How to block a program or an entire folder in Windows Firewall

To block a program in Windows Firewall, create an outbound rule that points to the program's .exe file and set the action to "Block the connection". Windows Firewall does not accept folders or wildcards in program rules, so blocking an entire folder means creating one rule per executable: by hand, with a short PowerShell loop, or with a free tool such as Folder Firewall Blocker.

This guide covers all three methods, explains why block rules always win over allow rules, and shows how to check and undo a firewall block on Windows 10 and Windows 11.

How does a firewall block work in Windows?

A firewall block in Windows is a rule that tells Windows Defender Firewall to drop network traffic that matches it, for example all traffic sent or received by one program. Microsoft's firewall handles the two directions differently, which matters when you want to cut a program off from the internet:

• Inbound: blocked by default. Traffic only gets in if an allow rule exists, which is why programs ask for permission the first time they listen for connections.
• Outbound: allowed by default. A program can connect to the internet unless a rule prohibits it, so stopping an app from "phoning home" needs an explicit outbound block rule.
• Precedence: according to Microsoft's firewall rules documentation, explicit block rules take precedence over any conflicting allow rules, and rules cannot be reordered by hand.

The important limitation: application rules use the full path of a single file. Microsoft states that wildcard patterns such as C:\*\app.exe are not supported in application rules. There is no "block this folder" checkbox, and that is the gap the methods below fill.

How to block a program in Windows Firewall

The built-in way to block one program is an outbound rule in Windows Defender Firewall with Advanced Security. You need administrator rights. The steps follow Microsoft's configuration guide:

1. Press Windows-R, type wf.msc and press Enter.
2. Select Outbound Rules in the left pane, then Action > New Rule.
3. Choose Custom as the rule type and click Next.
4. On the Program page, select This program path and browse to the program's .exe file.
5. Leave Protocols and Ports and Scope at their defaults to block all traffic, and click Next.
6. On the Action page, select Block the connection.
7. Pick the profiles (Domain, Private, Public); leave all three checked to block the program everywhere.
8. Give the rule a descriptive name, for example "Block Example app outbound", and click Finish.

Repeat the process under Inbound Rules if you also want to stop the program from accepting incoming connections. The rule takes effect immediately; there is no need to restart the program or Windows.

How to block an entire folder in Windows Firewall with PowerShell

PowerShell is the fastest built-in way to block every executable in a folder, because it can create one rule per file in a single command. The New-NetFirewallRule cmdlet takes the full path of one program per rule, so the command loops through the folder and passes each file to it. Open Windows Terminal or PowerShell as administrator and run (replace the path with your folder):

1. Set the folder: $folder = "C:\Tools\ExampleApp"
2. Create outbound block rules for every .exe, including subfolders: Get-ChildItem $folder -Recurse -Filter *.exe | ForEach-Object { New-NetFirewallRule -DisplayName "Folder block: $($_.Name)" -Direction Outbound -Program $_.FullName -Action Block }
3. Run the same command with -Direction Inbound if you want to block incoming connections too.

Every rule starts with "Folder block:", which makes them easy to find and remove later. The rules cover the files that exist when you run the command. An executable added to the folder later is not blocked until you run the loop again, and a rule stops matching if its file is moved or renamed, because rules are tied to the exact path.

Folder Firewall Blocker: block a folder with one click

Folder Firewall Blocker is a free, open source Windows program that creates Windows Firewall block rules for all executable files in a folder you select. Launch it, click Folder to pick a local folder, and click Block.

A confirmation prompt appears before the program writes any rules. Click Yes to add the rules to Windows Firewall, or No to cancel.

Version 1.2.1, the latest release listed by MajorGeeks, can include subfolders and covers many executable types beyond .exe, including com, bat, cmd, vbs, js, wsf, msi, scr, cpl, dll and sys files. An extra file types tab lets you add your own extensions.

Keep its limits in mind. The program dates from 2016 and has not been updated since; MajorGeeks lists support up to Windows 10. It also shares the PowerShell method's main weakness: it does not watch the folder, so files added later stay unblocked until you run it again. For a maintained alternative with a graphical interface, Sordum's Firewall App Blocker supports Windows 11 and includes a whitelist mode that blocks everything except the programs you allow.

Which method should you use?

The right method depends on how many files you need to block and whether you want to stay with built-in tools:

If a program keeps connecting despite a block, check that it is not running a helper executable from another folder (updaters often live elsewhere), and use a monitor such as Windows Firewall Notifier to see which process makes the connection.

How to check and remove a firewall block

You can review or undo any firewall block in the same console that created it. In wf.msc, open Outbound Rules (or Inbound Rules); blocked entries show a red circle icon. Right-click a rule and choose Disable Rule to pause it or Delete to remove it.

For rules created with the PowerShell loop, one command in an elevated PowerShell window removes them all at once: Remove-NetFirewallRule -DisplayName "Folder block:*". To list them first without deleting anything, run Get-NetFirewallRule -DisplayName "Folder block:*".

Windows Security offers a simpler view under Firewall & network protection > Allow an app through firewall, but that list manages allow entries. A block rule overrides an allowed app, so remove the block rule itself when a program should go online again.

FAQ

Related: Windows Update Blocker disables updates with one click, Security Task Manager review, enable the hidden Windows 11 administrator account