6

The current situation:

I disabled network connectivity to a particular IP on my Windows computer. In other words, if my system tries to connect over the internet to that specific IP address, it will not be able to do so.

I disabled the connectivity as mentioned above, by following the steps described in the following post: How can I disable network connectivity to a particular port or IP address in Windows?
which describes making an outbound rule to block a remote ip

My Goal:

I would like to allow one single program on my Windows to use that IP and connect to the internet through it (right now that program, like all programs, cannot access internet through that IP, due to the above-mentioned outbound rule).

In other words, my goal is to create an exception to the above mentioned outbound rule, that will allow that specific program to access the Internet through that IP. The outbound rule should apply to all programs and services, except one.

How can I configure things to work this way? Could you please help me?

1
  • Have you tried just making a normal exception rule for the application you want to have said exception? May 1, 2013 at 18:06

3 Answers 3

11

According to the Windows Firewall documentation, block rules always take precedence over allow rules, therefore even if your allow rule looks more specific than a block rule, the allow rule will not work, and the traffic matching both allow and block rules will be blocked. The option “Allow this firewall rule to override block rules” is available only for rules which require IPSec, and is not available for outbound rules.

The only thing you could do with Windows Firewall to achieve something close to what you need is to switch the default behavior for outbound connections to “Block”, then add explicit allow rules for all outbound connections that you need (not just for that single program). Alternatively, you can look for third-party firewall software with more features.

3
  • +1 good idea.. I suppose he could(as you suggest), set the outbound policy to block, then allow all the internet except that IP(however many rules that'd be?) then have the rule to let that program use that IP.
    – barlop
    Sep 24, 2014 at 18:20
  • So in summary it is not possible. I didn't get the concept to allow outbound connections that can solve the OP issue. He needs to allow a single program. Can you explain how to set the outbound rule for that?
    – Jus12
    Aug 13, 2015 at 5:57
  • It is possible, see superuser.com/a/268909/109468 and superuser.com/a/748925/109468 Sep 23, 2015 at 7:29
6

If you want to allow only one address for any program, e.g. 10.10.10.10, you can make 2 rules: One for block addresses 1.1.1.1 - 10.10.10.9 and an another for block 10.10.10.11 - 255.255.255.255. For me this works.

4
  • 3
    Welcome to Super User! Please read the question again carefully. Your answer does not answer the original question, which is to allow access for a single program not any program.
    – DavidPostill
    Mar 15, 2015 at 22:01
  • 1
    even though this did not address the question, it helped with my case May 5, 2016 at 19:52
  • Ugh, I wish the firewall would check allow rules first before checking block rules.
    – jjxtra
    Jul 25, 2018 at 22:11
  • you can obtain the same result using only one rule and adding to its scope the two ranges
    – Redoman
    Aug 12, 2021 at 14:37
2

the answer from Sergey Vlasov is still correct you can make the above rule for a single program as well, simply set the rule for a program not all programs.

so you set up 2 or more rules (depending on how many ip addresses you want to allow) and block all others. so for example if you only want to allow

10.10.10.10

and

20.20.20.20

you set up rules:

block from 0.0.0.0 to 10.10.10.9 and 10.10.10.11 to 20.20.20.19 and 20.20.20.21 to 255.255.255.255

and you voila ...

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.