear on top but never steal keyboard focus, so you cannot approve one by accident mid-sentence. A rules view lets you flip any app between allow and block with one switch, search and sort existing decisions, and clear out entries for uninstalled programs. An activity log lists every blocked attempt with its hostname, port and outcome, and double-clicking a row copies the IP address. Undecided items can be deferred and revisited later from the rules tab.

Caveats worth knowing

The mechanism has inherent trade-offs that the project spells out frankly. Because PacketHound learns about an app only after its first connection is denied, that first attempt fails and the app must try again once allowed — most do so automatically, and a browser just needs a refresh. Some installers give up after the initial block; PacketHound therefore offers a five-minute pause after you approve one, and lets through signed installers and updaters it has already seen before they even start.

Rules cover an entire app by default. Narrowing one to a host or domain is possible, but since Windows Firewall matches only IP addresses, PacketHound resolves a name's addresses as the app uses them, so the first connection to a new address may need a retry, and sites sharing an address — common with CDNs — share the rule. A temporary "until the app quits" rule survives until every process has ended, which matters for browsers and tray applications such as Edge, Chrome, Discord or Steam that keep running after their windows close. On managed corporate machines, firewall settings pushed through Group Policy take precedence.

Free, open source, no telemetry

According to the site, PacketHound is free with no trial, account or advertising, funded by voluntary donations, and its full source code is published on GitHub under the GNU General Public License v3. The project states that it collects no data and has no analytics: it performs ordinary DNS lookups so prompts can show a hostname rather than a bare IP, and a weekly version check — which can be switched off — is said to contain no information about the user or machine.

Why it matters

Windows Firewall has technically supported outbound rules for years, but the default experience gives users almost no visibility into which installed apps are phoning home, or where. Tools like Little Snitch made per-connection prompting a staple of macOS hygiene, while comparable options on Windows have tended to be paid or awkward. PacketHound fills that gap at no cost, and by layering on top of the operating system's native firewall rather than installing a driver, it keeps enforcement auditable and persistent. For privacy-conscious users, and for anyone reacting to the latest telemetry controversy, the source being open under the GPL removes the trust problem that plagues security software itself.