So... I searched for best firewall but none of the review sites gave in-depth info and many sounded like they were just repeating some promo blurb. In the end I decided to test them one by one (except Zone Alarm which sounds like it is now predominantly anti-virus with the firewall an extra plus still annoying nag screens. Anyway, none of the others worked well for me. I only use my tablet as a kind of glorified e-reader for reading stories on-line and watching videos on Vimeo (Youtube is so cluttered and ruined with ads I mostly use 4K-downloader for that.) Anyway, all I wanted was a firewall that would totally block everything by default, alert me if any program tried to access the net and let me choose whether to let it. None of them did well for me and many finished up blocking my browser even though it was shown in the list as 'allow'.
Finally I went back to the one I use on my main machine. It's the one with no name. Well, it's a firewall Control called erm... 'Firewall Control' which is kind of stupid. But it's produced by Sphynx so I always rename its folder etc as that. Anyway, the Win10 version was okay but didn't let me stop all of M$oft. Also I had another problem I forget what. Then I had a brainwave: I installed the Win7 version! It works great. I totally block M$oft except for:
Background Task Host - which I've set for what Sphynx call WebBrowserZone
Host Process For Windows Services - set to Local+DNS+DHCP+Update(svchost)
System - set to LocalSystem.
The only other thing I've enabled is my Vivaldi web browser - Web+FTPZone.
I'm considering disabling some or all of the Windows ones but not sure. Would that affect my web browser? Thoughts?
BTW I don't need email or anything much else. So far, I've blocked things like Dropbox, Outlook, all HP stuff (much of which I'd alread uninstalled or disabled anyway.) The funniest one is Microsoft Windows Malicious Software Removal Tool because it sounds like a tool to remove some malicious software called Microsoft Windows (which in a way, it is! It's software. And it's malicious!)
Oh yeah, and of course, I turn off wifi except as needed. Still not sure what 'connect automatically' means though. Could/would M$oft simply turn on wifi when it wants? Ideally, I'd like some (reliable) desktop freeware that would feed in my password, connect, then reverse that when I disconnect, so nothing can connect without a password to my wifi router. Or can it? I mean, quite a few other services are listed. What's to stop M$oft setting up their own network. How could one stop it?