Limen

See where programs connect. Review blocked Internet attempts. Create real Windows Firewall rules.

Limen 1.4.0 is an early Windows desktop application built with Electron. It reads Windows TCP connections and UDP endpoints and manages its own program rules through Windows Defender Firewall. The old 1.1 web console could only simulate blocking; this release writes rules to Windows and reads their saved fields and active-policy status back. Successful storage does not guarantee that traffic is blocked; see the validation record.

The screenshot shows the installed 1.4.0 application in the test VM with a real TCP connection and local country lookup. See the validation record for UI and packet checks. The existing Blackbox service inspection and War Monitor remain available.

Windows downloads · How it works · Build from source · Changes

Install on Windows

Use Windows 10/11 x64, with Windows PowerShell 5.1, the NetSecurity module, and Windows Defender Firewall available.

1. Download Limen-1.4.0-setup-x64.exe for installation, or Limen-1.4.0-portable-x64.exe for the portable app.
2. Starting the desktop app requests administrator privileges for Windows Firewall rule management. Without elevation, rule changes are unavailable.
3. Open Monitor or Apps to inspect observed programs. Create an explicit inbound or outbound rule for a program, optionally limited to a literal remote IP, TCP/UDP, and local or remote port.
4. Use Rules to inspect, disable, or remove rules created by Limen.
5. Open World map for locally resolved peer countries. Open Approvals and explicitly enable the mode to review unknown outgoing Internet attempts before permitting a retry.
6. X hides Limen in the Windows notification area. Use the icon to restore it; Quit Limen asks for confirmation.

This preview release is unsigned. Verify the release SHA-256 checksums and use source builds if you need to inspect the application before running it. It is not a replacement for your organization's endpoint protection.

How it works

Capability	Behavior
Windows capture	Get-NetTCPConnection, Get-NetUDPEndpoint, process paths, and Get-NetAdapterStatistics byte counters. If adapter statistics are empty, invalid, or unavailable, Limen falls back to .NET NetworkInterface.GetIPStatistics() for configured active interfaces.
Blocking and allowing	Explicit program rules in Windows Defender Firewall, created through New-NetFirewallRule. Changes are read back from Windows before the UI reports success.
Rule scope	A local .exe path, explicit inbound/outbound direction, optional literal remote IP, and either all protocols or TCP/UDP with optional local and remote ports. An IP rule is not a domain-name rule.
Persistence	Native rules remain stored when Limen closes. Windows enforces them while the matching policy and filtering category are active. Limen reads their state at startup.
Isolation	Local renderer files and a restricted Electron IPC bridge. No privileged HTTP server, account, cloud database, or remote web UI.
Browser preview	An explicitly labeled simulation lab. It cannot inspect the visitor's computer or change Windows Firewall.

The socket monitor observes connections after Windows creates them. Version 1.4 also adds an explicitly enabled native approval mode: unapproved outbound public TCP/UDP attempts are blocked through Windows Filtering Platform and shown for review. An approval permits a future retry; it does not resume a suspended socket call. The mode uses temporary session filters and starts off on a new application launch. Controls and limits.

Windows Firewall decides the final outcome. Explicit block rules take precedence over conflicting allow rules. Existing rules, disabled profiles, group policy, and other security products can affect enforcement. Limen reports its backend and profile status and does not disable Windows Firewall or rewrite system-wide profile defaults. See Microsoft's rule precedence documentation.

Limen displays the rule's ActiveStore status. A stored rule reported as Inactive / CategoryDisabled is not treated as effective protection. This occurred on the development machine; see the validation record before relying on this early release.

What the monitor can tell you

• Real TCP states and bound UDP endpoints, process IDs, and executable paths when Windows permits access. The socket count includes listening, bound, and closing endpoints; it is not a count of programs currently transferring data.
• Traffic rates from two comparable adapter-counter readings. The first reading establishes a baseline; unavailable counters do not appear as zero traffic. Per-program traffic and dropped-packet counts are not measured and are not fabricated.
• UDP endpoint enumeration does not supply a remote peer. TCP socket enumeration also does not reliably identify connection direction; unknown values stay unknown.
• A binary's signature is not assumed from its name or path. Blackbox inspection can verify the selected executable; uninspected binaries and loaded module signatures remain unknown.
• Capture is periodic. The monitor shows the last successful read and whether another read is pending. After 15 seconds without a fresh snapshot, retained observations are labeled stale and traffic rates are withheld. Very short connections can be missed; inaccessible process paths and failed reads are reported rather than replaced with mock data.

Version 1.2.1 fixed a reproduced false-zero counter result on Windows. Failed counter reads preserve valid socket observations, and changes to the counter provider or adapter set require a fresh rate baseline. Connections and rule actions appear before the optional throughput chart. New rules default to the whole program; restricting a rule to one remote IP is an explicit choice shown in the scope summary before saving.

The optional simulation lab keeps its traffic and policies separate from Windows rules. Old browser-local rules are never silently installed into Windows.

Blackbox Breaker and War Monitor

Version 1.3.0 adds hosted-service and process inspection, module lists, executable hashes and signature results, a local telemetry recorder, evidence-based anomaly hints and experimental Drift Guard. Freeze a program's observed TCP destinations to review later deviations without continually relearning them. These observations guide explicit Windows rule decisions; they do not automatically label or block programs.

Read the observation guide for controls, sampling limits and the distinction between a shared host and the service that originated traffic.

New in 1.4

• Offline world map: approximate countries for TCP peers and actual outbound guard events, including UDP. No endpoint addresses are uploaded. Private and unknown addresses remain separate.
• Notification area: X hides the running application. Restore it from its icon or by launching it again; actual exit requires confirmation.
• Internet approvals: an optional native WFP session blocks unapproved public TCP/UDP attempts. Allow one destination or the whole program for the current session, or deny. Existing Windows blocks still apply.
• Native binary core and integrity: a separately licensed C++ DLL and host, verified against pinned hashes, plus packaged Electron ASAR integrity and hardened fuses.

Read the 1.4 controls and limitations. Session approval mode is not a boot-time service or permanent default-deny policy: it ends when Limen actually exits or its native host dies.

Build from source

Use Node.js 22.12 or newer and npm. Windows is required to run and package the native backend. The new approval runtime is distributed as verified binaries under a separate license; its source is retained privately by the owner. The interface and public integration code remain MIT.

git clone https://github.com/DataProtector-collab/limen-firewall.git
cd limen-firewall
npm ci
npm test
npm run typecheck
npm run build
npm run native:prepare
npm start

For native rule changes, start your development terminal as administrator. The packaged application requests elevation itself.

npm run dist:win

The portable executable and installer are written to release/. You can inspect the unpacked build with npm run pack:win.

For browser-only interface development:

npm run dev

This serves the lab at http://127.0.0.1:8080; npm run preview serves the production browser build at http://127.0.0.1:8081.

Safety and testing

SECURITY.md documents the privilege boundary and limitations. docs/VALIDATION.md records the checks performed for this release and distinguishes automated regression tests from native enforcement tests.

Closing or uninstalling Limen does not remove its persistent Windows rules. Review and remove unwanted Limen rules before uninstalling, or use Windows Defender Firewall with Advanced Security to find the Limen rule group. Limen does not manage other applications' rules.

Project layout

desktop/                  Electron main/preload, Windows backend, native tests
src/lib/firewall/         Capture adapter, validated state, lab engine, tests
src/components/firewall/  Monitor, programs, native/lab rules, settings, dialogs
src/lib/i18n/             German/English text and legacy locale fallbacks
docs/                    Screenshots and validation notes

The desktop entry is src/main.tsx; obsolete web-server, account, database and deployment scaffolding has been removed. The current interface is translated into English and German. The seven other saved language selections currently display English; the language picker states this explicitly.

License

MIT for the interface and public integration code. The new native approval DLL and host have a separate binary license. Geographical data retains its own license and attribution. Copyright 2026 DataProtector-collab.