Firewall privacy ratings

Firewalls that control which apps connect to the internet.

15 firewalls are rated against 4 public criteria, and 15 have enough evidence for a letter grade. Of the 7 with a known jurisdiction, 3 are based in a Five Eyes country, and 5 in the wider Fourteen Eyes.

Open-source firewalls only · Criteria for this category · Suggest an addition · Markdown

Firewalls privacy ratings, sorted by pick and then by grade
Name	Grade	Score	Data	Jurisdiction	Open source	No trackers or telemetry	No ads or data sales	Independent audit
Lockdown Open-source firewall app for iPhone, iPad and Mac that blocks connections to tracking, ad and malware domains on the device, with custom block lists.	Grade B	80	100%	–	Yes	Yes	Yes	No
LuLu Free, open-source firewall for macOS that blocks unknown outgoing connections and asks the user to allow or deny each new one.	Grade B	80	100%	United States Five Eyes	Yes	Yes	Yes	No
OpenSnitch Application firewall for Linux that shows outgoing connections from each program and lets users allow or deny them with per-app rules.	Grade B	80	100%	–	Yes	Yes	Yes	No
Portmaster Application firewall for Windows and Linux that monitors and blocks network connections per app, with DNS filtering, tracker blocklists and an optional paid multi-hop network (SPN).	Grade B	80	100%	Austria Outside Eyes	Yes	Yes	Yes	No
Shorewall Configuration tool for the Linux Netfilter firewall that generates iptables rules from high-level zone and policy files. Development has ended and it is no longer maintained.	Grade B	80	100%	–	Yes	Yes	Yes	No
simplewall Windows tool that configures the Windows Filtering Platform (WFP) to allow or block network access per application, with a rules editor and built-in blocklists.	Grade B	80	100%	–	Yes	Yes	Yes	No
TinyWall Lightweight firewall for Windows that builds on Windows Filtering Platform, blocking all traffic by default and allowing apps through a whitelist without popups.	Grade B	80	100%	–	Yes	Yes	Yes	No
Uncomplicated Firewall Command-line front end for managing Netfilter firewall rules on Linux, the default firewall tool on Ubuntu, with simple commands for allowing and denying traffic.	Grade B	80	100%	–	Yes	Yes	Yes	No
OPNSense Open-source firewall and routing platform based on FreeBSD, with a web interface, VPN, intrusion detection and plugin support.	Grade C	70	100%	Netherlands Nine Eyes	Yes	No	Yes	Yes
BunkerWeb Open-source web application firewall (WAF) built on NGINX that sits in front of web services as a reverse proxy and blocks common attacks, with secure defaults.	Grade D	50	100%	France Nine Eyes	Yes	No	Yes	No
Gufw Graphical interface for ufw (Uncomplicated Firewall) on Linux, for managing firewall rules, profiles and per-application allow or deny rules.	Grade D	50	100%	–	Yes	No	Yes	No
Radio Silence Paid network monitor and outbound firewall for macOS that lists every app's connections and blocks chosen apps from reaching the internet.	Grade D	50	100%	–	No	Yes	Yes	No
Little Snitch Application firewall for macOS that alerts on outgoing connections and lets users allow or deny network access per app and per server, with a map of connections.	Grade F	35	100%	Austria Outside Eyes	No	Partial	Yes	No
GlassWire Network monitor and firewall for Windows and Android that shows which apps use the network, alerts on new connections and can block apps from going online.	Grade F	20	100%	United States Five Eyes	No	No	Yes	No
Windows Firewall Control Freeware front end for the built-in Windows Firewall that adds filtering profiles, notifications for blocked outbound connections and easier rule management.	Grade F	20	100%	United States Five Eyes	No	No	Yes	No

Questions

What is the most private option among firewalls?

No pick has been made yet. The table above is sorted by score, based on public evidence.

How are firewalls rated?

Each entry answers 4 questions: open source, no trackers or telemetry, no ads or data sales and independent audit. Answers need links to evidence. See the full criteria.

Does jurisdiction matter?

Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.