In-depth 2026 review of Safing Portmaster and the SPN, covering free firewall tools, paid privacy routing, pricing after the February update, and Monero payment options.
Safing Portmaster is an open-source application firewall for Windows and Linux that delivers per-app network control, secure DNS, tracker/ad/malware blocking via filter lists, and a network monitor. Its core privacy and firewall features remain free for all users.
The optional Safing Privacy Network (SPN) functions as a paid overlay that uses onion routing with layered encryption. Each connection routes independently through multiple nodes and exit points, enabling per-connection IP separation and multiple simultaneous identities per app, including across browser tabs. Configurable rules allow users to exclude specific apps or domains and restrict exit countries, with nodes chosen near the destination by default.
Portmaster supports Windows and Linux only; Mac and mobile releases are planned but unavailable. In December 2024, IVPN acquired Safing ICS Technologies GmbH. The project and SPN stayed open source, and no immediate changes to policies or operations occurred after the transition.
Portmaster's free tier supplies the core firewall functions, per-application network controls, secure DNS resolver, and filter-list blocking of trackers, ads, and malware along with a live network monitor. These features require no payment and run indefinitely on Windows and Linux.
The Plus tier adds investigative tools for €40 per year. Users gain access to full network history, per-application bandwidth graphs, and automated weekly reports, plus priority support and coverage for up to five devices. The tier stops short of any SPN routing.
Pro unlocks the complete Safing Privacy Network at the reduced 2026 rates of €8 per month or €80 per year, automatically applied to existing subscribers after the February 24 price update. All Plus features carry over, and every connection can now route through the SPN with independent onion paths and multiple simultaneous identities. Version 2.2.1 introduced split tunneling so selected apps or domains bypass the SPN while the rest remain protected.
| Tier | Price | Key Additions | SPN Access |
|---|---|---|---|
| Free | €0 forever | Firewall, DNS, blocking, monitor | No |
| Plus | €40/year | History, reports, bandwidth, priority support (5 devices) | No |
| Pro | €8/mo or €80/yr | All Plus features plus split tunneling (2.2.1) | Full |
The SPN routes each connection independently through multiple nodes using onion routing and layered encryption. Every TCP or UDP flow receives its own path and exit point, producing a distinct IP address rather than a single shared address for the entire device session.
Applications therefore sustain multiple simultaneous identities. A web browser can present different exit IPs across tabs because each underlying connection is handled separately by the network.
Configurable exclusion rules allow specific apps or domains to bypass the SPN entirely. Operators can also restrict exit countries through the same rule set, limiting where traffic appears to originate.
Exit-node selection defaults to nodes located near the destination server. This choice shortens the final leg of the route compared with fixed geographic exits used by most conventional VPN services.
Traditional VPNs encapsulate all device traffic inside one persistent tunnel to a single remote server. The SPN’s per-connection model removes that central chokepoint and reduces the ability to correlate activity across separate flows through a common IP address.
Safing lists three paid tiers on its pricing page as of the February 2026 update. The core firewall, DNS, and filter-list features remain free indefinitely. Plus adds investigative tools and priority support for €40 per year. Pro unlocks the full SPN overlay at €8 per month or €80 per year, with the same five-device limit as Plus.
| Plan | Annual Price | Monthly Price | Devices | SPN Access |
|---|---|---|---|---|
| Free | €0 | — | unlimited | no |
| Plus | €40 | — | 5 | no |
| Pro | €80 | €8 | 5 | yes |
Accepted payment methods include credit card, PayPal, Bitcoin, Monero, and cash. For users who already rely on Portmaster’s free per-app controls and now want per-connection IP separation, the Pro plan supplies the only route to the SPN at roughly €6.67 per month when billed yearly. The recent price reduction from €99 to €80 per year improves the value proposition for those combining firewall rules with the overlay network.
The SPN protects users by routing each connection independently through layered onion encryption and distinct exit points, delivering per-connection IP separation and multiple simultaneous identities. These features reduce correlation risks compared to single-exit VPNs, yet they do not eliminate all exposure. Exit nodes can still observe unencrypted traffic, and any connection that falls outside active rules defaults to clearnet routing where the original IP remains visible to destinations and network observers.
Clearnet node risks increase when rules are not configured to cover all relevant apps and domains. Proximity-based exit selection, while convenient, can also place traffic through jurisdictions with higher surveillance. Monero payments allow Pro tier access without relying on KYC-linked methods such as credit cards or PayPal when paired with non-custodial acquisition of the coin.
Concrete OPSEC steps include creating explicit exclusion and country-restriction rules for sensitive applications, forcing all other traffic through the SPN. Fund subscriptions exclusively via Monero, review the network monitor regularly for unintended leaks, and avoid routing any KYC-tied services through the same identity. These measures limit the attack surface but require ongoing verification since no overlay network guarantees absolute isolation.
Yes. Portmaster provides full support for both Windows and Linux desktops, delivering per-app firewall rules, secure DNS, and filter-list blocking on those platforms.
IVPN acquired Safing in December 2024. The project and SPN remain open source, with no announced changes to the existing business model or policies at the time of the acquisition.
Official sources provide no measured latency or throughput benchmarks. Users should test the SPN themselves, as speeds depend on node selection, exit location, and current network load.
Mac and mobile support are listed as planned but are not yet available. No release dates appear in current documentation.
Portmaster’s local firewall and DNS features can coexist with separate VPN clients, but overlapping routing rules may require manual configuration to avoid conflicts. The SPN itself already supplies per-connection identity separation when enabled.
The core firewall, DNS, and blocking functions remain free on Windows and Linux. Paid tiers continue to add investigative tools and SPN access exactly as before.
