guide · static export
Security

Block an App's Internet Access With Windows Firewall

Some programs only need the network to phone home. Two outbound rules stop that without uninstalling anything - and one command proves it worked.

by@guidox updated:10/30/26 time:15 min level:Intermediate tested on:Windows 11 24H2 works on:Windows 10, Windows 11
TL;DR

Create a **block** rule for the executable under **Windows Defender Firewall > Advanced settings > Outbound Rules**, for all three profiles. Then test with **Test-NetConnection** before you trust it.

Before you start

Requirements

  • Admin rights
  • The full path of the executable
  • A minute to test the result
Step by step

Instructions

01

Find the real executable

Open Task Manager, right-click the running process and choose **Open file location**. Launchers and updaters are separate binaries, and blocking the launcher leaves the updater free.

tipAdd the updater separately if it runs as a scheduled task - otherwise it bypasses the block.
02

Open the outbound rules

Run **wf.msc**, select **Outbound Rules** and choose **New Rule > Program**. Inbound rules are irrelevant here; you want to stop what the app sends.

wf.msc
03

Point the rule at the file

Browse to the executable, choose **Block the connection** and tick **Domain**, **Private** and **Public**. Missing one profile is why blocks work at home and fail on a different network.

Program: <full path>.exe
Action: Block the connection
Profiles: Domain, Private, Public
⚠ warningName the rule after the program and add the date. Six unnamed block rules are impossible to audit later.
04

Test before you celebrate

Start the app and check that its online features fail while local features still work. A DNS lookup from PowerShell shows whether the block is in place for other tools.

Test-NetConnection example.com -Port 443
05

Handle the updater

Open **Task Scheduler** and check for update tasks belonging to the program. A blocked binary can still be replaced by the installer, so disable the update task as well.

06

Keep a list

Sort the outbound rules by name and prefix your own with a tag, for example **block-** . When an app misbehaves six months later you will not remember which rule did it.

Troubleshooting

Common issues

The app still reaches the internet

A second binary - the updater or a service - does the talking. Check the connections tab in Resource Monitor for the process ID.

The block breaks the app completely

Some apps refuse to start without a licence check. Allow the specific host instead of unblocking everything.

The rule disappears after an update

The installer re-registers the program path. A path-based rule survives if the file stays in place; a name-based rule does not.

Games disconnect from their launcher

The launcher is the blocked binary. Allow it and block only the telemetry executable.

FAQ

Frequently asked

Is a firewall rule better than uninstalling?

It is reversible and keeps the program. Uninstalling is cleaner when you do not need it at all.

Does this survive a Windows update?

Yes. Rules are stored in the registry and survive feature updates.

How to undo this

Delete the rule in **wf.msc > Outbound Rules**. The program regains network access immediately - no reboot needed.

Changelog · 1 entry
  1. 2026-10-30
    First version
Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress