How to block programs in Windows Defender Firewall

Most programs and apps depend on having a connection to the internet but sometimes we may want to block them from accessing the wider world. If that happens, we need to manually block them with a firewall to stop them calling home or connecting altogether. If you’re using Windows, here’s how to block programs in Windows Defender Firewall.

Windows Defender Firewall is built into Windows 10 and is now a competent firewall for protecting your computer. It still isn’t as good as many third party firewalls but is gradually improving. If you’re the average home user who uses a router with NAT, you should have protection enough. If your router also has a built-in firewall, that’s even more protection.

If you connect to mobile hotspots or work on the road, you’re going to need to pack your own protection. That’s where Windows Defender Firewall comes in. It is built into Windows 10, is enabled by default and works credibly well to protect your computer. I would still suggest a third-party firewall over the built in version but if that’s all you want or all you have, that’s fine too.

Program blocking with Windows Defender Firewall

The main interface for Windows Defender Firewall doesn’t have all of the advanced tools you need to block programs. Instead, type ‘firewall’ into the Windows Search Box and bring up the Control Panel version. Select Advanced Settings on the left and you should see a popup window called Windows Defender Firewall with Advanced Security. It is from here that we block programs.

Block outgoing traffic with Windows Defender Firewall

To block programs reaching out from your computer, we build an outbound rule within Windows Defender Firewall. Here’s how:

Open Windows Defender Firewall with Advanced Security as above.
Select Outbound Rules from the left pane.
Select New Rule from the pane on the right.
Select Program and This Program Path.
Select Browse and select the executable of the program you want to block.
Change if you see %USERPROFILE% to the absolute path of the executable and select Next.
Select Block the connection and check Private and Public network profiles that apply then hit Finish.

Your rule is now in place and should block traffic from that program from now on.

At Step 6, Windows will often populate the path to the executable with environmental variables. Depending on the program, you may see the patch change from C:\PROGRAM to %USERPROFILE%\Program. You will need to change this back to C:\PROGRAM for the rule to work properly.

Also make sure that you choose the right executable. Some programs use multiple files to access the internet or use both the 32-bit and 64-bit executable. Make sure to block them all using a separate rule for each.

Block incoming program traffic with Windows Defender Firewall

To block incoming traffic to a program, we create an inbound rule in Windows Defender Firewall. The process is very similar to blocking outgoing traffic.

Open Windows Defender Firewall with Advanced Security.
Select Inbound Rules from the left.
Select New Rule from the pane from the right.
Select Program and This Program Path.
Select Browse and select the executable of the program or type in the absolute path.
Select Block the connection and check all the network profiles that apply then hit Finish.

As with outbound rules, change where you see %USERPROFILE% to the absolute path of the executable if you need to.

Network profiles

Blocking programs in Windows Defender Firewall require you to specify network profiles. You will see Domain, Private and Public, but what do they mean? Domain is for computers that are part of a domain that uses Active Directory. That will be work or college as not many home users both with domains.

Private networks is for home where your network is secure and you trust other computers on it. Public networks are for hotspots, cafes and other places where you don’t know what else could be on the network.

If you use your computer only at home, selecting just Private network for the profile will be fine. If you take your computer to school, college, the coffee shop or on the road, selecting Public is essential. If you use your computer in both situations, just select both profiles. Only select Domain if you connect to a company network.

It is relatively straightforward to block programs in Windows Defender Firewall. While still not as good as other programs, it does get the job done. Know of any other ways to do it without installing a third party firewall? Tell us about it below if you do!