Download Safing Portmaster for Windows PC v2.2.3 for Windows PC

Safing Portmaster 2.2.3 is a free, open-source application firewall for Windows that shows every connection your apps make, blocks trackers and malware...

Features

• The live connection monitor shows every program's network activity — destinations, domains and block decisions — in a clear interface instead of raw firewall logs.
• Curated filter lists block trackers, malware domains and data brokers by default, cutting unwanted traffic from the moment you install it.
• DNS queries are encrypted by default and can be configured per application, protecting a leak that most VPN and firewall setups leave exposed.
• Per-app rules are one click away: block an application entirely, block a single domain, or allow a connection once, without writing firewall syntax.
• The core application is free and open source from Safing ICS Technologies GmbH, so its traffic inspection can be audited rather than taken on trust.

Considerations

• Because it intercepts all network traffic, Portmaster can conflict with some VPN clients or other firewalls until compatibility settings are adjusted.
• Useful extras sit behind paid tiers: full connection history needs Portmaster Plus, and the SPN multi-hop privacy network is a separate paid add-on.
• It is a firewall and monitor, not an antivirus, so it cannot scan or clean malicious files that are already on the PC.

Safing Portmaster, from Safing ICS Technologies GmbH (now part of IVPN), answers a question Windows itself makes strangely hard: what is this program actually connecting to, right now? Where the built-in Windows Firewall thinks in rules most users never see, Portmaster's live connection monitor lays every app's connections out in plain sight — destination, domain, country, whether the connection was allowed or blocked, and why. Curated filter lists block trackers, malware domains and data brokers by default, quietly cutting a surprising amount of tracker and telemetry traffic with no configuration at all, and DNS queries are routed over encrypted DNS by default, protecting a leak most VPN and firewall setups leave exposed; DNS can be configured per application. Note the identity: this is Safing's network-security Portmaster, not portmaster.app, an unrelated tool for porting games to handheld consoles.

Making a rule is as simple as the interface promises: block this app entirely, block just this domain, or allow a connection once — no firewall syntax. The core application is free and open source: the live connection monitor, per-app rules, tracker blocking and encrypted DNS cost nothing, and because the code is open, its traffic inspection can be audited rather than taken on trust. For anyone who has ever opened the Windows Firewall's rule list and closed it again in despair, that combination — visibility first, one-click control — is the whole appeal. Version 2.2.3 is the current Windows release, and with Safing now part of IVPN and the core remaining open source, it is the most approachable serious firewall Windows has.

Useful extras sit behind paid tiers: full historical connection view and extra filter lists need Portmaster Plus, and the SPN (Safing Privacy Network) add-on, which routes traffic through a multi-hop privacy network, is a separate paid extra — the free tier deliberately holds back some depth. Because Portmaster installs a network service and inspects all traffic, it can occasionally clash with a VPN client or another firewall until you set the right compatibility options. And scope matters: Portmaster is a monitor and gatekeeper, not an antivirus — it will stop a malicious program phoning home but will not clean an infected file — and it does not encrypt your whole connection like a VPN; it is designed to work alongside both. It runs on Windows 10 or 11 (64-bit), with 2 GB or more of RAM recommended and about 300 MB of space.

Get Portmaster_2.2.3_x64-setup.exe (version 2.2.3, about 89 MB) from the download page at safing.io, which serves the file from Safing's official update servers. Check the name as you download: this is Safing Portmaster, the firewall, not the game-porting tool.

Run the setup file, approve the Windows prompt and let the installer set up Portmaster's background network service. A restart may be requested so the traffic inspection can start cleanly; afterwards Portmaster opens to its dashboard.

Open the Network Activity view and watch which apps connect where — the default filter lists already block known trackers. Click any app to allow or block it, or block a single domain, and Portmaster will remember and enforce the rule from then on.

Can I use Portmaster on Windows?

Yes. Safing Portmaster is a Windows application firewall and connection monitor, and version 2.2.3 is the current Windows release served from Safing's official update servers. Note the identity: this is Safing's network-security tool, not portmaster.app, an unrelated project for porting games to handheld consoles.

Is PortMaster a firewall?

Yes — an application-level firewall with a live connection monitor, rather than a rule list you never see. It shows every connection every program makes, blocks trackers, malware and data brokers using curated filter lists, and lets you allow or block a program, a domain or a whole category with a click.

Is port master free?

The core application is free and open source: the live connection monitor, per-app rules, tracker blocking and encrypted DNS cost nothing. Paid tiers add depth — Portmaster Plus unlocks the full historical connection view and extra filter lists, and the SPN (Safing Privacy Network) multi-hop routing add-on is paid separately.

Is Portmaster an antivirus?

No. Portmaster controls and monitors which programs may connect and where their traffic goes; it does not scan files like an antivirus, and it does not encrypt your whole connection like a VPN. It is designed to work alongside both — it will stop a malicious program phoning home, but it will not clean an infected file.

What is PortMaster and what is its purpose?

Portmaster answers a question Windows makes hard: what is this program actually connecting to, right now? It lays every app's connections out — destination, domain, country, whether it was allowed or blocked and why — routes DNS queries over encrypted DNS by default, and makes rules as simple as blocking an app entirely, blocking one domain, or allowing a connection once.