A firewall for people who do not want to become firewall administrators
Portmaster makes an unusually technical promise understandable: show every application's network activity, then let the user decide what may connect. Instead of asking people to reason primarily about ports and protocols, it builds profiles around applications and rules around recognizable targets such as domains, IP addresses, countries, localhost, the local network, peer-to-peer traffic, and inbound connections. Default filter lists block common tracking and malware domains before a user writes a rule.
That is a useful layer above the firewalls included with Windows and Linux. Portmaster provides one local view across browsers, services, games, and updaters. It also accounts for awkward process identities including Snap and AppImage applications, scripts, Windows Store apps, and services hosted under svchost.exe.
The project is not merely a nicer rule editor. It intercepts packets through nfqueue on Linux and the Windows Filtering Platform on Windows. It determines connection ownership through eBPF and /proc on Linux, and through a driver plus Windows APIs on Windows. The core runs as a system service while the interface and notifier run in the user's session.
Secure DNS is valuable and invasive
Portmaster catches DNS queries that applications try to send elsewhere, routes them to its own resolver, and forwards them over DNS over TLS or DNS over HTTPS. That closes a common gap where one application ignores the system's chosen encrypted resolver. Split-horizon support preserves private network names, while horizon validation is intended to defend against rebinding attacks.
The benefit is system-wide policy without configuring every browser and client. The risk is that Portmaster becomes part of the path for almost every name lookup. A current Windows issue documents an oversized UDP packet causing the internal DNS listener to fail and its retry delay to grow, producing repeated outages in the reporter's environment. The report includes a small reproduction and says the relevant code was unchanged in version 2.2.1. It is one detailed report, not a measured failure rate, but it illustrates the blast radius of a DNS interception bug.
VPNs add another source of friction. Safing's own compatibility guide explains that Portmaster and VPN clients can both hook DNS, while kill switches can also conflict with traffic routing. The suggested escape hatch may involve disabling the VPN's DNS redirection or using OpenVPN. Recent reports describe DNS failure with Proton VPN on Windows and a WireGuard connection failing on Debian and Solus whenever Portmaster runs, even with SPN and DNS modules disabled in the latter case. Anyone dependent on a corporate or privacy VPN should test before rolling Portmaster out widely.
The free product has meaningful limits
The free, GPL-licensed core includes live network monitoring, application rules, filter lists, and secure DNS. The README says processing is local except when the optional SPN service is used. Signed software updates and intelligence data such as filter lists and geographic IP information arrive automatically.
Recording and searching historical connections costs money, as does per-application bandwidth visibility. SPN, Safing's multi-hop privacy network, is a higher paid tier. The free version answers what is connecting now and lets you control it, but investigating a past incident or tracking long-term data use hits the subscription boundary.
SPN is also not simply another checkbox for an existing VPN. Safing describes multi-hop routes, onion encryption, destination-near exits, and per-app exclusions. Firewall-only users can ignore it. SPN buyers should evaluate the network service separately from the open-source local firewall.
Installation is easy until networking is unusual
Windows users can run the installer or use Winget. Installation registers a system service that starts at boot, and uninstallation requires a reboot. Linux users have DEB and RPM installers, an AUR package, and a shell installer. The Linux guide says setup downloads about 300 MB, does not start Portmaster automatically, recommends a clean reboot, and supports only current stable and long-term-support distributions.
Linux package purists should notice that the packages are initial installers and Portmaster subsequently updates itself. The long-running NixOS issue shows why that model clashes with systems expecting immutable or package-managed binaries. Building locally is not yet the polished alternative: the README labels the build process work in progress and asks for Earthly and Docker.
Recovery matters too. Safing's Linux documentation says a rapid unclean shutdown can occasionally leave iptables rules behind and break networking, then provides a recovery command. Save that command somewhere available offline. On either operating system, test ordinary browsing, local devices, containers, sleep and resume, and every VPN before assuming a quiet first hour proves compatibility.
Healthy project, serious failure modes
Portmaster has been developed since 2018 and has more than 13,000 GitHub stars. The last push was August 11, 2026, with issue activity the same day. Version 2.2.1 shipped June 16 with split tunneling plus fixes for profile migration, Linux SPN routing after resume, IPv6 cleanup, and an IVPN compatibility case. GitHub's 95 open count combines issues and pull requests, so it is evidence of an active queue, not 95 confirmed defects.
Documentation is one of the project's strongest assets. Beyond the concise README, Safing maintains installation details, compatibility tables, architecture explanations, a settings handbook, and a developer API. The docs are unusually candid about VPN conflicts, recovery commands, supported distributions, self-updating packages, and paid features.
Portmaster earns a recommendation because it turns useful network control into something ordinary technical users can operate. The recommendation has conditions: keep recovery instructions nearby, verify VPN behavior, and understand which history features require payment. If those conditions are acceptable, it provides more coherent desktop privacy control than assembling a firewall UI, DNS proxy, and block lists separately.