The worst part of the firewall is the inability to “copy” an ip address from the log interface or paste one into the rules section.
As much as the whole number.number input in the rule editor looks great its extremely frusterating when you actually have to use it to manually edit rules based on the logfiles.
constantly having to switch back and forth between windows and manually type ip adresses in is a bit sickening when you have over 100 ip’s to block/allow and any advanced user usually has a list of ip’s/domains to block upon installation of the firewall.
Personally as a fairly advanced computer user and a gamer i go through logfiles and when the same ip shows up too many times i whois it at arin or ripe etc in order to find out who/what/where If its in a non portable block i generally block it out permanently. If its portable i block it out for a week or so then allow it again.
I would suggest a 2 option install with a heavy warning on the second option.
Basic Interface
Advanced Interface.
Basic interface can pretty much stay the way it is now (except the inablility to copy/paste) and be the only one you can access from the non admin accounts of a microslop machine (to prevent kids and idiots from screwing the machine up)
Advanced interface should allow you to open the sections in separate window processes so you can just flip from one to the other. It also need more direct controls
Oh and precreate a rule for the updater so people don’t try to block it when they install the firewall. This results in an immediate and fatal crash of the firewall most of the time ( i duplicated this 10 times out of 15) One of my friends refuses to use it anymore despite the fact that i told him it was his blocking the firewall’s updater that caused it to crash on the first install. I’m going to show him at the shop tomorrow that is what caused it.
Generally you seem to have a ■■■■ sweet piece of software here although emergance mode kicks in far too often for my liking.