Release notes

Pre-release

NetClamp is currently pre-release. Versions in the 0.x range track ongoing work; the API surface, configuration format, and SPA layout may change between releases. We’ll note breaking changes here when they happen.

Notable items shipped

Things you might care about as a user:

Credit-based licensing. Replaces the earlier tiered model. Free baseline 3 entities, each $10 credit adds 10. No subscriptions, no recurring fees, no expiration on activated credits.
Two-phase rule storage. Rules persist with a sync state so a failed install into the underlying firewall can be retried without losing the rule itself. You see this as the Retry button on stuck rules in the SPA.
Auto-recovery from Windows firewall restarts. If Windows restarts its filtering service (during updates, for example), NetClamp re-installs its filters automatically. You don’t have to do anything.
Signed installer and user-mode binaries. The installer and user-mode programs are signed with an Extended Validation code-signing certificate, so Windows shows "Verified Publisher: Szallo Laszlo Persoana Fizica Autorizata" on the UAC prompt.
Reliable in-place upgrades. The installer now correctly stops
restarts the service during upgrade so the new version takes effect immediately, not after reboot.
URL-fragment pairing. Open http://127.0.0.1:9845/#<token>; to skip the pairing screen on a new browser.
Documented ICMP boundary. The rule form explains why a BLOCK ping.exe rule lets ping through (Windows handles it at a lower level where per-app rules don’t apply).

Upcoming

In active development, no commitment on dates:

Microsoft Hardware Dev Center attestation for the kernel driver (unblocks shipping the driver without dev-mode test-signing).
TLS support for non-loopback API binds.
Curated rule subscription bundles by topic (gaming-block, study-mode, work-machine).
Per-rule hit counters surfaced in the Rules table.

Reporting a bug

Email [email protected] with reproduction steps and the output of:

netclamp diag dump --json

The dump packages WFP counters, kernel-driver counters if loaded, recent log tail, and the redacted config in one bundle — safe to share, no secrets.