WHAT IS NETGUARD?

Home Network Security Monitor — your silent guardian

NetGuard is a real-time network intrusion detection system built for home users on Windows. It runs silently in the background, watching every device on your network and alerting you the moment something suspicious happens.

What NetGuard monitors:

Threat Type	What it means	Severity
ARP Spoofing	A device is impersonating another — classic Man-in-the-Middle attack	HIGH
Port Scans	Someone is probing your network looking for open services	HIGH
Brute Force	Repeated login attempts — attacker trying to guess passwords	HIGH
Malware DNS	A device queried a known malware or C2 domain	HIGH
Unknown Devices	New device joined your network that isn't whitelisted	MED
Risky Open Ports	Services like Telnet, RDP, SMB exposed on your network	MED
Suspicious Connections	Outbound connections to known bad ports (4444, 9050 etc)	HIGH
Bandwidth Drops	Speed drops significantly — possible bandwidth theft	MED

HOW IT WORKS

NetGuard has two parts that work together:

NetGuard-Service.ps1 — The monitoring engine. Runs in the background, scans your network every 30 seconds, detects threats, and writes alerts to the log files.

NetGuard-Dashboard.html — The visual interface. Open in any browser to see live charts, device lists, alert history, and controls. Reads from the log files the service writes.

NOTE

The dashboard only shows real alerts when the PowerShell service is actually running. Without the service, the dashboard is just a viewer with no data coming in.

INSTALLATION

Get NetGuard running in under 5 minutes

REQUIREMENTS

Requirement	Details
Windows	Windows 10 or Windows 11
PowerShell	Version 5.1 (built into Windows — no install needed)
Browser	Any modern browser — Edge, Chrome, Firefox
Network	Must be on a 192.168.x.x home network

FILE SETUP

1

Create a folder

Create a folder at C:\Users\Jack\Downloads\Network Intrusion (or wherever you prefer — just update the path in NetGuard.bat)

2

Copy all files into the folder

Place all NetGuard files in the same folder: Dashboard, Service, Tray, Whitelist, and the .bat menu

3

Unblock the PowerShell files

Windows may block downloaded .ps1 files. Right-click each .ps1 file → Properties → check Unblock at the bottom → OK. Or the .bat menu does this automatically.

4

Run NetGuard.bat as Administrator

Right-click NetGuard.bat → Run as Administrator. The menu will open.

5

Configure your email (optional)

Open NetGuard-Service.ps1 in Notepad and fill in your Gmail address and App Password in the config block at the top. See the Email Alerts section for details.

FIRST RUN

What to do the first time you launch NetGuard

1

Start monitoring

Right-click NetGuard.bat → Run as Administrator → press 2 for Background (System Tray). A shield icon will appear in your system tray.

2

Open the dashboard

Press D in the menu, or double-click the shield icon in the tray. The dashboard opens in your browser.

3

Run your first scan

Click SCAN NETWORK on the dashboard. After about 5 seconds you'll see all devices on your network listed in the Devices tab.

4

Add trusted devices

Click ⚙ SETTINGS → Trusted Devices, or press 8 in the bat menu to scan and add your known devices. This stops NetGuard alerting on your own phone, laptop etc.

5

Install auto-start (recommended)

Press 5 in the bat menu as Administrator. NetGuard will now start automatically every time Windows boots — no manual launch needed.

TIP

On first scan you'll see a lot of "New device" alerts — this is normal. Once you've whitelisted all your known devices, only genuinely unknown devices will trigger alerts.

THE DASHBOARD

Your real-time window into your network

TABS

Tab	What's in it
Overview	Stat cards, blocked IPs, traffic chart, threat categories, security health scores, recommendations
Devices	All discovered devices with risk scores, open ports, CVE exposure, and auto-blocked IPs
Threats	Live intrusion event log, world map showing attack origins, attacker geolocations
DNS	DNS query monitor — shows malware and tracker domain lookups in real time
Network	Network topology map, speed test, PowerShell service launcher
Alert History	Full searchable alert log, export to CSV, severity breakdown charts

CONTROLS BAR

Button	What it does
SCAN NETWORK	Runs a network scan — discovers devices and checks for risky open ports
CLEAR LOG	Clears the current session's alert log (does not delete the log file)
SPEED TEST	Tests your internet download and upload speed
SETTINGS	Opens the settings hub — alert config, service launcher, registration
TRUSTED DEVICES	Opens the whitelist manager
EXPORT REPORT	Generates a full HTML security report

SCANNING YOUR NETWORK

How to discover what's on your network

Clicking SCAN NETWORK on the dashboard runs a visual scan of your local network range (default: 192.168.1.0/24). The scan takes about 5-10 seconds and does the following:

What the scan checks:

1. ARP table — lists all devices currently connected to your router

2. Port scan — checks each device for dangerous open ports (Telnet, RDP, SMB, etc)

3. CVE lookup — cross-references open ports with known vulnerabilities

4. Risk scoring — assigns each device a risk score from 0-100

IMPORTANT

The dashboard scan is a visual preview. The PowerShell service (NetGuard-Service.ps1) runs deeper, continuous scans every 30 seconds and is what generates real alerts. Run the service from Settings → Start/Stop Service for full protection.

SCAN RANGE

The default scan range is 192.168.1.0/24 which covers addresses 192.168.1.1 through 192.168.1.254. This is the standard Verizon Fios range. If your router uses a different subnet you can change it in the dropdown next to the Scan button.

UNDERSTANDING ALERTS

What each alert means and what to do about it

SEVERITY LEVELS

HIGH

Immediate action required

Active attack or serious vulnerability. Alarm sounds, email and SMS sent, visual flash overlay appears.

MED

Investigate soon

Potential risk that needs attention. Email sent if configured. No alarm.

LOW

Informational risk

Minor or potential issue. Logged only by default.

INFO

Status update

New device joined, scan complete, service started etc.

CLICKING AN ALERT

Click the geolocation text on the right side of any alert in the Threats tab to open the IP Intelligence popup. This shows the country, ISP, and gives you a one-click Block This IP button.

ARP SPOOFING — MOST SERIOUS

If you see an ARP spoofing alert, a device on your network is pretending to be another device. This is a Man-in-the-Middle attack. Log into your router immediately, find the device, and block its MAC address. Then change your Wi-Fi password.

BLOCKING THREATS

How to block attackers from your network

FROM THE DASHBOARD

There are three ways to block an IP from the dashboard:

1. From the Alert History tab — Click the BLOCK button next to any HIGH severity alert

2. From the IP popup — Click any geolocation text in the Threats tab → Block This IP

3. From the Overview tab — The Blocked IPs panel lists all blocked IPs with an Unblock button

APPLYING BLOCKS IN WINDOWS FIREWALL

Dashboard blocks are saved in your browser. To actually enforce them in Windows Firewall:

Option 1 — One at a time: Click the PS button next to any blocked IP → copies the netsh command → paste into PowerShell as Administrator

Option 2 — All at once: Click Download Firewall Rules on the Overview tab → run the downloaded .bat file as Administrator

Option 3 — Automatic: In Settings → Alert Settings, enable Auto-block external IPs. NetGuard will block attacking IPs the moment a HIGH alert fires.

BLOCKING LOCAL DEVICES (LAN)

Windows Firewall can only block by IP address for external threats. For local devices (192.168.x.x) you need to block at the router level using the device's MAC address:

Go to http://192.168.1.1 (your Fios router)
My Network → Network Map
Find the unknown device
Click it → Block Device (or add to Access Control list)

TRUSTED DEVICES

Adding your known devices to stop false alerts

When NetGuard first runs it has no knowledge of which devices on your network are yours. Every new device triggers a "New device joined" alert until you add it to the whitelist.

HOW TO ADD DEVICES

1

Scan and add (recommended)

Run NetGuard.bat → option 8. NetGuard scans your network and shows all devices. Pick the ones that are yours and they're added automatically.

2

Add manually by IP

Run NetGuard.bat → option 7. Enter the IP address, device name, and owner name.

3

Via the dashboard

Open the dashboard → TRUSTED DEVICES button → opens the visual whitelist manager.

TIP — Add these devices first

Your router (192.168.1.1), your PC, your phone, your son's iPhone and MacBook, your printer, your smart TV, and any other devices you recognise. Once whitelisted, NetGuard only alerts on truly unknown devices.

SETTINGS

Configuring NetGuard to suit your needs

Click the ⚙ SETTINGS button in the controls bar to open the Settings Hub. It has 7 tiles:

Tile	What it does
Alert Settings	Email, SMS, alarm sounds, auto-block rules, daily digest
Start / Stop Service	Quick launch buttons for the PowerShell monitoring service
Trusted Devices	Opens the whitelist manager
Network & Speed	Goes to the Network tab with topology map and speed test
Export Report	Downloads a full HTML security report
License & Register	Enter your license code or pay via PayPal
Reset Activation	Admin only — resets the trial and license (password protected)

ALARM CONTROLS

The alarm controls are in the header bar at the top of the dashboard:

Control	What it does
🔔 ALARM ON / 🔕 ALARM OFF	Toggle the audio alarm on or off for HIGH alerts
Sound dropdown	Choose from Beep, Siren, Pulse, Klaxon, Chime, or Silent
TEST button	Plays the currently selected sound at full volume

EMAIL ALERTS

Get notified by email when threats are detected

NetGuard sends email alerts via Gmail's SMTP server. You need a Gmail account with an App Password (not your regular password).

SETTING UP GMAIL APP PASSWORD

1

Enable 2-Factor Authentication

Go to myaccount.google.com → Security → 2-Step Verification → Turn on

2

Create an App Password

Go to myaccount.google.com → Security → App Passwords → Select app: Mail → Select device: Windows Computer → Generate

3

Copy the 16-character password

Google shows you a 16-character password like abcd efgh ijkl mnop. Copy it (without spaces).

4

Enter it in NetGuard

Open NetGuard-Service.ps1 in Notepad → find the config block → fill in EmailFrom, EmailTo, SmtpUser, and SmtpPass

EmailEnabled = $true
EmailFrom   = "yourname@gmail.com"
EmailTo     = "yourname@gmail.com"
SmtpUser    = "yourname@gmail.com"
SmtpPass    = "abcdefghijklmnop"  # 16-char App Password, no spaces

SMS ALERTS

Get a text message when HIGH severity threats are detected

NetGuard sends SMS via Twilio. Twilio offers a free trial with $15 credit — enough for thousands of messages.

SETTING UP TWILIO

1

Create a free Twilio account

Go to twilio.com → Sign up free. No credit card needed for the trial.

2

Get a phone number

In the Twilio console → Phone Numbers → Get a number. Choose a US number.

3

Copy your credentials

From the Twilio console dashboard, copy your Account SID and Auth Token.

4

Add to NetGuard

Open NetGuard-Service.ps1 → fill in the Twilio config block → set SmsEnabled = $true

SmsEnabled  = $true
TwilioSid   = "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
TwilioToken = "your-auth-token-here"
TwilioFrom  = "+15551234567"   # Your Twilio number
TwilioTo    = "+15559876543"   # Your personal number

SYSTEM TRAY

Running NetGuard silently in the background

When you start NetGuard using option 2 in the bat menu, it runs as a system tray application — a shield icon appears in the bottom-right corner of your screen near the clock.

TRAY ICON COLOURS

Colour	Meaning
Green	Monitoring active, no threats detected
Red	One or more HIGH threats detected
Grey	Service stopped

TRAY RIGHT-CLICK MENU

Option	What it does
Open Dashboard	Opens the dashboard in your default browser
Manage Trusted Devices	Opens the whitelist manager
Start Monitoring	Starts the background monitoring service
Stop Monitoring	Stops the background monitoring service
View Log File	Opens the log file in Notepad
Add Trusted Device	Runs the whitelist scanner
Exit NetGuard	Stops the service and removes the tray icon

TIP

Double-click the shield icon to open the dashboard instantly.

AUTO-START ON BOOT

Make NetGuard start automatically every time Windows starts

Once installed as a Scheduled Task, NetGuard starts automatically when you log into Windows — no bat file or manual launch needed.

HOW TO INSTALL

1

Right-click NetGuard.bat → Run as Administrator

The menu must be running as Administrator for the Scheduled Task to install correctly.

2

Press 5 — Install Auto-Start on Boot

NetGuard installs itself as a Windows Scheduled Task that runs at logon.

3

Reboot to confirm

Restart your PC. The shield icon should appear in your system tray automatically within 30 seconds of logging in.

To remove the auto-start, press 6 in the bat menu as Administrator.

ALERT REFERENCE

Every alert type explained

HIGH

ARP SPOOFING DETECTED

A device is broadcasting false MAC address information. Someone on your LAN is attempting a Man-in-the-Middle attack. Action: find the device at that IP, block its MAC on your router, change your Wi-Fi password.

HIGH

PORT SCAN DETECTED

An external IP is scanning your network for open ports. Action: block the IP. If from your own LAN, investigate which device is doing it.

HIGH

SSH/RDP BRUTE FORCE

Repeated failed login attempts detected. Someone is trying to guess your password. Action: block the IP, disable the service if not needed, ensure strong passwords are set.

HIGH

MALWARE DNS QUERY

A device on your network looked up a known malware or C2 domain. Action: identify which device made the query, run antivirus on it, and block the domain at your router.

HIGH

SUSPICIOUS CONNECTION (port 4444)

A device has an active connection on a known backdoor port. This may indicate a compromise. Action: immediately disconnect that device from the network and run a full antivirus scan.

MED

NEW DEVICE ON NETWORK

An unknown device has joined your network. Action: identify it. If you don't recognise it, block its MAC address on your router and change your Wi-Fi password. If it's yours, add it to the whitelist.

MED

OPEN RISKY PORT (Telnet/RDP/SMB)

A risky service is exposed on your network. Telnet = disable immediately (unencrypted). RDP = restrict to VPN only. SMB = ensure Windows is patched.

MED

BANDWIDTH LOW

Your download speed has dropped below the threshold. Could indicate network congestion or an unauthorised device using your bandwidth.

MENU COMMANDS

All NetGuard.bat menu options explained

Option	What it does	Needs Admin?
1 — Start Foreground	Starts the monitoring service in a visible PowerShell window. Good for watching alerts live.	Yes
2 — Start Background	Starts the monitoring service silently. Shield icon appears in system tray. Recommended for normal use.	Yes
3 — Stop	Stops the background monitoring service.	No
4 — Check Status	Shows the service status and last 30 lines of the log file.	No
5 — Install Auto-Start	Installs NetGuard as a Windows Scheduled Task. Runs at every login.	Yes
6 — Remove Auto-Start	Removes the Scheduled Task.	Yes
7 — Add Trusted Device	Manually add a device IP to the whitelist.	No
8 — Scan Network	Scans network and lets you pick devices to whitelist.	No
9 — List Trusted	Shows all whitelisted devices.	No
D — Open Dashboard	Opens NetGuard-Dashboard.html in your default browser.	No
X — Exit	Closes the menu. The background service keeps running.	No

CONVERTING TO EXE

Package NetGuard as a standalone executable

Once you're happy with NetGuard running as .ps1 scripts, you can convert them to .exe files using ps2exe. The .bat menu automatically detects and uses the .exe versions.

STEP 1 — INSTALL PS2EXE (once only)

Install-Module ps2exe -Scope CurrentUser

STEP 2 — CONVERT ALL THREE SCRIPTS

cd "C:\Users\Jack\Downloads\Network Intrusion"

# Tray application (main EXE)
Invoke-ps2exe -InputFile .\NetGuard-Tray.ps1 -OutputFile .\NetGuard.exe -NoConsole -RequireAdmin

# Monitoring service
Invoke-ps2exe -InputFile .\NetGuard-Service.ps1 -OutputFile .\NetGuard-Service.exe -NoConsole -RequireAdmin

# Whitelist manager
Invoke-ps2exe -InputFile .\NetGuard-Whitelist.ps1 -OutputFile .\NetGuard-Whitelist.exe -NoConsole -RequireAdmin

TIP

Keep the .ps1 files as backups. If anything goes wrong with the EXEs, delete them and the .bat menu falls back to the .ps1 files automatically.

TRIAL & LICENSE

7-day free trial — $15 one-time license

NetGuard includes a fully functional 7-day free trial from the first time you open the dashboard. No features are locked during the trial.

PURCHASING A LICENSE

1

Click ⚙ SETTINGS → License & Register

Opens the registration panel.

2

Click Pay with PayPal or scan the QR code

Complete the $15 payment via PayPal. You'll receive a receipt by email.

3

Enter your username and license code

Your license code will be provided after payment. Enter your username and code in the registration panel and click Activate.

RESET ACTIVATION (ADMIN)

The Reset Activation tile in Settings is password protected. It requires admin credentials and resets the trial period and any existing license. This is for admin use only.

FAQ

Frequently asked questions

Why are all the alerts showing the same fake IPs?

The dashboard has demo events that fire on first run so you can see what it looks like. These are not real alerts. Real alerts only appear when NetGuard-Service.ps1 is running in the background and writes to the log file.

Do I need to keep the .ps1 files?

Yes — the .ps1 files are the monitoring engine. The HTML dashboard is just the visual interface. Without the .ps1 running, no real monitoring happens. You only need NetGuard-Service.ps1, NetGuard-Tray.ps1, NetGuard-Whitelist.ps1, NetGuard-Dashboard.html, and NetGuard.bat.

What is 192.168.1.55 and why is it alerting?

This is an unknown device on your network. Go to your Fios router at http://192.168.1.1, find the device by its MAC address, and determine if you recognise it. If not, block it at the router level and change your Wi-Fi password.

Can I run this on multiple PCs?

Yes — install NetGuard on each PC. Each instance monitors from that PC's perspective. They all write to their own local log files.

Will this slow down my computer or internet?

No. NetGuard is lightweight — it sleeps between 30-second scan cycles. CPU usage is under 1% when idle and the network scan uses minimal bandwidth.

Why does the light theme not change some things?

Make sure you're using the updated dashboard file. Earlier versions had a CSS compatibility issue with color-mix() that affected theme switching. The current version uses standard rgba() values that work in all browsers.

How do I update the PayPal link in the dashboard?

Open NetGuard-Dashboard.html in Notepad → find the line var PAYPAL_ME='https://www.paypal.com/paypalme/YourPayPalUsername' → replace YourPayPalUsername with your actual PayPal.me username → save.