Firewalls come in two flavours; software based and hardware based. Software based firewalls (which is what we will cover in this article) reside on your machine, running in the background to keep a watch on things. To avoid potential conflicts, only install one software firewall. In order to achieve the best combination of protection, we would strongly suggest to use a hardware firewall (such as a router) in conjunction with a software firewall. Modern routers usually have a built-in firewall, helping to filter out content before it reaches your machine; consult your router documentation for more details. In situations where a hardware firewall is not available (eg. a public network), having a software firewall is even more crucial.

Basic firewall protection is critical for securing your PC. At a basic level, firewalls limit access to your system and personal information, and silently protect you from inbound threats. We review basic third-party firewalls as well as the built in Windows firewall, and look at features such as monitoring programs that request outgoing Internet connections (we call this "outbound protection").

Basic firewalls generally only have limited protection; proactive firewalls offer more extended protection, including HIPS or program monitoring (HIPS Explained), and watch for malicious behavior before malware gets a chance to take control of your PC or turn it into a botnet drone. They seek to achieve stronger "2-way" protection, preventing programs from broadcasting your personal information to the Internet. The downside of such firewalls are that it may be harder to use and/or require more memory consumption. Also, there is a greater risk of HIPS software causing conflicts, errors, or otherwise cause other issues with your PC.

Some kinds of malware are best detected by their behavior, so a proactive firewall (or firewall/HIPS combo) is a solid second layer of protection next to your antivirus program. Many of the top antivirus programs also provide behavioral blocking and extended scanning of network activity. Therefore, to best minimize the risk of malware on your PC, it is important to use a basic or proactive firewall protection, as well as antivirus software.

You can "upgrade" (for free!) your security by reading the documentation and learning about proactive firewalls or HIPS programs, or using other protection like least-privileged user accounts and/or Sandboxie or GeSWall. This information, and more, is available on various parts of our website; check the end of this article for related document links.

• Online Armor Free's HIPS feature is mostly in its "Program Guard". It has a feature called "run safer" that allows you to selectively set risky applications (web browsers, office software, readers/viewers, instant messengers, email or news programs, multimedia software, download managers, etc.) to run as if under a limited user account (go to "Programs" tab > uncheck "Hide Trusted" > highlight a program and click "Run Safer"). It minimizes popup alerts over time with its automatic list of safe programs, your on-demand scans with its safety check wizard, and your responses to popup alerts -- especially in cases where you tell it to remember your decisions and have it treat programs as trustworthy.

  Run the wizard and have it search your PC for known programs to allow/block/ask. In this case, Online Armor relies on you to respond to alerts for unknown programs. For the curious or paranoid user, it uses excellent popup messages when it automatically allows a program to connect online and, optionally, when it automatically trusts a program/process to run (these alerts don't require user action and they can be enabled/disabled in the interface with "Options" > "Firewall", and "Programs" > "Options"). For example, I noticed a message when it auto trusted a key logger test, but after I set the tester to untrusted, it gave very informative and detailed security alerts (and then it passed the test and logged the tester in the interface under the "Key Logger" tab, but it only logged the key logger after the test was untrusted). You can even close both its tray tools from its right-click context menu. They are not needed for the firewall and HIPS components to continue running and protecting.

• AVS Firewall differs from other regular ones in that it comes with additional protection modules; namely a registry defender, a banner blocker, and parental control options – it is something like a suite. The firewall itself does not have as many configurable options as some of the firewalls listed on this page, but the standard selections are still there – off, which turns off the firewall; custom, which allows you to set your own connection rules; and high, which blocks all connections.

  Each section of the program is displayed clearly; navigation is through the menu on the left. Alerts are generally clear and straightforward, as is configuration.

  The registry defender protects the registry from being modified, with the option of only protecting select categories. The parental control limits the list of websites that can be accessed, but you must manually add each website to be trusted, ie. You cannot block specific websites; you can only allow certain websites. The anti-banner component blocks undesirable web page content including ads, flash banners, pop-ups and the like. All three of these additional modules can be disabled independently as desired. AVS Firewall also comes with a monitoring utility so you can check the size of network traffic which is sent and received by each application.

  During installation of this firewall, the installer automatically installs the AVS Software Browser; there is no option to opt-out of installing this, but the program can be removed separately after installation with no effect on the actual firewall program. The installer also has a pre-checked option to install AVS Registry Cleaner, and it is recommended that it is unchecked so the installer does not install it. Therefore, while the software has some additional features not found in your everyday firewall program, most of those features can be found in other third party programs.

• Outpost Firewall Free by Agnitum software technology is a good choice for users who want highly flexible protection without sacrificing usability. It appears to be built with average users in mind, judging by the care taken to simplify alert messages and make it easy to adjust intrusion prevention (or HIPS) monitoring. For example, it remembers your responses to popup alerts without the need to set "trusted" rules (like in Comodo/Online Armor), and like Online Armor it notifies you when it automatically allows an application to access the Internet (especially helpful during the learning phase).

  The free version lacks many extras of the pay version, however, such as automatic updates and the ability to break active connections. The HIPS component is called "Host Protection" in the interface. It provides four default levels of protection, which can be easily set with a slider and additionally customized item by item by advanced users. The default "optimal" setting only monitors the "most dangerous activities" (such as memory injections, driver loads, and a healthy list of system critical features -- auto starts, shell extensions, and internet settings) instead of all program activities. But these "optimal" settings lack protection from keyloggers, direct disk accessing, DNS API request monitoring, etc. You can check the types of reduced monitoring in "Settings..." > "Host Protection" > "Customize...".

  Agnitum has now been acquired by Yandex. As a result, Agnitum has discontinued support and sales of the Outpost product line.

• A former commercial product, Privatefirewall is now unrestricted freeware. It is a proactive multi-layer security solution, offering behaviour blocking technology alongside standard firewall protection. Using Behavioral-based Monitoring, it features zero-hour virus, spyware, and malware protection, process and application security, and registry protection, just to name a few. It is definitely a feature-packed firewall/HIPS solution.

  While there is a decent help file available, the user interface can be a bit confusing and overwhelming. There are many configurable settings, and sorting through them may require some time. To help out with that there is a information menu on the right of each screen which explains what each section is for. Training mode allows all actions within a 180-second interval, which is ideal for installing or running programs for the first time. On the first run after installing however, Privatefirewall still managed to disable Panda Cloud Antivirus, the antivirus software on my test system, even with Training mode activated. Adding Panda Cloud Antivirus to the allow list seemed to solve this issue.

  It is also possible to set different security levels for the Internet and the Network. Various levels of protection (High, Low, and Custom) can be separately specified for Internet Access and Network Security (ie. file and printer sharing). This is useful for, say, when one needs to access the internet via a network they don't quite trust. In addition, there are three profiles you can choose: Home, Office, and Remote. You can set appropriate settings for each one and easily switch between them as needed; this is particularly useful for portable computers which connect to many different networks. Another useful feature is that it is possible to block all outbound email; simply click the 'Block Outbound Email' icon in the main user screen and all outbound email should be blocked.

  Overall, Privatefirewall is a very effective firewall; it ranks among the top products on Matousec. However, the graphic interface and usability is perhaps more suitable and tailored for the more advanced users. Beginner computer users may want to consider another firewall instead, but if you are comfortable with the basics of Windows & firewall software, you should definitely consider Privatefirewall.

Other Unsupported Firewalls for Windows 95-Vista

• Sygate Personal Firewall (Windows 2000/XP/2003)
• NetVeda Safety.Net (Windows 95/98/Me/NT/2000/XP, requires registration)
• Ashampoo FireWall Free (Windows 2000 SP4, XP SP2)
• Filseclab Personal Firewall (Windows 95/98/Me/NT/2000/2003/XP, 32-bit)