Windows comes with a built-in firewall, and right out of the gate, I have to say that it is adequate. If you've never thought about the word "firewall" and don't have any interest in managing your Windows computer's network activity or security, then the default firewall is great.
Its best feature is, in fact, how invisible it is. When an app attempts to host a server or accept incoming connections for the first time, the Windows firewall pops up to ask if you want to allow access If you say "yes", then it will set up a rule to allow that app through, and you won't hear from it again or even know that it's working in the background. But, I do care about what my Windows computer is doing, and so I want a firewall app that gives me more visibility and control.
The problem is that most firewall apps want too much from me. I want insight, but I don't want to spend time configuring a firewall either. So I'm in this weird middle-space, where I want to have some control, I want to see what's going on and have some power to intervene, but not feel like I'm an underpaid and overworked network engineer.
Then I saw an article written by my colleague Dibakar Ghosh, going over the features of an app called Portmaster. This app is available for Windows, as well as Linux. I decided to give it a try, and so far it's checked all the boxes on my list of requirements.
When you first install Portmaster, it makes a point of telling you that you almost certainly don't need to change any of the default settings.
By default, it blocks ads, encrypts your DNS requests, filters malware, and blocks trackers. Most people would see these as positive. Though we always appreciate it if you add How-To Geek to your ad-blocker's exception list! It's how we keep the lights on.
After installing it and letting it run, I could completely forget it was there. The only indication I had was that ads suddenly weren't displaying on websites anymore.
Speaking of allowing sites to show ads, you can do that from the network monitor, which is my favorite feature and the whole reason I wanted to use Portmaster in the first place.
You can see a world map that shows you which countries have been accessed by your apps recently. That can be a quick red flag, because I certainly don't expect Russia or China to be lit up. At the same time, if I see something odd, I can follow up immediately. For example, for a second, I was confused by Poland being on the list, but could then see that (of course!) my GOG client was the culprit. GOG is based in Poland, so it makes perfect sense.
If I click on GOG in Portmaster, it opens up a window where I can block the app instantly with a toggle, in case I think something weird is going on. Then I can look through the log at my leisure. Click on a connection entry, and it shows you which specific server the app is connected to and more.
But of more interest is looking at the list of blocked connections. After all, wouldn't you want to know why hundreds of connections from your Windows computer were blocked? If you open any of the entries, the reason for the block is listed. Usually it's because the server that the app was trying to connect to is on a block list that Portmaster uses, but once you have the IP address of that server, you can investigate why it's on a banned list in the first place.
I haven't mentioned it yet, but Portmaster is free and open-source software. So that does introduce an extra layer of assurance that there's nothing untoward in the source code. That said, there are paid versions that add investigation and packet inspection features. If you need packet inspection, you can get it for free using another FOSS app called Wireshark.
While I haven't run into this personally yet, Portmaster's deep integration with Windows networking can sometimes cause compatibility issues with some VPNs or apps. Speaking of VPNs, Portmaster is not a substitute for a VPN. It's configured with strong privacy features by default, but you're not getting a free encrypted tunnel or anything like that.
In the end, Portmaster seems to strike the best balance between my desire to know what's going on when my computer accesses my network, but not wanting to tinker with firewall rules or dealing with constant pop-ups.