How to block a program in Windows Firewall (Windows 11 and 10)

Applies to: Windows 11 and Windows 10, using the built-in Windows Defender Firewall. You need an administrator account to create firewall rules.

Block a program with Windows Firewall settings

The simple Allow an app through firewall list can’t do this job. Unticking an app there only removes permission for incoming connections, and Windows lets every program make outgoing connections by default. To stop a program going online you need an outbound block rule:

1. Press Win + R, type wf.msc and press Enter. You can also open Windows Security > Firewall & network protection > Advanced settings. Click Yes if User Account Control asks.
2. In the left pane, click Outbound Rules. In the right pane, click New Rule.
3. Choose Program and click Next.
4. Choose This program path, click Browse and select the program’s main .exe file, for example C:\Program Files\MyApp\myapp.exe. Click Next.
5. Choose Block the connection and click Next.
6. Leave Domain, Private and Public all ticked so the block applies on every network. Click Next.
7. Type a clear name such as Block MyApp outbound and click Finish.

The rule takes effect at once; you don’t need to restart. If you’re not sure where a program’s file is, right-click its shortcut, choose Properties and look at the Target box, or right-click it in Task Manager and choose Open file location.

Also block incoming connections

An outbound rule stops the program sending data, which is what most people want. If the program also listens for connections, such as a game server or a file-sharing tool, repeat the same steps under Inbound Rules so other devices can’t reach it either.

Block a program with PowerShell or netsh

To do the same from the command line, open PowerShell or Command Prompt as administrator and run one of these, changing the name and path to match your program:

New-NetFirewallRule -DisplayName "Block MyApp outbound" -Direction Outbound -Program "C:\Program Files\MyApp\myapp.exe" -Action Block

Or, in Command Prompt:

netsh advfirewall firewall add rule name="Block MyApp outbound" dir=out action=block program="C:\Program Files\MyApp\myapp.exe" enable=yes

Use -Direction Inbound or dir=in to add the matching inbound rule. Keep the quotes around the path, because most program folders contain spaces.

Check that the block works

Open the program and try something that needs the internet, such as checking for updates or signing in. It should report that it can’t connect. You can also look for your rule in Outbound Rules: an active block rule shows a red circle icon. In PowerShell, Get-NetFirewallRule -DisplayName "Block MyApp outbound" shows whether it’s enabled.

Unblock the program later

• In wf.msc, right-click the rule and choose Disable Rule to pause it, or Delete to remove it.
• In PowerShell: Remove-NetFirewallRule -DisplayName "Block MyApp outbound"
• In Command Prompt: netsh advfirewall firewall delete rule name="Block MyApp outbound"

If the program still connects

• It uses more than one .exe: many apps have a separate updater, helper or launcher. Look in the program’s folder, and in Task Manager while it runs, and add a rule for each file that goes online.
• You picked a shortcut or the wrong copy: the rule must point at the real .exe, not a .lnk shortcut. Apps that update themselves sometimes move to a new versioned folder, so check the path again after an update.
• It’s a Microsoft Store app: Store apps live in the protected WindowsApps folder and a program-path rule may not catch them. New-NetFirewallRule has a -Package option for packaged apps; see the Microsoft documentation below.
• Another security product manages the firewall: if Windows Security says another app is protecting your network, create the block rule in that product instead.
• The firewall is turned off: in Windows Security > Firewall & network protection, each network profile should say Firewall is on. If Windows Security itself won’t open, see Windows Security not opening in Windows 11.

If you’re blocking a program because you think it’s unwanted or harmful, blocking its network access is only a stopgap. Scan your PC for malware and remove it properly.

Related guides

• How to scan for malware on Windows
• Adware removal on Windows
• Windows Security not opening in Windows 11
• How to open Command Prompt as administrator
• How to enable and use Telnet in Windows

Official sources:

• Microsoft Learn: Manage Windows Firewall with the command line
• Microsoft Learn: New-NetFirewallRule

Frequently asked questions

Does blocking a program in the firewall stop it from running?

No. The program still opens and works offline; it just can’t send or receive network traffic. To stop it running, uninstall it or remove it from startup.

Do I need to block inbound and outbound?

To stop a program going online, outbound is enough. Add an inbound rule as well if you also want to stop other devices connecting to it.

Can I block a program on Windows 11 Home?

Yes. Windows Defender Firewall with Advanced Security and the PowerShell commands are included in every edition, Home included.