I need to set some rules to block network traffic, both IPv4 and IPv6. The routes should be a blackhole or unrecheable depending on the case. In Linux and MacOSX seems simple, there are specific keywords/flags when adding a route ("blackhole", "unreachable" in linux, and the flag "B" or "R" in MacOSX). My problem is Windows.

I found a solution for Blackhole, that you can see here for example, just to mention one website. Basically sending the traffic to the loopback interface. That is for IPv4. For IPv6 I use a similar trick, using the loopback interface, but pointing to 0100::1, a discard prefix, citing:

"0100::/64 as a Discard-Only Prefix in the "Internet Protocol Version 6 Address Space""

Then, my questions are:

  • are the solution I have written the "standar way"? is there a better way to achieve this?
  • how can I achieve a "unreachable" route in Windows and not a "blackhole"?
  • [WRONG, see edit] I could also use the firewall, that sometimes I read is the best solution in Windows. For example, I can put a filter with a FWP_ACTION_BLOCK action, see FWPM_ACTION0 structure. But this roule will act as blackhole? or as unreachable?

Thanks everyone.


It seems a firewall rule is the wrong solution. I tested that while using a route to 0100::1 through the loopback interface, if a try to ping using IPv6, I get a General failure error, while doing it using a blocking firewall rule, I get a timeout (that is exactly what I do NOT want). But I am still not able to get a Route Unreachable error as in MacOSX and Linux...

  • What's the difference for you between a blackhole and a unreachable route? You could just drop the traffic you don't want.
    – Seth
    Feb 20, 2019 at 11:59
  • The unreachable route will send back a message specifying that the route is unreachable. Blackhole route just does not say anything. With the blackhole route, the sender could be blocked waiting till a timeout expires, with the unreachable the sender knows that the route is not good and does not wait.
    – n3mo
    Feb 20, 2019 at 12:50
  • So you want to send the proper ICMP messages. By just setting a rule to block that should be happening. It would generate an unreachable message unless you block ICMP as well.
    – Seth
    Feb 20, 2019 at 12:57
  • by "setting a rule to block" you mean a rule in the firewall returning the FWP_ACTION_BLOCK action?
    – n3mo
    Feb 20, 2019 at 12:59
  • 1
    ah ok, I understand your doubt now. I did not specified it in the question, sorry :) Yes, I already have a C++ application, indeed this rule should be added automatically by it.
    – n3mo
    Feb 20, 2019 at 15:15

1 Answer 1


You can do what you want using an unallocated local IP address ( in the example). Note that in both cases you run the commands from cmd. Let's assume you want to null-route

For Windows XP, Server 2003

route add mask metric 1 -p

Windows 7, Server 2008

route add mask if 1 -p

The route can be removed if needed with route delete command.

  • Hi @Overmind, thanks for your answer, but my question is a bit more specific: what does that route look like? as a blackhole route or as an unreachable route? I suppose this is a blackhole, then how can I achieve a unreachable?
    – n3mo
    Feb 25, 2019 at 9:33
  • It's basically the same thing. The unreachable response depends on your configuration. For example on CISCO equipment if you null /BH a route, you will get unreachable response and if you don't want that response you must manually add "no ip unreachables" in your configuration, just like in BSD you use -reject instead of -blackhole.
    – Overmind
    Feb 25, 2019 at 10:41
  • Understand, but how can I modify this behaviour (blackhole/unreachable) in Windows? Is there some sort of flag? I am open to netsh solution or to program API solutiaon as well...
    – n3mo
    Feb 25, 2019 at 10:43
  • They asked for IPv4 and IPv6. Sep 12 at 2:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .