I am attempting to block all internet traffic except for chrome. I have found many articles outlining how to do this using windows firewall. I followed the instructions but it just blocks everything (chrome won't work). I set outgoing connections in all profiles to BLOCK. This blocks everything. Then I created an outgoing rule specifying my chrome executable. Eventhough this rule is created, it still blocks everything, I even confirmed this in my log. I'm not sure what I am missing. To be clear, I'm trying to setup a "Deny All except ...." configuration where all traffic (in or out) is blocked except for what is specified in rules.

  • That's how it works. When you block everything, then everything is blocked. Checking for rules is halted. – Ron Maupin Jan 24 '18 at 3:41
  • When I select "block", in the overview, it states "Outbound connections that do not match a rule are blocked" Are you saying this is not correct and windows firewall does not support blocking all except rules. This is how incoming rules are set by default. – eng3 Jan 24 '18 at 4:05
  • either way is fine. Both is better – eng3 Jan 24 '18 at 12:46

I played around with the settings and got it to work. By using the GUI to setup the rule, it creates the rule as "%USERPROFILE%\AppData\Local\Google\Chrome SxS\Application\chrome.exe" but if I create the rule with the absolute "c:\users .... path, it works. I did not have to do anything with the DNS however I did not do anything with the existing default outgoing rules so maybe its in there already

I guess there is a bug with the GUI


You're using the wrong tool; windows firewall has many, many flaws in how it handles things, including not having order of precedence based rules.

Try the Comodo firewall instead; that is a solid, free application based Windows software firewall with good GUI tools and defaults for configuring it, and should easily be able to do what you want.

  • It should still have the capability of being configured to do something so simple. Anyways, I tried your recommendation and installed "Comodo firewall". It is a very bloated software with a very rudimentary interface. It took a while just to figure out the configuration but I also could not configure a "deny all except...". Upon trying to uninstall, it tried to get me to install some other software. Then it gave me my first and only blue screen on this computer and left remnants of the software after the uninstall. – eng3 Jan 24 '18 at 4:44
  • Block all outgoing traffic:

    1. With Windows Firewall Control Panel: Open Control Panel > System and Security > Windows Firewall. Click on "Windows Firewall Properties". Set all the "Outbound connections" to "Block" (default is to allow). Do this for all profiles by selecting the tabs. The click "Apply" button below to apply that Firewall state.

    2. With Command Prompt: Run this command as administrator:

      netsh advfirewall set allprofiles firewallpolicy blockinbound,blockoutbound

  • Allow System and Chrome: The above setting blocks all connections including from System and DNS Host service. Allow System and Chrome with the following commands as administrator. Let the path of Chrome executable file is "E:\Chrome\chrome.exe". Replace that with your own.

    netsh advfirewall firewall add rule Name=System Program=System Action=allow Dir=Out
    netsh advfirewall firewall add rule Name=Chrome Program="E:\Chrome\chrome.exe" Action=allow Dir=Out
  • Delete DNS Cache service: As the above Firewall State block DNS service, applications can not send DNS request. So by deleting DNS cache service you allow all apps to send/receive DNS packets independently. First backup the registry "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Dnscache" from Registry Editor. Now delete the DNS Cache service with the following commands as administrator.

    sc.exe stop "Dnscache"
    sc.exe delete "Dnscache"
    reg.exe delete "HKLM\SYSTEM\CurrentControlSet\Services\Dnscache" /F

Now restart PC to effect the changes. See this Netsh AdvFirewall Firewall Commands for further readings.

  • if I completely delete the DNS cache service, how do I add it back? Is there a way to allow DNS as well? The main goal here is to control usage when I'm on a metered connection. – eng3 Jan 26 '18 at 0:14
  • Hence I said to backup that registry. Alternatively, you may backup full C drive. It's safe and secure, I've done that every time. This gives you to control which software you want to connect. – Biswapriyo Jan 26 '18 at 3:44
  • when I do 'sc.exe stop "Dnscache"' I get "ERROR: Unrecognized command" When i look in services, I dont see a "Dnscache". I am using windows 7. Alternatively, I don't mind just allowing DNS. Basically allowing chrome and whatever is needed to make chrome work, I just dont know the correct firewall rules to allow the windows components required – eng3 Jan 26 '18 at 13:04
  • Open services.msc see if any DnsClient service present. Does the reg command run properly? Try the command without quotes. Run this command to query that registry reg query HKLM\SYSTEM\CurrentControlSet\Services\Dnscache – Biswapriyo Jan 26 '18 at 13:10
  • Also run those commands without .exe words. I mean type reg not the reg.exe and type sc not sc.exe. – Biswapriyo Jan 26 '18 at 15:56

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.