First run
- Install the program. The installer registers the service and starts the tray icon.
- Open the window from the tray and look at the Traffic monitor for a while: it shows what already uses the network.
- On the ELX protection tab, switch the firewall ON and choose the mode — Ask to connect is the one most people want.
- Programs that already had connections, and the components of Windows itself, are allowed automatically; you will be asked only about new ones.
Answering a prompt
| Choice | What it allows or blocks |
|---|---|
| Whole program | Every host and port of this program |
| This domain | Only the host from the prompt; you will be asked about other hosts |
| *.domain | The domain with all its subdomains |
| Port N only | The same, limited to this port; other ports are asked separately |
| Until the program closes | The decision is not saved and is forgotten when the program exits |
While the prompt is open, the program's new TCP connection is held rather than refused, for up to a minute. If you close the prompt without answering and the program tries again, the prompt comes back; “Later” postpones it for two minutes. Programs waiting for a decision are also listed at the top of the ELX protection tab with an “Answer” button.
Rules by domain and port
Expand a program on the ELX protection tab to see every domain and address it has used, with ports and live connections. Each line has Allow, Default and Block; the rules block below takes a host (example.com, *.example.com, an IP or a subnet), ports (443, 80,443, 8000-8100) and the direction. Rules under “Rules for all applications” apply to every program.
Folder rules
A folder rule covers every program in the folder and its subfolders — useful for a games library, a portable tools folder or a development directory. The deepest matching folder wins; a decision made for a particular program overrides the folder.
Network scan
- Press “Scan”; a /24 network takes about twenty seconds.
- Double-click a name or a location to change it.
- Autoscan repeats the scan on a schedule; the interval, the number of threads and the protocols used are in the settings.
- “Random MAC” means the device hides its real address — modern phones do this by default.
VirusTotal
Paste your API key into Settings → VirusTotal and press “Check key”. Programs are then checked one at a time — a free key allows four requests a minute — and again when a file changes or a week has passed. Only the SHA-256 hash is sent.
When something is wrong
| Symptom | Where to look |
|---|---|
| A program cannot connect | ELX protection tab: is it blocked, or waiting for a decision at the top of the list? |
| No prompt appears | Do Not Disturb in the tray menu; the program may also be inside a folder with a rule |
| A server program is not reachable from the network | In ask mode incoming are closed by default — set Incoming to Allowed for it |
| A site is blocked although the program is allowed | A domain rule for this program or for all programs; look in the expanded row |
| The window says the service is not running | Start it from the tray menu: Service → Start |