“Every packet is visible to the service, and any packet can be stopped before it leaves the system. The software matches traffic to the app that created it by using eBPF and the proc filesystem on Linux or a kernel driver and the IP Helper API on Windows. This approach lets users see each connection while still setting rules per application. It also helps the service sort out unusual cases. Portmaster can recognize Snap packages, AppImage apps and scripts on Linux as well as Windows Store apps and system services that run under svchost.exe.”
I love that it shows per application how many, and what countries, connections are being made to the Internet. It also intercepts DNS queries that may have bypassed your user settings.
The linked article does link directly to the GitHub project, where you can get the files to install it.
See https://www.helpnetsecurity.com/2025/12/03/portmaster-open-source-application-firewall