An open-source effort to bring the engine behind the Android firewall Rethink DNS + Firewall to Windows: encrypted DNS, per-app firewall rules, connection logs and WireGuard, in a free app for everyone.
Early test software. Installing it needs administrator rights once; after that, any Windows user turns protection on without an admin prompt (through AuroraVPN Service, as with Proton VPN). The portable exe asks for admin rights each time. It changes network settings while it runs. Do not rely on it for privacy or security yet.
This is an unofficial community project. It is not affiliated with or endorsed by Celzero (Rethink), Cloudflare, WireGuard LLC or Microsoft.
The networking engine, firestack, now builds and runs on Windows
(x64 and ARM64). A command-line test tool, fswin, drives it:
-full): all IPv4 traffic goes through firestack, which logs
every connection.chrome.exe, discord.exe, ...).-block chrome.exe).-nrpt): a Windows DNS policy sends every lookup to the tunnel.-dnssec, -dns-cache): bogus answers are blocked,
repeat lookups come from the cache.-warp), WARP over
MASQUE (-masque, looks like HTTPS), the WARP chain WARP -> your WireGuard
server -> WARP (-chain my.conf), any WireGuard server (-wg my.conf), or a
SOCKS5/HTTP proxy (-proxy socks5://...). MASQUE and the chain use
usque.-rules): per app block, isolate, bypass or exclude; IP and
domain rules; the universal rules (block UDP, ICMP, port 80, unknown or new apps,
DNS bypass, PC locked, lockdown); allowed DNS record types; pause.-dial-strategy): split TCP or the TLS ClientHello.-routes): send chosen apps through their own WireGuard config
or proxy, the rest through the main VPN.-killswitch): Windows Filtering Platform rules block everything
outside the tunnel, and keep blocking if the engine crashes.ui/): an Electron app styled after the Android home screen, with
a tray icon. Download the installer or the portable exe from the
latest release;
every change merged into main is published there as a new version.Not yet: a background service, IPv6, country and network-provider stats. See the roadmap.
Open the latest successful Windows build and download fswin-windows-amd64 (or -arm64 for ARM PCs) under Artifacts. You need to be signed in to GitHub to download artifacts.
Unzip it. It contains fswin.exe and wintun.dll (the official
Wintun driver from the WireGuard project).
Disconnect any other VPN (Proton VPN, NordVPN, ...). They fight over the same network settings.
Open Terminal (Admin) in that folder and run:
.\fswin.exe -full -nrpt
or, to also hide your IP address behind free Cloudflare WARP:
.\fswin.exe -warp -nrpt
Browse. You will see lines like:
dns example.com (type 1) -> 93.184.215.14 via Preferred 21ms ...
flow #12 tcp msedge.exe 10.111.222.1:51234 -> 93.184.215.14:443 [example.com]
Press Ctrl+C to stop. Everything is undone: the network adapter, its routes and the DNS rule are removed.
If fswin was closed some other way (window closed, crash) and websites stop
loading, run .\fswin.exe -cleanup from an admin terminal to restore DNS.
Windows SmartScreen or antivirus may warn about fswin.exe because it is not
code-signed yet.
Please tell us how it went with a test report.
| Flag | Meaning |
|---|---|
-full | Send all IPv4 traffic through the tunnel (default: DNS only) |
-nrpt | Send every DNS query to the tunnel, whatever other adapters say |
-block a.exe,b.exe | Block these programs (exe names or full paths); needs -full |
-warp | Use free Cloudflare WARP as the VPN. The first run registers a free account and saves it in fswin-warp.json next to fswin.exe (keep that file private) |
-wg my.conf | Use a WireGuard server; my.conf is a normal WireGuard config file |
-proxy socks5://user:pass@host:port | Use a SOCKS5 (or http://) proxy |
-doh URL -doh-ips IPs | Use another DNS-over-HTTPS server |
-dnssec | Block DNS answers that point a public name at a private, loopback or test address (a sign of DNS poisoning); answers with DNSSEC proof are marked in the logs |
-dns-cache | DNS booster: answer repeat lookups from the cache |
-dns odoh -odoh URL [-odoh-relay URL] | Oblivious DoH: a relay hides your IP from the DNS server |
-dns proxy -dns-proxy ip:port | Plain DNS to a server or a local forwarder (like Tor's DNSPort) |
-dnscrypt-relays sdns://... | Anonymized DNSCrypt through relays |
-blocklists DIR -blocklist-stamp 1-... | On-device RethinkDNS blocklists (the app downloads them, ~60 MB) |
-masque | Use free Cloudflare WARP over MASQUE (needs usque.exe next to fswin.exe) |
-chain my.conf | WARP -> the WireGuard server in my.conf -> WARP (needs usque.exe) |
-killswitch | Block all traffic outside the tunnel, even if fswin crashes |
-pcap file.pcap | Packet capture of the tunnel, for Wireshark |
-routes routes.json | Split tunnel: extra WireGuard configs or SOCKS5/HTTP proxies that chosen apps use instead of the main exit |
-rules rules.json | Firewall rules as the app writes them: a mode per app (block, isolate, bypass, exclude), IP and domain rules, universal rules, allowed DNS record types, pause |
-dial-strategy never|auto|split-tcp|split-tls | Anti-censorship: split the first TCP segment or the TLS ClientHello to get past DPI filters (default never, as on Android) |
-dial-retry never|split|plain | What to do when a connection fails |
-dial-timeout 300 | Close idle TCP and UDP sockets after this many seconds |
-tcp-keepalive | Shorter TCP keep alive |
-eim | Endpoint-independent mapping and filtering for UDP (games, calls) |
-cleanup | Remove a DNS rule or kill switch left behind by a crashed fswin, then exit |
-log 0..8 | firestack log detail: 0 very verbose, 3 default, 8 none |
-version | Print the build and exit |
| Phase | What | Status |
|---|---|---|
| 1 | firestack builds on Windows; Wintun network adapter; fswin test tool | done |
| 2 | Firewall core: program lookup, blocking, DNS leak fix, kill switch, rules engine and SQLite storage | in progress |
| 3 | WireGuard and WARP (MASQUE) inside the service | planned |
| 4 | App window and tray icon, installer, code signing, auto-update | planned |
The design and the details of every phase are in PORT.md.
| Path | What |
|---|---|
intra/, tunnel/ | firestack, the engine (from celzero/firestack via paulvers-ui/firestack). Linux-only parts sit in _linux.go files with _windows.go counterparts. |
intra/netstack/wintun_windows.go | Connects firestack's network stack to a Wintun adapter |
win/ | Windows-only pieces: ifbind (keep firestack's own traffic out of the tunnel), owner (which program owns a connection), dnspolicy (DNS leak fix) |
cmd/fswin | The test tool |
third_party/gotrie | A patched copy of a firestack dependency, with Windows support |
Builds run on GitHub Actions: every push builds Windows x64 and ARM64 and checks that the Android build still works.
Testing on your PC is the most useful thing right now: different Windows versions, Wi-Fi and Ethernet, other VPNs and antivirus. Code, docs and ideas are welcome too. See CONTRIBUTING.md.
third_party/gotrie: MPL-2.0.wintun.dll (in the downloads, not in this repository): WireGuard LLC's
prebuilt-binaries license, shipped next to wintun-LICENSE.txt.Celzero for firestack and Rethink, paulvers-ui for the AuroraVPN fork this starts from, the WireGuard project for Wintun and wireguard-go, and Google's gVisor for the network stack.
An open-source effort to bring the engine behind the Android firewall Rethink DNS + Firewall to Windows: encrypted DNS, per-app firewall rules, connection logs and WireGuard, in a free app for everyone.
Early test software. Installing it needs administrator rights once; after that, any Windows user turns protection on without an admin prompt (through AuroraVPN Service, as with Proton VPN). The portable exe asks for admin rights each time. It changes network settings while it runs. Do not rely on it for privacy or security yet.
This is an unofficial community project. It is not affiliated with or endorsed by Celzero (Rethink), Cloudflare, WireGuard LLC or Microsoft.
The networking engine, firestack, now builds and runs on Windows
(x64 and ARM64). A command-line test tool, fswin, drives it:
-full): all IPv4 traffic goes through firestack, which logs
every connection.chrome.exe, discord.exe, ...).-block chrome.exe).-nrpt): a Windows DNS policy sends every lookup to the tunnel.-dnssec, -dns-cache): bogus answers are blocked,
repeat lookups come from the cache.-warp), WARP over
MASQUE (-masque, looks like HTTPS), the WARP chain WARP -> your WireGuard
server -> WARP (-chain my.conf), any WireGuard server (-wg my.conf), or a
SOCKS5/HTTP proxy (-proxy socks5://...). MASQUE and the chain use
usque.-rules): per app block, isolate, bypass or exclude; IP and
domain rules; the universal rules (block UDP, ICMP, port 80, unknown or new apps,
DNS bypass, PC locked, lockdown); allowed DNS record types; pause.-dial-strategy): split TCP or the TLS ClientHello.-routes): send chosen apps through their own WireGuard config
or proxy, the rest through the main VPN.-killswitch): Windows Filtering Platform rules block everything
outside the tunnel, and keep blocking if the engine crashes.ui/): an Electron app styled after the Android home screen, with
a tray icon. Download the installer or the portable exe from the
latest release;
every change merged into main is published there as a new version.Not yet: a background service, IPv6, country and network-provider stats. See the roadmap.
Open the latest successful Windows build and download fswin-windows-amd64 (or -arm64 for ARM PCs) under Artifacts. You need to be signed in to GitHub to download artifacts.
Unzip it. It contains fswin.exe and wintun.dll (the official
Wintun driver from the WireGuard project).
Disconnect any other VPN (Proton VPN, NordVPN, ...). They fight over the same network settings.
Open Terminal (Admin) in that folder and run:
.\fswin.exe -full -nrpt
or, to also hide your IP address behind free Cloudflare WARP:
.\fswin.exe -warp -nrpt
Browse. You will see lines like:
dns example.com (type 1) -> 93.184.215.14 via Preferred 21ms ...
flow #12 tcp msedge.exe 10.111.222.1:51234 -> 93.184.215.14:443 [example.com]
Press Ctrl+C to stop. Everything is undone: the network adapter, its routes and the DNS rule are removed.
If fswin was closed some other way (window closed, crash) and websites stop
loading, run .\fswin.exe -cleanup from an admin terminal to restore DNS.
Windows SmartScreen or antivirus may warn about fswin.exe because it is not
code-signed yet.
Please tell us how it went with a test report.
| Flag | Meaning |
|---|---|
-full | Send all IPv4 traffic through the tunnel (default: DNS only) |
-nrpt | Send every DNS query to the tunnel, whatever other adapters say |
-block a.exe,b.exe | Block these programs (exe names or full paths); needs -full |
-warp | Use free Cloudflare WARP as the VPN. The first run registers a free account and saves it in fswin-warp.json next to fswin.exe (keep that file private) |
-wg my.conf | Use a WireGuard server; my.conf is a normal WireGuard config file |
-proxy socks5://user:pass@host:port | Use a SOCKS5 (or http://) proxy |
-doh URL -doh-ips IPs | Use another DNS-over-HTTPS server |
-dnssec | Block DNS answers that point a public name at a private, loopback or test address (a sign of DNS poisoning); answers with DNSSEC proof are marked in the logs |
-dns-cache | DNS booster: answer repeat lookups from the cache |
-dns odoh -odoh URL [-odoh-relay URL] | Oblivious DoH: a relay hides your IP from the DNS server |
-dns proxy -dns-proxy ip:port | Plain DNS to a server or a local forwarder (like Tor's DNSPort) |
-dnscrypt-relays sdns://... | Anonymized DNSCrypt through relays |
-blocklists DIR -blocklist-stamp 1-... | On-device RethinkDNS blocklists (the app downloads them, ~60 MB) |
-masque | Use free Cloudflare WARP over MASQUE (needs usque.exe next to fswin.exe) |
-chain my.conf | WARP -> the WireGuard server in my.conf -> WARP (needs usque.exe) |
-killswitch | Block all traffic outside the tunnel, even if fswin crashes |
-pcap file.pcap | Packet capture of the tunnel, for Wireshark |
-routes routes.json | Split tunnel: extra WireGuard configs or SOCKS5/HTTP proxies that chosen apps use instead of the main exit |
-rules rules.json | Firewall rules as the app writes them: a mode per app (block, isolate, bypass, exclude), IP and domain rules, universal rules, allowed DNS record types, pause |
-dial-strategy never|auto|split-tcp|split-tls | Anti-censorship: split the first TCP segment or the TLS ClientHello to get past DPI filters (default never, as on Android) |
-dial-retry never|split|plain | What to do when a connection fails |
-dial-timeout 300 | Close idle TCP and UDP sockets after this many seconds |
-tcp-keepalive | Shorter TCP keep alive |
-eim | Endpoint-independent mapping and filtering for UDP (games, calls) |
-cleanup | Remove a DNS rule or kill switch left behind by a crashed fswin, then exit |
-log 0..8 | firestack log detail: 0 very verbose, 3 default, 8 none |
-version | Print the build and exit |
| Phase | What | Status |
|---|---|---|
| 1 | firestack builds on Windows; Wintun network adapter; fswin test tool | done |
| 2 | Firewall core: program lookup, blocking, DNS leak fix, kill switch, rules engine and SQLite storage | in progress |
| 3 | WireGuard and WARP (MASQUE) inside the service | planned |
| 4 | App window and tray icon, installer, code signing, auto-update | planned |
The design and the details of every phase are in PORT.md.
| Path | What |
|---|---|
intra/, tunnel/ | firestack, the engine (from celzero/firestack via paulvers-ui/firestack). Linux-only parts sit in _linux.go files with _windows.go counterparts. |
intra/netstack/wintun_windows.go | Connects firestack's network stack to a Wintun adapter |
win/ | Windows-only pieces: ifbind (keep firestack's own traffic out of the tunnel), owner (which program owns a connection), dnspolicy (DNS leak fix) |
cmd/fswin | The test tool |
third_party/gotrie | A patched copy of a firestack dependency, with Windows support |
Builds run on GitHub Actions: every push builds Windows x64 and ARM64 and checks that the Android build still works.
Testing on your PC is the most useful thing right now: different Windows versions, Wi-Fi and Ethernet, other VPNs and antivirus. Code, docs and ideas are welcome too. See CONTRIBUTING.md.
third_party/gotrie: MPL-2.0.wintun.dll (in the downloads, not in this repository): WireGuard LLC's
prebuilt-binaries license, shipped next to wintun-LICENSE.txt.Celzero for firestack and Rethink, paulvers-ui for the AuroraVPN fork this starts from, the WireGuard project for Wintun and wireguard-go, and Google's gVisor for the network stack.