1

Is it possible for me to block traffic to and from sources and destinations outside my local computer using Windows Firewall for certain programs? As I understand, I may have to use subnets/subnet masks - I'm not sure I understand how they work as I tried to use 127.0.0.0/8 as a mask to allow but it seemed to allow all traffic through the firewall when I set it.

netsh advfirewall firewall add rule name="Blocked: %%a" dir=out program="%%a" action=block
netsh advfirewall firewall add rule name="Blocked: %%a" dir=in program="%%a" action=block

I had been using the above two commands to block all traffic, but I need to allow these programs to communicate within the local machine.

Any help would be much appreciated :)

1 Answer 1

0

I've since discovered how to accomplish this! :)

The trick is to not use the old, Command Prompt "netsh advfirewall firewall" interface but to instead use the modern, PowerShell interface.

New-NetFirewallRule -DisplayName "Blocked: $file" -Direction Outbound -RemoteAddress Internet -Program "$file" -Action Block

The above command blocks the file stored in the "$file" variable. In my use case I had this:

$fileNames = Get-ChildItem -Path $scriptPath -Recurse -Include *.exe

foreach ($file in $fileNames) {
    New-NetFirewallRule -DisplayName "Blocked: $file" -Direction Outbound -RemoteAddress Internet -Program "$file" -Action Block
    New-NetFirewallRule -DisplayName "Blocked: $file" -Direction Inbound -RemoteAddress Internet -Program "$file" -Action Block
}

The above PowerShell script blocks all internet traffic to and from *.exe files within a certain directory - recursively!

The real key here is the use of New-NetFirewallRule's -RemoteAddress macro, "Internet" which automatically selects packets to/from the internet.

More information here: https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=win10-ps

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .