26

Is it possible to auto block all applications incoming/outgoing internet connection except for example Firefox with default windows firewall?

I would like to block everything, even including windows update and other software updates.
I would like to allow only one web browser like firefox, chrome or opera.
How can I set up a config like this in windows Firewall? I see for blocking application but seems you need to add one by one and it is a tedious task.

What I wish to achieve is a "whitelisting" - meaning that I set up 1 rule on a firewall that says "block everything" (deny all any/any, where
"deny" = don't let anything through,
"all" = all types of traffic,
"any/any" = any source, any destination).

Then, I set up the "white list" - meaning the list of good destinations that I want to allow.
A list of applications that I'd like to grant network access to them. Only application in this list will be able to communicate.
Notice that whitelisting is different than blacklisting, in that whitelisting blocks everything and then allows a few things later. With that definition in mind, everything is automatically blocked and cannot be used.

I'd like there should be an option or button to makes it possible for me to edit, add or delete application in this list manually.


I'm not an expert, So please try to give a detailed answer as I don't know anything about ports and some other expressions that I came across when googleing this.
Thanks,

6
  • Duplicate question, everything from firewall, also you can make alerts there superuser.com/questions/599743/…
    – Narzan Q.
    Feb 25, 2017 at 12:27
  • 3
    No, my question is more pervasive and practical. Feb 25, 2017 at 13:02
  • This has now become an off-topic question, asking for product recommendations.
    – Arjan
    Jul 22, 2017 at 14:06
  • @Arjan: Thanks Arjan, My question about the applications that have the white-list technology, not compare and recommendation about them Jul 22, 2017 at 14:17
  • Very well, I've edited your question to remove the software recommendation part.
    – Arjan
    Jul 22, 2017 at 14:33

12 Answers 12

22

You do not need any 3rd party firewall software.

By default windows firewall functions as follows:

  • Inbound - Block all unless in the list (Whitelist)
  • Outbound - Allow all unless in the list (Blacklist)

You want to Block all Inbound and all Outbound connections by default.

You can do this using Windows built-in Firewall. The way to do this (though somewhat hidden away way) is to change the settings as follows in these 3 easy steps:

  1. Go to: Control Panel\System and Security\Windows Firewall

  2. There, right-click as shown in screen shot to get the properties:

    Firewall settings screenshot

  3. Change Outbound Connections to Block for each profile Now you can add only the programs you want to the list.

You can import/export rules by right clicking the same as in screenshot above and selecting Export Policy. It imports/exports the whole thing. So you can experiment, disabling rules and making your machine more secure. For example my settings are as follows (excluding my programs):

Inbound - there's not a single rule here!

Outbound - only "Core Networking - DNS (UDP-Out)" is enabled

If you're using OpenVPN you will also need to add two more Outbound rules:

Core Networking - Dynamic Host Configuration Protocol (DHCP-Out)
and a rule to allow openvpn.exe

2
  • 1
    Thanks for your help and replay. I appreciate you sincerely. Sep 8, 2017 at 14:08
  • I did this but adding whiteslist doesnt work? i added both cmd and ping.exe files to whitelist of outbound but i still cant ping?
    – OneAndOnly
    Mar 13, 2022 at 8:36
14

In an elevated shell window, do

Set all profiles to block inbound/outbound traffic:

netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound

Remove all rules:

netsh advfirewall firewall delete rule all

Allow basic outbound rules for ports 80,443,53,67,68

netsh advfirewall firewall add rule name="Core Networking (HTTP-Out)" dir=out action=allow protocol=TCP remoteport=80
netsh advfirewall firewall add rule name="Core Networking (HTTPS-Out)" dir=out action=allow protocol=TCP remoteport=443
netsh advfirewall firewall add rule name="Core Networking (DNS-Out)" dir=out action=allow protocol=UDP remoteport=53 program="%%systemroot%%\system32\svchost.exe" service="dnscache"
netsh advfirewall firewall add rule name="Core Networking (DHCP-Out)" dir=out action=allow protocol=UDP localport=68 remoteport=67 program="%%systemroot%%\system32\svchost.exe" service="dhcp"

And to reset firewall to default values

NETSH advfirewall reset

** All changes take effect immediately

2
  • Hope it was what you needed.
    – Hames
    Jul 26, 2017 at 17:28
  • I found this really helpful. I actually wanted to disable all rules, not delete them, which can be done with: netsh advfirewall firewall set rule all new enable=no
    – v25
    Aug 29, 2019 at 20:48
8
+50

Another very useful, powerful and of course free here:

TinyWall
TinyWall takes a different approach from traditional Firewalls. It does not display popups that "urge users to allow". In fact, it will not notify you of any blocked action at all.
Instead of showing popups, TinyWall makes it easy to whitelist or unblock applications by different means.
For example, you can just initiate whitelisting by a hotkey, then click on a window that you want to allow. Or, you can select an application from the list of running processes.

Of course, the traditional way of selecting an executable also works. This approach avoids popups, but still keeps the firewall very easy to use.

Most importantly, with the no-popup approach, the user will only notice that a program has been denied internet access when he can't use it anymore.
Consequently, users will only unblock applications that they actually need and none more, which is optimal from a security standpoint.

Feature overview

  • Multiple and easy ways to whitelist programs
  • Automatic learning mode
  • Firewall tampering protection
  • Password lockdown of settings
  • Quick modes, like Normal protection, Allow outgoing, Block all, Allow all and Learning mode
  • Support for temporary/timed firewall rules
  • Port and domain blocklists
  • Hosts file protection
  • Option to always allow communication within LAN
  • Option to restrict an application to the LAN
  • Recognition of safe software and impostors
  • Full IPv6 support
  • List established and blocked connections
  • View open ports on your machine
  • 100% free and clean software. No fees, no ads, no paid upgrades.

You can see the Thiny wall white-list in below image: enter image description here

1
  • question states with default firewall
    – Kevin
    Oct 26, 2018 at 1:55
5

Firewall App Blocker

Firewall App Blocker WhiteList Mode: It will block everything except on the white listed items, to activate it tick the “Enable WhiteList” box on the right bottom corner.
The whitelist mode denies access to all network interfaces, After enabling WhiteList Mode Drag and drop an Application/Applications on the “Firewall Application Blocker” interface to Allow it/them , It was the most wanted feature: Firewall App Blocker- White-list

4

If you want to use Komodo Internet Security (KIS) or Comodo Free Firewall (CFF):
Comodo firewall Whitelists help you by including all the items below, and nothing else is allowed into the system:

  • Websites
  • Networks
  • People/devices
  • Software Applications

White List creation Instruction:
You should block everything except DNS and web browsers, for doing this go to the Advanced settings -> firewall settings and enable "Do NOT show popup alerts" and change the dropdown to Block Requests. This will block anything that doesn't have a rule created for it.

Now to create the rules for your applications.
1- Go to add > browse > file groups > all applicatoins > use ruleset blocked application.

2- Next add another rule and click Browse > Running Processes > select svchost.exe then Use a custom ruleset > add block IP In or out then add another rule to allow UDP out destination port 53.

3- To allow your browser go to Advanced settings -> firewall settings -> applications rules then add whatever browser you want to allow access,
Add a new rule and give it the allow Web Browser or Allowed Application ruleset.

4- For windows update, I'm not exactly sure which processes need access to the internet so maybe someone else can give us some insight.
I think the main exe is under C:\Windows\System32\wuauclt.exe but it also uses svchost.exe.

The process will be the same for adding any other application you want to allow access for.

Important: Firewalls work in a hierarchical structure, so from TOP to BOTTOM manner, therefore rules to allow, must always be added BEFORE (higher) than the Block ALL rule!!

You can see finally Comodo Firewall configuration below:

Finally Comodo Firewall configuration

For Import/Export and Manage Personal Configurations

2
2

Evorim Free Firewall

You can use Evorim Free Firewall and put Evorim in "Paranoid Mode" to block everything except what you want to allow.

Paranoid Mode
Trust no one! In Paranoid mode, no software can access on the Internet or network, without your prior consent. Only applications which you trust get Internet access.

Evorim Paranoid Mode
Evorim Paranoid Mode white-list Settings

1
  • question states with default firewall
    – Kevin
    Oct 26, 2018 at 1:54
1

I investigated Windows Firewall and it appears its outgoing traffic filtering module is working in blacklist mode only. In other words, it checks the connection against all rules and if it finds no matching rule, it allows the connection.


While your question is about Windows Firewall only, perhaps you find it useful to know that there are third-party personal firewalls that can indeed operate in whitelist mode. Comodo Internet Security, ESET Internet Security and ZoneAlarm can be configured to operate in whitelist mode.

When I say configured, I mean you should change their default configuration. For example, in case of Comodo Internet Security, you must switch to the policy-based mode. Also, by default, Comodo Internet Security permits Windows Store apps to have internet access but you can revoke that too.

7
  • Thank's again for your help, are you using any third-party white-list firewall tools, Which of them do you recommend? Feb 26, 2017 at 7:19
  • 1
    I myself use Comodo at home and ESET at work. Of course, I use interactive whitelist mode; everytime an app wants to connect to the Internet, Comodo asks me what to do.
    – user477799
    Feb 26, 2017 at 7:27
  • Do you know Has Kaspersky internet security (KIS) such as this feature? Feb 26, 2017 at 7:31
  • KIS had such a feature, but I haven't worked with it since 2011.
    – user477799
    Feb 26, 2017 at 7:34
  • 3
    @MojtabaReyhani I normally don't mention this, but I think I should do so in your case: Comodo Internet Security is free.
    – user477799
    Feb 27, 2017 at 6:15
1

The problem with disabling all outbound connections is that Windows Firewall does not notify you when processes try to establish outbound connections. This means that you will have to check logs to find out about it, or use for better control the free Windows Firewall Control.

You may also use a third-party firewall product that allows better control such as Comodo Free Firewall.

To disable all outbound rules using Microsoft's firewall :

  1. Enter the applet Windows Firewall with Advanced Security
  2. Right-click Windows Firewall with Advanced Security on Local Computer
  3. Select Properties
  4. In the dialog that opens, select your profile : Domain, Private or Public.
  5. Set Outbound connections to Block and click OK image
  6. Click on Outbound Rules
  7. Select and disable the rules that you do not want to allow by clicking Disable rule. You may also type first Ctrl+A to select all rules, then after disabling them all, enable or add the allowed rules.
7
  • Thank you so much for your help and attention, but none of Comodo Free Firewall, ZoneAlarm Free Firewall, or Private firewall haven't any straightforward whitelist option like Tiny Wall. Jul 22, 2017 at 13:55
  • You could try Microsoft's firewall together with Windows Firewall Control..
    – harrymc
    Jul 22, 2017 at 14:06
  • That looks kinda different from what I remember, what version is it on?
    – Journeyman Geek
    Jul 22, 2017 at 14:59
  • @JourneymanGeek: Windows 10.
    – harrymc
    Jul 22, 2017 at 16:46
  • 1
    @MojtabaReyhani: For Comodo see this post.
    – harrymc
    Jul 22, 2017 at 18:23
1

SimpleWall

SimpleWall WhiteList

Description:

Simple tool to configure Windows Filtering Platform (WFP) which can configure network activity on your computer.

The lightweight application is less than a megabyte, and it is compatible with Windows Vista and higher operating systems.
For correct working, need administrator rights.

Features:

  • Free and open source
  • Simple interface without annoying pop ups
  • Rules editor (create your own rules)
  • Internal blocklist (block Windows spy / telemetry)
  • Dropped packets information with notification and logging to a file feature (win7+)
  • Allowed packets information with logging to a file feature (win8+)
  • Windows Subsystem for Linux (WSL) support (win10)
  • Windows Store support (win8+)
  • Windows services support
  • Localization support
  • IPv6 support

Website: www.henrypp.org

1
  • question states with default firewall
    – Kevin
    Oct 26, 2018 at 1:54
1

I use @Hames' answer which is excellent. On my Windows 7, I had to modify it a little bit to make it working (the %%systemroot%% was not working when copy/pasting in cmd.exe)

netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound
netsh advfirewall firewall delete rule all
netsh advfirewall firewall add rule name="Core Networking (DNS-Out)" dir=out action=allow protocol=UDP remoteport=53 program="c:\windows\system32\svchost.exe" service="dnscache"
netsh advfirewall firewall add rule name="Core Networking (DHCP-Out)" dir=out action=allow protocol=UDP localport=68 remoteport=67 program="c:\windows\system32\svchost.exe" service="dhcp"
netsh advfirewall firewall add rule name="Chrome" dir=out action=allow program="C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
netsh advfirewall firewall add rule name="Firefox" dir=out action=allow program="C:\Program Files\Mozilla Firefox\firefox.exe"

Also, unlike the linked answer, I don't allow ports 80/443 by default for all programs, but I whitelist them individually (e.g. Firefox, Chrome, etc.)

0

Blumentals Software Surfblocker

With Surfblocker you can easily restrict internet access at specified times or on demand.
You can allow and block websites and limit which programs and features have access to the internet. For example, you can allow only e-mail and and work or study related websites.
You can also simply password protect internet connection or set it to be automatically disabled after a specified amount of time. Of course, you can also block harmful and hazardous content automatically.

Allow only work-related stuff Allow work-related websites and programs while blocking everything else

To allow only specified services or programs such as e-mail

You can block the Internet access while allowing only specific internet services or programs. To do this, please follow these steps:

  1. Launch Surfblocker, enter your Surfblocker password (if requested).
  2. Check Block everything.
  3. Click Exceptions and under Allowed Services mark the services you would like to allow.
  4. Click Exceptions and under Allowed Programs add the programs you would like to allow.
1
  • question states with default firewall
    – Kevin
    Oct 26, 2018 at 1:54
0

Windows Firewall Control

Windows Firewall Control is a powerful tool which extends the functionality of Windows Firewall and provides new extra features which makes Windows Firewall better.
It runs in the system tray and allows the user to control the native firewall easily without having to waste time by navigating to the specific part of the firewall.

This is a tool to manage the native firewall from Windows 10, 8.1, 8, 7, Server 2016, Server 2012. Windows Firewall Control offers four filtering modes which can be switched with just a mouse click: High Filtering - All outbound and inbound connections are blocked. This profile blocks all attempts to connect to and from your computer.

Medium Filtering - Outbound connections that do not match a rule are blocked. Only the programs that you allow can initiate outbound connections.

Low Filtering - Outbound connections that do not match a rule are allowed. The user can block the programs he doesn't want to allow initiating outbound connections.

No Filtering - Windows Firewall is turned off. Avoid using this setting unless you have another firewall running on your computer.

Windows Firewall Control doesn't do any packet filtering and does not block or allow any connection. This is done by Windows Firewall itself based on the existing firewall rules.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .