Simplewall: how does simplewall compare with comodo firewall?

[shiftyshady]

I have been using Comodo Firewall (only firewall, hips or other things disabled) for years, afaik without leaks.
A recent update has been failing to start on system boot, so I am reconsidering my firewall choice.

I like that simplewall is opensource, but it relies on WFP.
I think Microsoft is the major privacy threat for Windows users (all pc's come infected from factory), so how could one trust WFP?
Comodo on the other hand installs a driver, so it messes with the Windows kernel and in theory could be more effective at fighting Microsoft spying. But I have also read that Comodo uses WFP, so I am confused.

Are all firewalls on Windows limited to have to rely on WFP? Can Comodo firewall (assuming only firewall is enabled) provide deeper security than simplewall?

[beerisgood]

If you don't trust Microsoft then why use Windows?
Also why don't trust then a 3th party instead of Windows internal solution? Doesn't you think that Microsoft know their own system better then any other?

You got a much better privacy and security with Windows own solution and even better with this one here.

If you care about telemetry, you should it block on network side and not on client side

[tokariu]

I've been using comodo firewall for many years before I got rid of it in favor of simplewall one or two years ago.

I was very happy with the comodo firewall, it has still a lot more functionality than simplewall and due to it's kernel level it's working for all users on the system and it can be activated for specific network devices only.

However, there are several reasons which makes the use of comodo firewall unbearable:

• The Software is bloated to the max. Installing the Software is a mess. You get the firewall bundled with other nonsense bloatware and it's very tricky to not install unwanted software. If it happens that you install this stuff you might end up with security flaws because comodo installs their own certificates to capture and analyze ssl traffic. Then, someday they got rid of the offline installer making it mandatory to use their web installer, which, before you install the comodo firewall, analyzes your PC and then already sends some of that information home to comodo. It also downloads all unwanted software first, even if you don't want it to be installed. That's just about the install process...

• Even if you manage to only install the Firewall, it has still a lot of functionality that has nothing to do with a firewall but rather an anti-virus software. you have to uncheck so many things in the settings you don't want if you only want a firewall functionality. if you don't block internet access for comodo firewall itself, it still sends some kind of anti-virus file analyzes home to comodo.

• The quality of the software, especially the installer is a complete mess. After every update, the comodo forums are full of threads with people whose OS was broken after the process. One Day, after an update, I suddenly got the Error "Comodo Security Agent could not be started" and the firewall stopped working. I tried everything to fix it but the only solution was to restore a complete system backup. So installing new comodo versions on my OS did not work because their software then just stops working. There are so many documented cases in their forums, just look here for an example: https://forums.comodo.com/firewall-help-cis/firewall-stops-working-after-uninstalling-av-and-cant-get-fixed-anymore-help-t121314.0.html
  Therefor, Comodo don't even let me a chance to use their software any further, but after all these recurring problems I was already about to head over to alternatives.

• It's closed source, you never know exactly what the software does. does it have backdoors for the country the business sits in? I don't want another blackbox installed on the system. Comodo as a business aims to make money out of the "free" software and it tends to install even more unwanted and bloated software to fit their needs. And it is already so much bloated.

So when I look back, I don't regret that I got rid of the comodo software. I still miss some functionality in Simplewall and some of the known issues and bugs are still hurting, but the bottom line is it is nevertheless a lot less trouble than comodo software and the functionality is sufficient for me even when a few things are missing.

@beerisgood "If you care about telemetry, you should it block on network side and not on client side"
this doesn't work on laptops when you move between different locations and networks. not everyone is using a stationary PC. Therefor we are in need of solutions that works on client side.

[setsunati]

You can always switch to Linux Mint Cinnamon and use GUFW firewall since Windows 10 can't be trusted. If you are missing some windows software's, you can always run them in VirtualBox or Gnome Boxes. For windows games, you can use Lutris or enable Steam Play Proton from Steam settings.

[shiftyshady]

I have been running both firewalls now for some time, so now I can add some information to this issue. Unfortunately my findings are still not very useful. I am not using yet a traffic sniffing solution (wireshark or pfsense) to see what's leaking. And I have not yet learnt the small details of simplewall.

Both firewalls seem to be able to work in tandem, with simplewall pop-up preceding comodo's. When I only get a comodo pop-up, I temporarily allow the connection in order to see if simplewall will detect it, but that's never the case. So there have been a few connections that comodo prevented but simplewall did not Here are a couple of examples:

In this case, I do not know how simplewall identifies the process identified by comodo as "Windows Operating System", so I don't know if this is a simplewall leak or a predefined system rule allowing that connection. I have enabled all rules in Rules/Blocklist (extra, spy and update), and my system rules are:

Here is a surprising one, because I had denied MS Word on simplewall, but, it could be that for some reason this time comodo's filter preceded simplewall (and simplewall blocked the connection anyway based on preexisting simplewall blockall rule)

I am sorry I am not goign to comment on why not linux (there are many reasons one could be stuck with windows) or how good or bad comodo is.