Applies to Fort Firewall 3.20.6.

Fort Firewall is a firewall for Windows 7 and later. It allows or blocks network access per program. It can also filter by address, port, protocol, direction, network area and network profile, and limit bandwidth.

Fort uses its own Windows Filtering Platform (WFP) driver; it does not configure Windows Defender Firewall.

Getting started

• Overview
• Installation
• Getting around: tray icon and My Fort

How it works

• How Fort decides
• Filter modes
• Ask to Connect

Features

• Programs
• Groups
• Speed Limits
• Time Periods
• Zones
• Rules
• Traffic, connections and Filter Simulator

Reference

• Options reference
• Security
• Command line
• Limits

Help

• Common tasks
• Troubleshooting
• Further documentation

Fort identifies the program behind every connection by its executable path. It then decides whether to allow or block the connection: see How Fort decides.

• Per-program Allow / Block / Ask / Kill Process.
• Ask to Connect: a connection is paused till you allow or block it.
• Wildcard paths and rules inheritance from parent processes.
• Per-service filtering for svchost.exe.
• Groups, Speed Limits and Time Periods (schedules).
• Zones: address lists, including downloadable block lists.
• Text-based Rules.
• Traffic statistics, a connection log with block reasons, and a live Traffic Graph.
• A Filter Simulator, which shows how Fort would decide on a connection.
• Password protection and a command line.

Download the installer from Releases:

You also need:

• Microsoft Visual C++ Redistributable for the installer's architecture: x64 · x86 · ARM64.
  • The x86 installer needs the x86 redistributable, even on 64-bit Windows.
  • Only the x86 installer checks for it, on a new install. If it is missing, the installer offers the download and exits.
  • The x64 and ARM64 installers do not check, so install the redistributable first.
• Windows 10 and later: Memory integrity (HVCI) must be off. See below.
• Windows 7: update KB4474419, for SHA-2 driver signatures.
  • On a new install, the x86 installer checks whether Windows can verify the driver's signature.
  • If it cannot, the installer points you to KB4474419.
• Administrator rights to install the driver. Without the Windows Service, Fort must also run as Administrator.

The Fort driver is a signed loader. It loads the verified driver image into memory that is both writable and executable, which Windows Memory integrity (HVCI) forbids.

On a new install, the installer stops with "This program is not compatible with HVCI (Core Isolation)." if HVCI is on. Fort itself does not check HVCI later.

To turn it off:

1. Open Windows Security (Windows 11: Settings ▸ Privacy & security ▸ Windows Security).
2. Go to Device security ▸ Core isolation details.
3. Set Memory integrity to Off.
4. Restart Windows.

The HVCI wiki page has the details.

You can change the service, Explorer integration and auto-run later in My Fort.

1. Turn off Memory integrity (Windows 10+). Install with Windows Service on.
2. Fort starts in Auto-Learn mode: every new program is allowed and added to the list.
   • Auto-Learn lasts for Auto-learn seconds: (1 minute by default) after the service starts.
   • Start your usual Internet programs now.
3. Then Fort switches to Block, if not allowed. Programs not in the list are blocked and marked as alerts.
4. Open Programs. Allow the programs you trust and block the rest.
5. If something doesn't work, check Connections. See Troubleshooting.
6. Optional: enable update checks. See Updating.

Fort keeps its data in a Data folder next to FortFirewall.exe. It recognizes portable mode by a README.portable file in the same folder. The driver still needs Administrator rights.

A portable copy can use the Windows Service too: My Fort ▸ Windows Service ▸ Install also installs the driver, and then Fort runs without Administrator rights. Remove removes both. On Quit, such a copy asks "Remove the Windows Service and the Driver before quitting?": Yes removes them (with a UAC prompt) and quits, No just quits, Cancel keeps Fort running.

There is no uninstaller. To remove portable Fort:

1. Run Fort as Administrator and use My Fort ▸ Portable ▸ Uninstall.
2. Choose Quit from the tray menu and wait for Fort to exit.
3. Delete the folder.

1. In Options ▸ Schedule, enable Fort Firewall Update Checker. It is off by default; the interval is daily.
2. When a release is found, a "New version vX.Y.Z available!" notification opens My Fort ▸ About.
3. There, use Download, then Install. Check for update checks right away.

Options ▸ Options ▸ Auto Update has three switches, all off by default:

To move these folders:

• -p <folder> moves the main profile. Statistics and cache follow it; per-user UI settings do not.
• To move each folder separately, set these keys in FortFirewall.exe.ini next to the executable:
  • global/profileDir
  • global/statDir
  • global/cacheDir
  • global/userDir

Use Windows Settings ▸ Apps, or the Start-menu uninstall shortcut.

• At the end, the uninstaller asks Delete config & data files?. The default answer is No.
• Yes deletes %ProgramData%\Fort Firewall and your %LOCALAPPDATA%\Fort Firewall.
• With Check password on Uninstall, the installer and uninstaller ask for the Fort password. See Security.

Default clicks (change them in Options ▸ Interface ▸ Tray):

Notes on the menu:

• Services needs admin rights or the Windows Service.
• Kill Process and Kill child processes keep working while Filter Enabled is off.
• With Snooze Alerts on, notifications and sounds still occur.
• Block Traffic offers No Block, Block Internet Traffic, Block LAN Traffic, Block Internet and LAN Traffic and Block All Traffic.
• After Quit, filtering continues if the service is installed. Without the service, Fort's program settings stop applying.
• While Fort is locked by its password, or while Options is open, these items are disabled: Filter Enabled, Snooze Alerts, Block Traffic, Filter Mode and the Group items.

The My Fort page has four sections:

The About page shows the version and updates.

Also in the window:

• Footer links: Profile, Logs, Service Logs, Releases and Help.
• Lock / Unlock: shown if a password is set.
• Admin-only controls: the driver, portable and all-users controls require Administrator rights.
• Without the service and Administrator rights, Fort cannot access the driver: at startup it offers to install the Windows Service.

The driver checks each new connection (inbound or outbound, IPv4 or IPv6) in this order. The first step that decides wins. The Reason column in Connections shows which step decided. The Filter Simulator shows it for a connection you describe, without making it.

Notes

1. Loopback and broadcast: they are allowed unless Filter Local Addresses is on.
   • Block All Traffic blocks loopback, but not broadcast. To block broadcast too, turn on Filter Local Addresses.
   • The LAN block modes block broadcast.
2. Internet: in the Block Traffic modes, "Internet" means any address not in Local Network Addresses.
3. Ignore mode: unknown programs in Ignore mode skip step 6 and every later step.
4. Unknown programs: the Filter Mode either blocks them here, or allows them; in that case only step 15 still applies. Ask to Connect asks them, and also the alerted programs.
5. Groups: if the program has exclusive Groups, only those count. This step requires Block traffic for disabled Groups.
6. Zones:
   • An address in a rejected zone is blocked.
   • An address in an accepted zone is allowed.
   • Once accepted zones are set, any other address is blocked.
7. Rules and Network Filters:
   • The Group Rules run in ascending Group ID order. The first rule that decides wins.
   • A rule or the Network Filters with a Terminating Rule always decide: if nothing else matched, the terminating action applies, and the later checks of steps 14–15 are skipped. E.g. the program's Rule with a Terminating Rule leaves its Network Filters unused.
8. Allow Addresses: an allowed address skips the later steps, but an unknown program is still added to the list. Both lists apply to LAN addresses only while Filter Local Network is on.
9. Ask: a connection decided by the Ask action of the program, a Rule or a filter, or by the Ask to Connect mode, is paused till your decision. See Ask to Connect.

The Filter Mode decides only about programs that are not yet in the Programs list. Ask to Connect also asks about the alerted programs.

You can set the mode in the tray Filter Mode menu, in Options ▸ Options, or with -c filter-mode.

How the mode behaves:

• Auto-Learn timer:
  • Auto-Learn ends after Auto-learn seconds: and switches to Block, if not allowed.
  • The timer starts when Auto-Learn is turned on, and again at every service start while Auto-Learn is still active.
  • Disabled keeps Auto-Learn on indefinitely.
• Adding programs:
  • In Ask to Connect, Block and Allow modes, programs are added only when Collect New Programs is on. Without it, Ask to Connect blocks unknown programs without asking.
  • Connections decided before step 6 of How Fort decides, e.g. LAN traffic, never add a program. Addresses in Allow Addresses are the exception.
• Alerts: by default, Fort shows the alert window, a "New program detected!" notification and a sound in Ask to Connect, Block and Allow modes, but not in Auto-Learn. You can change this in Options ▸ Interface ▸ Programs, except for Ask to Connect.

Ask to Connect pauses a connection until you allow or block it. A connection is asked:

• in the Ask to Connect Filter Mode: when the program is unknown or alerted;
• in any Filter Mode, when it is decided by an Ask action:
  • of the program (Edit Program ▸ General, or Ask in the Programs window);
  • of a Rule (Edit Rule ▸ General);
  • of a filter (Action: Ask in the filter dialog, act(ask) in rule text);
  • of a Terminating Rule:.

A program with the Ask action is checked like an allowed one: see How Fort decides. Only the connections that would be allowed at step 16 are asked.

When a connection is paused:

• The Alert Program window opens for the program with the oldest paused connection, unless Snooze Alerts is on. Its OK moves on to the next program with paused connections.
• In the program's Edit Program dialog, the Paused Connections button (a pause icon with their count) appears next to the Connections button. It opens the Paused Connections window.
• If you don't decide within Ask to Connect seconds: (Options ▸ Options, 30 seconds by default), the connection is blocked.

The Paused Connections window lists the program's paused connections. A decided connection stays in the list, but no longer pending. Its buttons act on the selected connections:

Notes:

• Saving the program, e.g. by OK in the Alert Program window, decides its paused connections by its new settings, unless its action is still Ask. Connections asked by a Rule or a filter wait for your decision.
• An inbound connection can't be allowed or blocked once: use Continue or Allow Process.
• A program can have up to 9 outbound and 1 inbound paused connections. Its further connections are dropped silently, so the programs retry them later.
• Without a running Fort UI to decide them, paused connections are blocked after the timeout.
• Paused connections are not shown in Connections. A decided connection is logged there by the logging switches, with the reason Allowed once by "Ask to Connect", Blocked by "Ask to Connect" (also after the timeout) or Process allowed by "Ask to Connect". Limit of "Ask to Connect" means it could not be paused.

A program entry holds:

• an action: Allow, Block, Ask (see Ask to Connect) or Kill Process;
• optional network filters, Groups, a schedule, logging flags, notes and an icon.

Kill Process stops the program from starting, even while Filter Enabled is off. It normally also terminates running instances.

The columns are:

• Name: struck through if the file is missing.
• Zones, Rule, Groups, Speed Limits, Scheduled: icons showing what is set.
• Action: a yellow triangle marks alerted programs.
• File Path, Creation Time.
• Notes: hidden by default.

You can also drag an .exe onto the window to add it.

The title is Edit Program, or Edit Wildcard for wildcard entries.

Editing rules for the path fields:

• File Path: is editable only when adding an entry.
• Wildcard Paths: stay editable.
• Neither can be edited when several programs are selected.

The quick buttons switch the action now, switch it for N minutes, or remove the entry after N minutes. They save at once.

Available only when the action is Allow or Ask.

The Add Filter / Edit Filter dialog builds one filter line; the Text box shows it, Copy Text copies it.

• Nothing ticked in Direction:, Protocol: or Area: means any.
• The = / ≠ button before a field inverts it: all, except these.
• The button after Local IP: / Local Port: makes the local value equal to the remote one: =Local_Port in the Text. See = in Rule syntax.
• The clear button clears a non-empty field.

The Connections button in the corner of the dialog's tab bar opens and closes the Program Connections window: this program's logged connections, also those inherited from it (see Rules inheritance). A new program's connections are shown by its path.

• The window opens next to the dialog and closes with it.
• On the Network Filters tab, its Add Filter fills the filter dialog from the selected connection. Double-clicking a row does the same.
• The Paused Connections button before the Connections button opens and closes the program's Paused Connections window. It is shown while the program has paused connections or the window is open.
• Edit ▸ Connections in the Programs window opens it for the selected program, too.

TODO: The screenshot may be outdated: it shows the former Connections tab of the dialog.

An alert marks a program that still waits for your decision:

• a new program that Fort added to the list by itself (see Filter modes);
• a program whose connection matched a filter with the Alert option.

Alerted programs have a yellow triangle in the Action column of the Programs window. Filters ▸ Alerts or the alerted counter lists them.

The Alert Program window is the Edit Program dialog for the newest alerted program. A program with paused connections comes first: see Ask to Connect.

• Choose an action and click OK, or use a quick button. The window then moves on to the next alert.
• Programs you skip stay alerted; find them with Review Alerts.

TODO: The screenshot may be outdated.

The commands that remove alert marks differ:

Every new alert shows the "New program detected!" notification, plays the sound and opens the Alert Program window. These settings control it:

Create wildcard entries with Add Wildcard, or with Switch Wildcard in the dialog. Wildcards work only in wildcard entries.

• One pattern per line.
• A line beginning with # is a comment. Comments at the end of a line are not supported.
• Matching is case-insensitive. / and \ both work.

Matching rules:

• *, ? and [...] never cross \. ** crosses folders only as a whole path segment.
• \ is never an escape character.
• Lookup order:
  1. exact paths;
  2. wildcard patterns, where the alphabetically first match wins;
  3. trailing-** prefixes, where the longest wins.

Environment variables in wildcard entries:

• Variables such as %SystemRoot%, and the built-in %FORTHOME% (Fort's folder), are expanded only in wildcard entries.
• With the Windows Service, they resolve as Local System. For example, %USERPROFILE% becomes C:\Windows\System32\config\systemprofile.

Rules inheritance: has three options:

How changes apply:

• Changes apply to processes started afterwards.
• A child that inherits its parent's network settings still keeps its own Kill Process setting.

Many services share one svchost.exe process. Options ▸ Services lists them. It is available when the Windows Service is installed, or when Fort runs as Administrator.

Notes:

• If Windows Update resets a trackable service, Fort makes it trackable again at startup.
• On Windows 10+, many services already run separately, so Make Trackable is rarely needed.

Right-click an .exe and choose Fort Firewall ... to open Edit Program for that file.

• On Windows 11 it is under Show more options.
• The integration is per user.
• It does not work when Disable command line management is on.

A Group is a shared on/off switch for programs, optionally on a Time Period. Open it from the tray: Options ▸ Groups.

Each program joins Groups in Edit Program ▸ General ▸ Groups; a program can be in several.

How Groups work:

• A program whose Groups are all inactive is blocked, provided Block traffic for disabled Groups is on (the default).
• Programs without Groups are unaffected.
• If a program is in several active Groups, their Rules run in ascending Group ID order (the number shown in the Groups window). The first Rule that decides wins.

A Speed Limit caps bandwidth in one direction. Open it from the tray: Options ▸ Speed Limits. Assign limits per program in Edit Program ▸ Network Filters.

How limits behave:

• Programs that use the same Speed Limit share its bandwidth.
• Limits work only while Filter Enabled and Speed Limiter Enabled are on.
• The window's Queue and Dropped columns show the limiter at work.
• A limit with speed 0 can only come from an older configuration. It is ignored, including its latency and packet loss.

A Time Period is a weekly schedule used by Groups, Speed Limits, Rules and the Statistics' active period. Open it from the tray: Options ▸ Time Periods.

• A period is active during any of its intervals.
• A new period starts with one interval, 09:00–18:00 on all days. Add Interval adds another with the same defaults.
• An interval with the same start and end time lasts 24 hours.
• If the start time is later than the end time, the interval runs past midnight. The week days are the days on which the interval starts.
• A disabled period never restricts anything. An enabled period with no intervals is never active.
• Fort checks periods every minute.

A Zone is a named address list. Open it from the tray: Options ▸ Zones.

Custom URL overrides a source's URL: and Form Data:.

Addresses are loaded only when the Zones Downloader runs. It runs:

• when you click Update Zones in the Zones window;
• when you answer Update Zones? after editing a zone;
• on its schedule, if enabled in Options ▸ Schedule.

Until then, a new zone is empty. At startup, Fort uses the last download.

The zone selector has three states:

Open the Rules window from the tray: Options ▸ Rules. It groups rules by type:

TODO: The screenshot may be outdated.

Unnamed values:

• An unnamed value at the start of a line is ip.
• An unnamed value right after ip, area or zones is port.
• Any other unnamed value is an error.

Examples:

# DNS to two resolvers
ip(1.1.1.1, 8.8.8.8):udp(53)

# Outgoing DNS to the Internet
area(inet):udp(53):dir(out)

# Inbound RDP from the LAN (needs "Filter Local Network" on)
area(lan):proto(tcp):local_port(3389):dir(in)

# Always block this address, whatever the rule's action
1.2.3.4:act(block)

# Nested group: outgoing web or DNS
dir(out):{
tcp(80)
udp(53)
}

These windows open from the tray Statistics ▸ menu, or from the chart button in the top-right corner of most windows.

Open it from the tray: Statistics ▸ Traffic (or Middle Click on the tray icon).

The Traffic window shows per-program Download and Upload in Hourly, Daily, Monthly and Total views.

• The All row is the sum of all programs.
• Search / filters the programs. A leading / searches by regular expression.
• Units: sets the units of the values: Adaptive, Bytes, KB … PB.
• The Edit menu has Add Program, Remove Application, Reset Total and Clear All.
• Ctrl + double-click a view's tab to make it the active one when the window opens.

TODO: The screenshot may be outdated.

Open it from the tray: Statistics ▸ Connections.

The Connections window is the connection log. Hover the Reason icon to see which step of How Fort decides decided, and which Rule: or Zone:. It also shows Loopback for a loopback connection, and Inherited from: with the parent program's path for a connection decided by the inherited settings (see Rules inheritance).

Search / filters the connections:

• Space-separated words must all be found, case-insensitively. A leading / searches by regular expression.
• It searches the program's file name and name, the process ID, the protocol, the local and remote IP addresses and ports (also by service names, e.g. https), the direction, the action and the reason with its rule or zone name.
• It does not search the host names and the time.

The right-click menu has:

• Copy as Filter, Copy and Lookup IP;
• Add Program;
• Filter Simulator, which opens the Filter Simulator for this connection;
• Remove, which removes the row and all older rows;
• Clear All.

The Options button has Auto scroll and Show host names.

TODO: The screenshot may be outdated.

The Filter Simulator shows what Fort would decide on a connection, without making it. Open it from the tray: Statistics ▸ Filter Simulator, or from a row's right-click menu in Connections, which fills in that connection and simulates it at once.

Click Simulate to see the Result:

The simulation uses the current options, programs, Rules, active Groups and the last downloaded Zones.

The tray Traffic Graph item toggles a small live graph of download and upload speed. Appearance settings are in Options ▸ Traffic Graph.

TODO: The screenshot may be outdated.

Open the window from the tray: Options ▸ Options. Every default value in this guide is listed here.

The buttons at the bottom:

Style Sheet: is a Qt style sheet file (.qss) applied to all windows at once. A relative path is from the program's folder. The -stylesheet <file> command line argument takes priority over it.

The button next to Auto-Show Alert Window for New Programs picks the filter modes that show the alert notification, sound and window:

TODO: The screenshot is outdated: it lacks Allow Addresses.

How these interact:

• Collect Traffic re-injected by other drivers counts the packets that another driver re-injects, e.g. the inbound packets diverted by WinDivert, which otherwise aren't counted. Turn it on only when such traffic is missing: else the same traffic may be counted twice.
• The Time Period: (Time Periods) limits when traffic is stored and when quotas count. The live graph keeps running outside the period. The former "Active time period" from/to times are converted into a Time Period on the update.
• Quotas count only downloaded traffic that Fort tracks. When a quota is exceeded, Fort shows a Quota Alert.
• If Block Internet traffic when quota exceeds is on, Fort also turns on Internet blocking. You must undo it yourself.
• Turning off Collect Traffic Statistics stops the history but not the quota checks. To stop those, set the quota to Disabled.

The tab also sets Colors (Light | Dark), incl. the Total: color of the download and upload sum.

Each color has an Alpha channel in its color dialog. For a transparent graph window, set the Background: color's alpha: 0 makes the background fully transparent, a value up to 255 makes it semi-transparent. The bars, lines and labels stay as they are. Opacity: applies to the whole window, the graph included. The Light and Dark themes have separate colors: set the alpha of both if you switch themes.

To configure a task:

• Tick a task to enable it, and choose its interval: from Each 5 minutes to Monthly, or Custom in minutes. The list shows it as e.g. 1d 6h 30m.
• The Options button sets Run On Startup and retries.
• Run runs the selected task now; Abort stops it.

Set it in Options ▸ Options ▸ Password:.

It protects:

• the Programs, Options, Rules, Zones, Groups, Speed Limits, Time Periods, Services, Traffic, Connections and Filter Simulator windows;
• the alert window;
• command-line commands, except home show, graph and conf update-driver.

Unlock till: has these choices:

To force a new password prompt, close the protected windows and click Lock in My Fort. With a choice other than Window closed, Options ▸ Options also shows a Lock the password (unlocked till "…") button below Password:.

• Allow only programs you recognize, and check the path first.
• Remember that LAN traffic is unfiltered by default.
• Remember that Ignore mode hands unknown programs to other firewalls.
• Treat Fort as one layer of defense, alongside updates, backups and endpoint protection.

FortFirewall.exe -c <command> [<arguments>] controls the running Fort instance. -o <file> writes the command's output to a file instead of the console.

When a password is set, the commands except home show, graph and conf update-driver ask for it. Only Fort's tray process can show the password prompt: with the service alone, they fail with "Password required".

The windows' commands (home, window, graph) need the tray process too: the service alone fails them with "The service has no windows: run the tray process".

<intervals> of a Time Period: the days, 1 (Monday) to 7, as single days or ranges separated by commas, each list followed by its /<hh:mm>-<hh:mm> time, e.g. 1-5/09:00-18:00,6,7/10:00-12:00. The last list may have no time: whole days, e.g. 6,7.

A relative <file> is resolved against the command's current folder. Give backup a full <folder> path.

<key>=<value> sets a field. A Boolean is 0 or 1 (false, true), a list of Zones or Groups is their numbers separated by commas (empty clears it). Quote an argument with spaces, e.g. "notes=My notes". An unknown key or invalid value is an error, and nothing is changed.

The get and list commands print an object per line, as <key>=<value> pairs separated by spaces, in alphabetical order. A Boolean is 0 or 1; a text with spaces or quotes is quoted, its quotes doubled.

• simulate: app (the program's number, 0 if not in the list), reason, result (allowed, blocked, ask or ignored), rule and zone (their numbers, 0 if none), terminated (decided by a Terminating Rule).
• conn list and pending list: alerted, blocked, dir (out or in), dropped, id, inherited, local and remote (<ip>:<port>), loopback, path, pid, proto (the protocol's number), reason, rule, terminated, time (Unix time), zone.

Each task ends with a check.

1. In Programs, select the program and click Allow or Block.
2. Check: retry the program. A block appears in Statistics ▸ Connections with Program's action.

1. In Programs, use Filters ▸ Alerts, or Edit ▸ Review Alerts.
2. Allow or block each program; this clears its mark.

1. In Programs, use Edit ▸ Timer ▸ 1 hour.
2. Check: the Scheduled column shows an icon.

1. In Programs, use Edit ▸ Add Wildcard and enter C:\Games\**.
2. Choose the action and click OK.

1. Add the address to Options ▸ IP Addresses ▸ Block Addresses and click Apply or OK.
2. Check: connect to the address again; the reason shown is Blocked Internet address.

1. In Programs, select the program and click Ask.
2. Check: start a connection of the program; the Alert Program window opens. Decide in its Paused Connections window, or choose an action and click OK. See Ask to Connect.

1. In Speed Limits, choose Edit ▸ Add.
2. Enter a Name:, select Download, set Speed:, leave Enabled ticked, and click OK.
3. In the program's Network Filters tab, tick Download:, choose the limit, and click OK.
4. Check: watch the Traffic Graph.

1. In Time Periods, choose Edit ▸ Add and enter a Name:. A new period already has one interval, 09:00–18:00 on all days.
   • Edit that interval; don't add a second one.
   • Set both times to 00:00, which means a whole day.
   • Select only Saturday and Sunday, then click OK.
2. In Groups, choose Edit ▸ Add and enter a Name:. Tick Exclusive and Time Period:, choose the period, and click OK.
3. In each game's General ▸ Groups, tick the Group and click OK.
   • Make sure the game is in no other Exclusive Group that is active outside the weekend; any active Exclusive Group enables it.
4. Keep Block traffic for disabled Groups on.
5. Check: a game connects during the period and is blocked (reason App. Group) outside it.

1. Reproduce the problem.
2. Open Statistics ▸ Connections and hover over Reason.
3. Fix only the setting from that step of How Fort decides.
   • Exception: Old connection is not caused by a setting; see Troubleshooting.
4. Check: right-click the row and choose Filter Simulator. It shows the new decision without a retry.
   • A connection that isn't logged, e.g. LAN traffic, can be described there by hand.

Click a problem to expand it.

If the problem persists, attach a zip with Fort's logs and the driver's state to the issue.

1. Reproduce the problem.
2. Right-click the Start button ▸ Terminal (Admin), Windows PowerShell (Admin) or Command Prompt (Admin). Use the Windows account you run Fort with.
3. In Terminal or PowerShell, type cmd and press Enter first. Then paste and run these commands:

cd /d %TEMP%
rmdir /s /q FortReport 2>nul
mkdir FortReport
cd FortReport
xcopy /e /i /q "%ProgramData%\Fort Firewall\logs" ServiceLogs
xcopy /e /i /q "%LOCALAPPDATA%\Fort Firewall\logs" UserLogs
wevtutil qe System "/q:*[System[Provider[@Name='fortfw']]]" /f:xml /rd:true /c:100 > fortfw-events.xml
netsh wfp show state file=wfpstate.xml
(ver & sc query fortfw & sc qc fortfw & sc query FortFirewallSvc) > system.txt
cd ..
tar -a -c -f "%USERPROFILE%\Desktop\FortReport.zip" -C FortReport .

4. Attach FortReport.zip from your Desktop to the issue.

The zip contains: