Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Block internet access to all programs except for whitelisted ones

I sometimes work outside and are using a 3G usb connection with quite a limited data allowance.

I want some fast and easy way to temporary block all incoming and outgoing traffic in windows firewall except for chrome to be sure that Dropbox or something else is not using up my data.

I've tried to set Windows Firewall Properties to "Block" which gives "Outgoing/Incoming connections that do not match a rule are blocked".

Problem: There are many allow-rules like Dropbox that would "override" the block. And I don't want to disable all rules and then enable them, since there are some that I want disabled even when I get to the office...

Any suggestions?


share|improve this question

marked as duplicate by Karan, CharlieRB, 8088, Not Kyle stop stalking me, Mokubai Jan 18 '13 at 23:09

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

Have you looked at something like ZoneAlarm Firewall? You can create and assign different profiles that would allow a manual switch based on your situation. – kobaltz Jul 17 '12 at 22:55

This is more a stub of answer since my test machine is currently not here so I can’t test it.

  • Define the 3G network as Public inside Network and Sharing Center
  • Set the Windows Firewall Properties (Advanced Settings) for Public Profile to Outbound connections to Block

At this time, no program that does not have a rule for the Public profile, will be allowed to send data.

Next step is to make sure that only rules concerning core networking functions and Google Chrome are allowed for the Public profile.

In order to change all existing rules, use the netsh advfirewall firewall (see Technet) command line utility and put these commands in a batch file.

  • Disable the public profile for all rules:
    • Netsh advfirewall firewall set rule name=all profile=public new profile=Domain,Private
  • Renable all rules from the Core Networking group (DNS requests etc.) again for the public profile
    • Netsh advfirewall firewall set rule group=”Core Networking” new profile=Domain,Private,Public
  • Renable the rule for Chrome for the public profile
    • your command here :)

Every time you would use the 3G stick, you simply run this batch. This will make sure that any new rule a program has created in the meantime will be disallowed and does not eat up your bandwidth.

Again, sorry for posting untested commands but my test machine should return the day after tomorrow, and then I could try to clean this up.

Reference: List all rules for the Public profile:

 netsh advfirewall firewall show rule name=all profile=public
share|improve this answer
Would it be possible to save the current settings for the public profile prior to disabling it for all rules (and restore it later)? – Daniel Gehriger Oct 30 '12 at 11:25
@DanielGehriger: try the netsh export/import commands. – mivk Mar 28 '14 at 11:08

Not the answer you're looking for? Browse other questions tagged or ask your own question.