A box pops up: a program wants the internet. Four buttons, ten seconds of patience, and your whole outbound policy is decided in moments like this. Here is what each button really does.
The notification prompt is the feature people install this tool for — and the feature people understand least. Each button sounds similar, but two of them are temporary and two of them write permanent rules into Windows Firewall. Knowing which is which turns a nervous click into a calm decision.
On Medium Filtering with notifications on, the prompt appears the first time a program tries an outbound connection that no rule covers. Read it top to bottom: the program name and path matter most — a familiar name in its normal folder is a very different event from an unknown name running out of a temp folder.
Allow once lets this single connection (and typically this run of the program) through, without writing a permanent rule. It is the right answer when you are unsure: the program works today, and if it asks again tomorrow you get to decide again with more information. Nothing about your long-term protection changes.
Allow always creates a permanent allow rule in Windows Firewall for that program. Use it for software you know and trust — your browser, mail client, office suite. Be a little careful with updaters and helpers of big suites: allow the ones you recognise, and let unknown helpers ask again rather than blessing a whole family blindly.
Block once refuses this attempt and moves on — good for a one-off surprise. Block always writes a permanent block rule: the program will never connect out, and it will stop asking. That silence feels peaceful, but it is also how people accidentally kill a program's updates forever and wonder months later why it is out of date and broken. Block always is a decision, not a dismissal.
Once in a while the prompt names something you cannot identify at all. The honest sequence is: block once, then search the name, then decide. Nothing legitimate is harmed by one blocked attempt — the program will simply ask again if it really needs the connection. The reverse mistake, allowing an unknown program permanently because the prompt was annoying, is the one that cannot be un-rung.
Between once and always there is a third idea worth knowing: this tool can create temporary rules that expire — after a set time, or when the PC restarts. They suit the grey cases perfectly: a game that needs to connect for tonight's session, an installer that wants to fetch components once, a work tool you are evaluating for a day. The program gets its window, the window closes by itself, and your permanent ruleset never fills up with one-evening decisions you forgot making.
Profiles, prompts and rules — the whole Firewall Control walkthrough is in the video.
▶️ Watch Full VideoYou are probably choosing Allow once, which deliberately creates no rule. If the program is known and trusted, choose Allow always once, and the prompts for it stop because a permanent rule now exists.
Yes. Open the Rules panel in Windows Firewall Control, find the rule by the program's name or path, and delete or disable it. The prompt system only writes normal Windows Firewall rules, so every decision can be reviewed and reversed.
The notification system is mainly about outbound connections — that is the gap in the default Windows behaviour this tool exists to close. Inbound connection attempts are blocked silently by default, which is the correct behaviour for them.