PortMaster is GREAT but Confusingly Disorganized with BAD Labels

Portmaster, Windows Update, and the Misleading "Block Connections" Setting

Portmaster can successfully restrict Microsoft-related network traffic while still allowing Windows Update to function. However, its user interface makes this considerably more confusing than it should be.

The primary problem is that the prominently displayed Block Connections control does not mean what its label naturally implies.

Setting:

Block Connections: OFF

does not mean that Portmaster will allow the application's connections.

It only means that Portmaster will not use that particular control to force-block all connections. Other Portmaster filtering mechanisms remain active and can still block the application.

This distinction is particularly important with Windows Update.

Windows Update Configuration

On the tested Windows 11 system, initiating Settings → Windows Update → Check for updates caused Portmaster to show network activity from:

• Windows Service: Wuauserv
• Windows Service: BITS

Other Windows Update-related services such as Delivery Optimization (DoSvc), Update Orchestrator Service (UsoSvc), Windows Update Medic Service (WaaSMedicSvc), and MoUsoCoreWorker were not observed attempting network connections during the test and therefore were not relevant to the Portmaster problem being diagnosed.

Both active services were configured with:

Block Connections: OFF

Windows Update still failed.

The setting that actually prevented Windows Update from communicating was the Microsoft entry in Portmaster's Big Tech filter list.

The working exception was:

Apps and Profiles
 → Windows Service: Wuauserv
 → Settings
 → Privacy Filter
 → Filter Lists
 → Big Tech
 → Microsoft: OFF

After disabling the Microsoft filter specifically for Wuauserv, Windows Update functioned normally.

The global Microsoft filter can therefore remain enabled:

Global Settings
 → Privacy Filter
 → Filter Lists
 → Big Tech
 → Microsoft: ON

This preserves Portmaster's Microsoft filtering for the rest of Windows while allowing Windows Update itself to communicate.

Why "Block Connections" Is Misleading

The placement and wording of Block Connections strongly suggest that it is the master allow/block control for the selected application.

A reasonable interpretation of:

Block Connections: OFF

is:

Connections for this application are not being blocked.

That is not how Portmaster works.

The actual meaning is closer to:

Force Block All Connections: OFF

Portmaster then continues evaluating the connection against additional controls, including rules, filter lists, domain-related filtering, and other Privacy Filter settings.

Safing's documentation confirms that Portmaster evaluates connections through multiple stages. Filter Lists are evaluated independently, and a connection matching an ena