Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How can I setup windows 7 firewall so that it blocks ALL inbound and outbound traffic of all kinds, unless I am connected to a network that is designated in network options as public?

I'd like to block Home and Private. Thanks for any advice.

share|improve this question

2 Answers 2

The following worked when I tried it.

  1. Open the Start menu.
  2. In the search box, search for "Windows Firewall."
  3. In the search results, select "Windows Firewall with Advanced Security."
  4. In the "Overview" section, check to see which profile is active. By default, it should "Private Profile."
  5. Next, click on the link marked "Windows Firewall Properties."
  6. Select the tab labeled "Private Profile."
  7. Make sure that "Firewall State" is set to "On (recommended)."
  8. Under "Inbound Connections" click on the drop-down menu and select "Block all connections."
  9. Under "Outbound Connections" click on the drop-down menu and select "Block."
  10. Next to "Protected network connections," click the button marked "Customize."
  11. Make sure that all of the check boxes are marked, especially "Local Area Connection" and "Wireless Network Connection" (if present).
  12. Click the "OK" button. When that dialog closes, click the "OK" button on the next dialog.

Source

share|improve this answer
    
One might want to additionally try disabling the allow rules in outgoing, and anything in 'allow programs'. Though even then, it's worth bearing in mind that it stops a lot but not everything. Traffic still shows in wireshark so it doesn't block everything, though it seems there isn't anything one can do in the windows 7 firewall to totally block everything. It does block a lot though. Though some fundamental stuff is still sending and seeing packets as seen in wireshark. –  barlop May 8 at 21:52

On windows 7 Home Premium:

  • Start - Control Panel - Firewall - "Advanced Settings"
  • This will open up "Windows Firewall with Advanced Security" Window
  • Click on "Inbound Rules" and "New Rule"
  • Rule Type: Custom
  • Program: All Programs
  • Protocol and Ports: Any
  • Scope: Any IP Address (both local and remote)
  • Action: Block the connection
  • Profile: Domain and Private (Untick Public)
  • Name: Make a name for this rule

Click on Finish

And now you have an inbound Rule that blocks All Application from accessing any IP on any Port on Domain and Private (Home or Work or Private Networks)

And now you have to make exactly the same rule under "Outbound Rules"

Note (Credit to barlop): Although Windows Firewall does block a lot of things, it does not block ALL traffic. Barlop has added that WireShark still detects some traffic in and out of the system even when everything meant to be blocked using either method.

share|improve this answer
    
I haven't fully tested this but do you really need to make a rule for incoming, given that there is a 'block all' option in windows firewall properties for incoming? –  barlop May 8 at 8:15
    
and you should know that traffic still shows in wireshark, so it doesn't seem to block everything –  barlop May 8 at 21:50
    
Looks like I didn't notice the block all option.. so Ramhound's answer would probably more straightforward to do. Wireshark can see all incoming attempt to the machine, but there won't be any replies, or any outgoing. –  Darius May 8 at 23:06
    
dude, try wireshark with his method, and as with your method, you'll see that there are outgoing and incoming for some packets. I mentioned this on your post and his post. And if you don't believe me then try it. It blocks a lot, and so you see a lot less in wireshark than you would if more packets were allowed. But, it doesn't block all. –  barlop May 8 at 23:14
    
@barlop I haven't tried wireshark myself, but the question asked to block only Private and Home part of Network set up. The question still wants internet/intranet access if the network is set to "public" so I am assuming you will still see traffic. (Even if its just DHCP asking for IP address). If the question wants no network at all, perhaps physical disconnection is preferred, or a 3rd party firewall that can completely bar all connection (ZoneAlarm can do this when I used it ages ago) –  Darius May 8 at 23:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.