Portmaster is a free and open-source application firewall that monitors and controls all network activity on Windows and Linux desktops.
The tool addresses the problem of unwanted network surveillance and data leakage by intercepting packets at the raw network level and applying filtering rules before they leave your device. On Linux, it uses nfqueue to intercept packets and eBPF to identify which application owns each connection. On Windows, it integrates via a kernel driver using Windows Filtering Platform and the IP Helper API. All processing happens locally on your device. The firewall offers sensible defaults that block trackers and malware automatically, while also supporting granular per-application rules based on domains, IP addresses, countries, and network scopes like localhost, LAN, and internet traffic.
Portmaster suits users who want privacy protection without configuration overhead, as well as those who need detailed control over network behavior. The tool handles complex scenarios like Snap packages, AppImages, and Windows Store apps by identifying their true network owners. It includes secure DNS via DoT and DoH with protections against DNS rebinding attacks. Some advanced features like network history recording and per-app bandwidth monitoring are available through paid tiers, while the core firewall functionality remains free.
The project maintains active development with regular updates to its core filtering engine and platform-specific integrations. The codebase shows ongoing refinement of its packet interception mechanisms across both operating systems. The team continues expanding support for edge cases in process identification and application matching. Documentation and user-facing materials receive consistent updates to reflect feature changes and capabilities.
