GeoIP Blocker 1.0.0 - portable Windows release
===================================================

WHAT IT IS
----------
GeoIP Blocker is a country, ISP and application-level outbound firewall for
Windows. It uses the Windows Filtering Platform (WFP) to drop outbound
connections to selected countries, autonomous systems, or individual apps.

ADMIN REQUIRED
--------------
geoipblocker.exe is manifested with requireAdministrator because WFP's
user-mode API requires an elevated token. The first launch triggers UAC;
subsequent launches via the included "Start with Windows" scheduled task
elevate silently.

DATA FILES
----------
On first run the following files are created in the exe's folder:
  * config.json             user settings
  * blocklist.json          blocked countries / ASNs / apps
  * baseline.json           learned per-app profile (if baseline enabled)
  * alerts.json             last 1000 alerts (if baseline enforcing)
  * logs\connections-YYYYMMDD.jsonl  one line per NEW / END / BLOCK event
  * logs\export-*.csv        on-demand CSV export of the in-memory log
  * feeds\*                 downloaded Spamhaus / FireHOL lists (if enabled)
  * geoip\dbip-country.bin  updated GeoIP table (optional; embedded otherwise)
  * wfp-diag.log            per-apply trace of WFP operations

HOW TO REMOVE
-------------
1. If "Firewall rules: Persistent" was ever enabled, run from an elevated
   prompt:
       geoipblocker.exe --remove-all-rules
   or use the "Remove all rules and exit" entry in the tray menu.
2. If the scheduled task "GeoIP Blocker" was installed, remove it:
       schtasks /Delete /TN "GeoIP Blocker" /F
3. Delete the folder containing geoipblocker.exe and its data files.

ATTRIBUTIONS
------------
See LICENSES.txt.

SIGNATURE AND SMARTSCREEN
-------------------------
geoipblocker.exe is Authenticode-signed; the publisher reads
ITITSOLUTION SOFTWARE LLC. Right-click the exe, Properties, Digital
Signatures to confirm. Windows SmartScreen may still warn on first launch
while the publisher builds reputation; click "More info", check the publisher
name, then "Run anyway".

Published hashes: https://ititsolutions.com/geoipblocker
Support: admin@ititsolutions.com

LICENSE
-------
Commercial software; see LICENSES.txt for the license summary and the
third-party data attributions.
