PacketHound is an outbound firewall for Windows 10 and 11 that asks for a decision the first time an application tries to reach the internet. The prompt shows the application, its publisher, the destination and the port. The answer, Allow or Block, is stored as a Windows Firewall rule for the whole app or for a single address, host or domain, and applies permanently or until the app quits. Windows components pass automatically.
- First-connection prompt. When an application without a rule tries to reach the network for the first time, PacketHound shows a window with the program name, its publisher, the destination address and the port number. The prompt appears on top of other windows without taking keyboard focus, so a keystroke made while typing cannot answer it by accident. It has no close button: the options are Allow, Block or Decide later.
- Rule scope. A decision can cover the whole application or be limited to one IP address, one host such as api.example.com, or a whole domain such as *.example.com. Any connection is the default. Windows Firewall matches only IP addresses, so PacketHound adds the addresses of a name as the application uses them. The first connection to a new address may require a retry, and sites that share one address, as is common with CDNs, share the rule.
- Rule duration. A rule can stay permanently or last only until the application quits. Temporary rules are removed after every process of the program has ended, not only when its window is closed. Browsers such as Edge and Chrome and tray applications such as Discord or Steam keep running in the background, so their temporary rule stays until the last process exits.
- Automatic approval of Windows components. System components are approved without a prompt, so questions concern only the programs the user installed rather than hundreds of Windows services. Each approval is stored as a silent rule in a separate group named PacketHound (Windows components), apart from the rules created by the user.
- Verification of system files. A program counts as part of Windows only if it is located in a Windows folder, is owned by the system and carries a valid Microsoft Windows signature. A malicious file copied into System32 receives no automatic approval. The settings define what is treated as Windows.
- Control of risky system tools. PowerShell, curl, certutil, mshta and rundll32 are part of Windows, but malware often uses them to download payloads. PacketHound asks before these tools connect, the same as for any third-party program.
- Operation on top of Windows Firewall. PacketHound installs no kernel driver and no service of its own. It switches the outgoing default of the firewall to block and watches the security log for blocked outbound connection events (ID 5157). Every decision is an ordinary Windows Firewall rule visible in wf.msc, and it keeps working when PacketHound is closed. On exit, the program asks whether to keep blocking apps that have no rule yet.
- Rules list. The Rules tab gathers all decisions. Each application switches between Allow and Block with one toggle. The list supports search and sorting, and shows the date of each decision, what the rule applies to, which rules are temporary and the state of each rule in a separate Status column.
- Cleanup of removed programs. Rules for programs that no longer exist on the computer are highlighted as Program not found. The Remove missing command deletes them after confirmation, so the list keeps only current applications.
- Activity log. Every blocked attempt is recorded with its hostname, port and what happened next. Names are resolved with a regular DNS lookup. A double click on a row copies the IP address, and the right-click menu opens the decision for that application.
- Deferred decisions. The Decide later option keeps the application blocked and lists it on the Rules tab under Waiting for your decision, with a Decide button. If the program is still running, PacketHound asks again after 10 minutes or at the next connection. The main window, the tray icon and its menu show how many applications are waiting.
- Protection pause. From the tray icon, protection can be paused for 5 minutes, 15 minutes, an hour or until it is turned on manually. A timed pause ends by itself, even after a restart. During the pause, apps without a rule can connect, while Block rules stay in force.
- Installer handling. Some installers fail because their first connection attempt is blocked. PacketHound recognizes installers and updaters that run from a temporary folder: their rules last only until they quit, and signed ones are remembered, so the next copy passes before it even starts. After an installer is approved, a notification offers to pause protection for 5 minutes in one click.
- Settings and tray icon. The program lives in the notification area; a right click pauses it or exits. The settings cover start at sign-in, the definition of Windows components, restoring the Windows Firewall defaults and turning off the weekly version check. The main window remembers its size, position and maximized state.
- Privacy. PacketHound collects no personal data or usage statistics and has no accounts or advertising. Settings and the log stay in C:\ProgramData\PacketHound, and the uninstaller removes them. The only network activity consists of DNS lookups of server names and a weekly version check that sends no information about the computer.
- Installation and removal. Changing firewall settings and reading the security log require administrator rights. The program works alongside Microsoft Defender and most antivirus products, but it cannot operate if a third-party suite replaces Windows Firewall, and on computers managed by Group Policy those policies take priority. On removal, the uninstaller asks whether to delete the rules and restores the previous firewall settings.
PacketHound was created in 2026. Version 1.0.0 was published on 5 November 2026 with the Allow or Block prompt, automatic approval of Windows components, a rules list, an activity log and an installer with a clean uninstall. On 6 November, versions 1.1.0 and 1.2.0 followed: the first added rules limited to an IP address, host or domain and temporary rules, and the second added deferred decisions, protection pause, installer recognition and detection of missing programs. The project is maintained under the name packethound-app on GitHub and on the website packethound.app, and its support page credits the author as Henrys_Cat. The program is written in C# on .NET 10 and manages rules through the Windows Firewall COM interface. It runs on 64-bit Windows 10 (version 1809 and later) and Windows 11, and the installer takes about 68 MB.
Alternatives to Packet Hound:
For Packet Hound there are 2 alternative programs. Free: 2, paid: 0.
Maxwave Proxifier is a rule-based tunneling and proxy application.
Price: Free Size: 29.8 MB Version: 1.2.4 OS: Windows, Linux, MacOS
Little Snitch is a network monitor and application firewall for macOS that alerts you to every attempt to connect to the Internet, allowing the user to decide whether to allow…
Price: Free Size: 36.8 MB Version: 6.3.3 OS: MacOS
