If this project helps you, a coffee helps me keep working on it.
HostsGuard shows the DNS and network activity happening on your Windows PC, then gives you a safe place to decide what should be allowed. It can manage the hosts file, create clearly named Windows Firewall rules, and recover the machine to a known network posture.
The desktop app and CLI stay unelevated. A small Windows service owns protected changes, which keeps administrator access away from the day-to-day interface.
Download the latest release | See the workflow | Use the CLI
- See the traffic: follow DNS lookups, short TCP flows, UDP activity, listeners, and recent firewall decisions.
- Make narrow changes: block a domain, one application, a remote address, or a defined rule group without reaching for a global kill switch.
- Review before recovery: inspect hosts backups, portable policy changes, and full-state recovery points before applying them.
- Keep policy local: activity history and settings stay on the PC. Online feeds, reputation checks, and AI categorization are optional.
| Windows device | Installer |
|---|---|
| Most Intel and AMD PCs | HostsGuard-v0.12.157-win-x64-dotnet-Setup.exe |
| Windows on ARM | HostsGuard-v0.12.157-win-arm64-dotnet-Setup.exe |
Requirements: Windows 10 or 11. The installers are self-contained, so a separate .NET runtime is not required.
HostsGuard releases are intentionally unsigned. Windows may show a SmartScreen warning on first run. Download from this repository only, then compare the file against SHA256SUMS.txt:
Get-FileHash .\HostsGuard-v0.12.157-win-x64-dotnet-Setup.exe -Algorithm SHA256The installer asks for administrator access once to register HostsGuardSvc. The app and CLI run without elevation after that.
Every screen below is captured offscreen from the real WPF application with a safe sample data set. No live hosts or firewall policy is changed during capture.
| Inspect live firewall activity | Review the managed hosts policy |
|---|---|
 |
 |
| Author clear Windows Firewall rules | Check health and recovery controls |
|---|---|
 |
 |
- Observe. HostsGuard listens to Windows DNS, connection, and firewall evidence and presents it in one workbench.
- Investigate. Search by domain, process, port, country, rule source, or decision. Inspect the reason behind a block before changing it.
- Control. Add a hosts entry or a scoped
HG_firewall rule. Notify and Learning modes can help build application policy from real activity. - Recover. Restore the safe network posture, roll back a blocklist source, or preview a full recovery point when a change does not behave as expected.
| Area | What you can do |
|---|---|
| DNS and hosts | Watch DNS events, block or temporarily allow domains, manage blocklists, inspect resolver behavior, and restore protected hosts content. |
| Firewall activity | Review live TCP and UDP activity, listeners, service attribution, recent decisions, QUIC use, and per-app bandwidth. |
| Firewall rules | Search Windows rules, create scoped HG_ rules, review drift, group related rules, and clean up exact duplicates with a guarded preview. |
| Ask-to-connect | Prompt on new outbound attempts, bind decisions to an executable or interpreter script, and retain a reviewable history. |
| Network posture | Switch between Normal, Notify, and Learning modes. Use DNS bypass defenses, VPN bindings, profile rules, and timed pauses when needed. |
| Recovery and evidence | Export redacted support bundles, create full-state snapshots, inspect policy changes, and return to a safe network posture. |
HostsGuard also includes optional threat feeds, domain-purpose annotations, usage budgets, webhook notifications, portable policies, and an authenticated loopback API. Defaults favor observation and review. Disruptive controls are opt-in.
flowchart LR
A[WPF app<br/>unelevated] -->|Authenticated named pipe| C[HostsGuardSvc<br/>LocalSystem]
B[CLI<br/>unelevated] -->|Same contract| C
C --> D[Windows hosts file]
C --> E[Windows Firewall and ETW]
C --> F[Local SQLite policy and history]
The service owns every privileged mutation. The control pipe has an access control list, uses a per-session token, and verifies the connected service identity. Policy files under %ProgramData%\HostsGuard are restricted to SYSTEM and administrators.
HostsGuard uses typed Windows APIs for firewall, DNS, network, and service work where Windows provides them. Read-only diagnostics may call a bounded Windows query tool when there is no equivalent managed API.
- Import and restore flows show a preview and bind the apply step to the reviewed content hash.
- Hosts writes are transactional and backed up. Tamper watch can distinguish HostsGuard changes from external edits.
- Rules created by the app use the
HG_prefix, so they remain identifiable and removable as a group. - Uninstall restores the prior firewall posture and removes HostsGuard rules. Local history is retained by default unless you choose the purge option.
No network privacy tool can prove that every packet is attributable on every Windows build. HostsGuard reports degraded or unavailable evidence instead of presenting a false clean result.
The CLI talks to the same authenticated service as the desktop app and does not need to run as administrator.
HostsGuard.Cli status
HostsGuard.Cli mode notify
HostsGuard.Cli block telemetry.example.test "Not needed on this PC"
HostsGuard.Cli explain telemetry.example.test
HostsGuard.Cli firewall-analyze
HostsGuard.Cli safe-postureUseful command groups include:
block,allow,unblock,blocklists, anddns-cachelisteners,events,traffic-profile,usage, andsupport-bundlefirewall-rule,firewall-analyze,firewall-cleanup, andsecure-rulessnapshot,export-policy,import-policy,profile-match, andupdate
Run HostsGuard.Cli --help for the full command catalog and options.
| Location | Contents |
|---|---|
%ProgramData%\HostsGuard\ |
Service policy, SQLite activity data, recovery state, consent decisions, and feed metadata. |
%APPDATA%\HostsGuard\ |
Per-user theme, scale, language, and application logs. |
HostsGuard does not send product analytics. Network access occurs when you request a release check, refresh a remote list, use an online reputation link, configure webhooks, or enable an AI categorization provider. Support bundles are created locally and redact sensitive fields before export.
The installer includes HostsGuard.Migrator.exe for profiles from the retired Python release line. It can import the old SQLite database, schedules, allowlists, and resolver settings. Preview the move first:
HostsGuard.Migrator.exe --source C:\path\to\python-profile --target C:\path\to\new-profile --dry-runThe final Python build is preserved at the python-eol tag.
Install the .NET 10 SDK and Inno Setup 6, then run:
git clone https://github.com/SysAdminDoc/HostsGuard.git
cd HostsGuard
dotnet build HostsGuard.sln -c Release
dotnet test HostsGuard.sln -c Release
powershell -NoProfile -ExecutionPolicy Bypass -File tools\package-hygiene.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File tools\visual-smoke.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File tools\release-version-gate.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File build\publish.ps1 -AllRuntimesBuild the installers after publishing:
& "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" installer-dotnet.iss
& "C:\Program Files (x86)\Inno Setup 6\ISCC.exe" /DTargetRid=win-arm64 /DTargetArchitecturesAllowed=arm64 /DTargetInstallIn64BitMode=arm64 installer-dotnet.issOutputs:
installer_output/HostsGuard-v<version>-win-x64-dotnet-Setup.exe
installer_output/HostsGuard-v<version>-win-arm64-dotnet-Setup.exe
The solution separates the domain model, Windows integrations, gRPC contract, LocalSystem service, WPF app, CLI, migrator, and their test projects. Release screenshots are rendered from an isolated sample fixture and checked for dimensions, content, theme coverage, and stale binaries.
A domain is blocked but still resolves
Some apps keep their own DNS cache or use encrypted DNS. Inspect the name under Tools, flush the selected Windows cache entry, then review Firewall Activity if the process still connects directly. DNS bypass controls remain opt-in because they can affect other software.
Windows Defender reports a hosts file change
Large hosts lists, especially lists that include Microsoft telemetry names, can trigger SettingsModifier:Win32/HostsFileHijack. Review the selected list and its preview. If the change is intentional, add an exclusion for C:\Windows\System32\drivers\etc\hosts.
I need to undo my changes
Use Restore safe network posture for the quickest recovery. The Hosts File page can restore a backup, and Firewall Rules can remove rules owned by HostsGuard. Uninstall performs both cleanup steps automatically.
Open a GitHub issue with a redacted support bundle from Tools > Export Support Bundle. Remove any details you do not want to publish before attaching it.
HostsGuard is available under the MIT License.
Issues and focused pull requests are welcome. For a bug report, include the app version, Windows build, reproduction steps, and the smallest relevant section of a redacted support bundle.