Firewall Engine

Firewall Engine

CyberWall uses the Windows Filtering Platform (WFP) for kernel-level network filtering with a default-deny architecture.

---

How It Works

Architecture

CyberWall operates at two levels:

Detection Methods

Default-Deny Philosophy

Unknown connections are blocked by default:

1. App attempts network connection
2. WFP intercepts the connection
3. CyberWall checks for existing rules
4. If no rule exists → prompt or block
5. Allow always and Block become persistent rules; Allow once and dismissed prompts apply temporarily (about 10 minutes)

---

Firewall Modes

Ask to Connect (Default)

When an unknown app tries to connect:

• A popup prompt appears
• Choose Block, Allow once, or Allow always
• Allow once and dismissed prompts are temporary (about 10 minutes); Allow always and Block save a persistent rule
• Auto-block timeout for unanswered prompts

Block All

Silently blocks all unknown connections:

• No prompts shown
• Known apps with allow rules still work

Killswitch

Total network lockdown:

• Blocks all network traffic, including allowed apps
• No prompts shown
• Emergency use

Disabled

No filtering:

• All connections allowed
• Monitoring stops while disabled
• Useful for troubleshooting

Mode Switching

Change modes from:

• System tray icon → right-click menu
• Main window toolbar mode selector

---

Rules

Rule Types

Each rule combines a verdict with a direction:

Creating Rules

Rules are created when:

• You respond to a popup prompt with Allow always or Block
• You edit per-direction verdicts in the Edit rule dialog

Smart Toolchain Rules

CyberWall automatically resolves companion executables:

• Git → Auto-detects git-remote-https, git-remote-http, ssh, etc.
• Edge WebView2 → Maps host processes correctly

Rule Storage

Rules are stored in:

%ProgramData%\CyberWall\rules.json

Rule Properties

Each rule stores:

---

Process Identity

How CyberWall Identifies Apps

Rules match by executable path and Store package identity. The UI also shows descriptive info:

WebView2 Host Resolution

Maps Edge WebView2 runtime processes back to their host applications.

---

Auto-Block Timeout

Configuration

When a prompt is not answered:

• Enabled — Auto-block after timeout
• Duration — 30 seconds to 30 minutes (default: 5 minutes)
• Action — Block the connection

Use Case

Prevents indefinite prompts:

• If you step away from the computer
• If a prompt appears during a fullscreen app
• Reduces unwanted background connections

---

Rule Management

Main Window

The main window shows all rules:

• Search and filter
• Edit rule properties
• Delete rules

Context Menu

Right-click a rule for actions: