Projects · by TakeGuard

WireCee

A personal firewall for Windows and Linux that shows what every program is talking to, and lets you stop it.

  • Windows, 64-bit
  • Linux x86_64, with nftables
  • Free
WireCee dashboard with protection status, blocked and allowed counts and a throughput chart

WireCee reads the real connection tables itself, enforces its own rules through the Windows Filtering Platform (nftables on Linux), and can filter DNS for the whole machine. The window and the command line use the same engine, so they never disagree.

What it does

Live connections per application

Host names, state and bytes in and out for every connection, grouped by the program that opened it.

Allow, block or ask

Per application. Ask refuses a new program until you decide, so nothing new gets out unnoticed.

Rules that scale

By address, port, protocol and direction, with lists of hundreds of addresses in one rule.

Known C2 servers blocked

A built-in rule blocks known malware command-and-control servers, from the TweetFeed list.

DNS filtering

Your own blocklist for the whole machine, with a guard so programs cannot go around it.

Data usage

Per day and per application, with a monthly limit and alerts.

Local network devices

See what is on your network and give devices names you recognise.

Tamper alerts

Changes to the hosts file, DNS servers and proxy settings, incoming Remote Desktop and modified executables.

Command line

wirecee connections, block, usage, devices, alerts, dns and more. Query commands need no administrator rights.

Screenshots

WireCee dashboard with protection status, blocked and allowed counts and a throughput chart
Dashboard, shown with sample data.
WireCee connections view listing applications, remote hosts, ports and traffic
Live connections, shown with sample data.

Download

Version 0.2.0, released 15 September 2026. Files are hosted on GitHub Releases.

Status

Version 0.2.0 is the latest release (September 2026). Before 1.0, features and settings may still change between versions. Development continues in the public repository.

Install

Windows: unpack the zip and run WireCee.exe. It asks for administrator rights; without them it still monitors, but cannot block or filter DNS. Linux: unpack the tar.gz and run sudo ./wirecee --open.

Licence

PolyForm Noncommercial 1.0.0. Source available: free to use, read, change and share for non-commercial purposes. Not an OSI open-source licence. Read the licence.

WireCee is a separate product from TakeGuard training and is not included in, or needed for, any training plan.