red=incoming traffic requesting access
black=outgoing traffic requesting access

** Hi Christopher, in your first post you mention:

“the best policy on an unprotected machine is no-incoming policy. It’s always the safest route to be able to get out but not let anything in.”

Could you by post,link, etc please show how exactly to block all incoming traffic?? How to allow or add permission for programs that need incoming traffic and pose no threat to the machine.

Thank you.

However, I have a question. In the list of traffic under the events tab, some items are coloured red and others are black. What’s the significance of the red ones?

It looks like the attempts on ports on which I have services running are in red but there’s nothing in the help (the links don’t work) to confirm this.

If you need to access the GUI to make changes you’d need to launch it but by default it isn’t loaded.