Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For privacy and performance reasons, I'd like to prevent my computer from ever communicating with certain Internet hosts. I'd like to do this at the OS level, not through web browser plug-ins (not broad enough), or even through my home router (my laptop travels). I'd prefer to use built-in tools.

I'm running Windows 7 Professional 64-bit. I'm all too familiar with the Windows hosts file - and its limitations. There seems to be some confusion over whether hosts supports wildcards, but my own tests confirm that it does not.

I have experimented with Windows Firewall and the IP Security Policy MMC snap-in. So far as I can tell, both require numeric addresses. I don't want to block specific IP addresses, or ranges of addresses, in part because IP-address-to-hostname mappings can and do change.

Is there any tool in Windows 7 Professional with which I can block (or route to communication with Internet hosts by hostname mask? If not, are there any good, free, third-party tools?

share|improve this question
Wildcard based blocking using hosts is not possible - have a look at Using wildcards in names in Windows hosts file – Sathya Aug 30 '10 at 0:21
He knows, he's looking for an alternative solution that does support wildcard. – Tom Wijsman Aug 30 '10 at 0:24
I was going to say resolv.conf may help, but you're running Windows... – digitxp Aug 30 '10 at 1:04
up vote 2 down vote accepted

The "easiest" way to do this would be to run your own DNS server and add primary zones for the domain(s) you want to block. You wouldn't even need to create 'A' records. any references to hosts within the zone (domain) would be returned unresolved by your DNS server. Posadis is one freeware/open source DNS available that runs under Windows (though I have not used is personally). Of course, if you have just about any version of Windows Server running anywhere, you can use Microsoft's DNS server.

One side "benefit" of this solution is that you could (if you wanted to) redirect requests to the "banned" domains to an internal "not allowed" web page.

share|improve this answer
You sure it's the easiest way? – zneak Aug 30 '10 at 3:01
Hmm, run my own DNS server. Hadn't thought about that. BIND now runs under Windows and there are a number of ugly but functional web-based GUIs. I bet BIND is every bit as fun to configure as Gentoo Linux is to compile from source. I will have to consider how desperate I am. – Metaphile Aug 30 '10 at 18:12
You'll find easy-to-follow instructions in this article: – BillP3rd Aug 30 '10 at 20:57

Try an IP blocker

There are many other IP blockers available, most allow you to make your own block lists and allow for ip ranges

Some do not work with W7 very well, do your homework.

share|improve this answer
I've searched for solutions via Google and not had much luck. That's why I'm here. ProtoWall appears to operate on IP addresses, which is specifically not what I'm looking for. I could achieve the same effect, and probably more ... effectively, via Windows Firewall. – Metaphile Aug 30 '10 at 17:52

Taking over the DNS resolver functions is a good solution. You may want to sign up for an account at OpenDNS and hard code the DNS server settings in Windows to use OpenDNS as your resolver. They allow you to enter domains that will always be blocked. Sign up is free but a small fee gets you extra features.

share|improve this answer
Kevin M also suggested OpenDNS. I asked him, Will my OpenDNS configuration follow me around from network to network? How does it identify my computer? Via MAC address? Or is there a client I have to install? – Metaphile Aug 30 '10 at 17:56

Use OpenDNS. They can do category filtering('Nudity', 'Pornography', 'Gambling', 'Adware', etc) in addition to individual domains. Downside is that it requires a little extra setup on the server side for dynamic updates, but it is documented here.

share|improve this answer
Will my OpenDNS configuration follow me around from network to network? How does it identify my computer? Via MAC address? Or is there a client I have to install? – Metaphile Aug 30 '10 at 17:34
You have to install a client. – digitxp Aug 31 '10 at 12:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .