Controlling which programs connect to the Internet is one of those tasks that many users neglect… until something goes wrong. Automatic updates that break features, apps with annoying ads, games that let your kids talk to strangers, or software that sends more account data than necessary. These are just a few examples of why it's important to master firewall rules for blocking applications.
The good news is that, both in Windows (for example, you can learn to Block programs in Windows 11) as in macOS and even Linux, you have several ways to authorize or block network traffic for each appWhether using the system's built-in firewalls, third-party security solutions (like ESET), web application firewalls (WAFs), or by manipulating iptables on GNU/Linux systems, we'll examine this carefully and in detail, using clear and practical language.
Why blocking apps in your firewall can save you a lot of trouble
A firewall acts as a filter that decides what traffic comes in and what traffic goes out of your team or network, following a set of rules that you or the system itself have defined. The typical comparison is that of border control: everything that enters and leaves is checked, and anything that doesn't meet the criteria is left out.
By blocking certain apps with the firewall, you can to prevent unauthorized connections, reduce the risk of malware, and limit the sending of information that you're not interested in sharing. Furthermore, you prevent certain programs from requesting data from external servers or downloading content that may be irrelevant or even dangerous.
In everyday life, this translates into very concrete things: Stop automatic updates that may break compatibility, and remove advertising embedded in some free apps. or prevent a program from connecting when you're on a public Wi-Fi network with questionable security. A whole host of annoyances and risks that you can tackle with a couple of well-defined rules.
If you have children at home, a firewall is also a powerful ally: You can block online traffic from certain gaming or social media platforms. to prevent them from interacting with strangers without supervision. It's not a complete parental control solution, but it is an important pillar of that protection.
In professional and educational environments, controlling apps through the firewall helps to prevent data leaks, reduce the attack surface, and limit the use of unauthorized toolsThe key is finding a balance: it's not about blocking everything, but about allowing only what you really need.
Block apps in Windows 10 and 11 with Windows Firewall
In Windows, the most direct method to control which programs access the Internet is to use Windows Defender Firewall with Advanced SecurityIt's not the most user-friendly interface in the world, but it allows for very fine control through inbound (incoming) and outbound (outgoing) rules.
To block internet access for a specific program In Windows 10 or 11, the typical procedure involves creating an outbound rule associated with the application's executable file. This way, even if the app attempts to connect, the firewall will block the traffic before it leaves the computer.
It is usual to work with the full path of the .exe file. Executable files are usually located in “C:\Program Files” or “C:\Program Files (x86)”followed by the application folder name and the main executable. Knowing this path or locating it with the file explorer is key to creating the rule correctly.
Once you've located the application, you can define a rule that Block the connection on all network profiles: Domain, Private, and PublicThis ensures that the app will not connect from your home Wi-Fi, a work network, or a public hotspot, unless you change that setting.
How to create an exit rule in Windows to block an app
The classic workflow for blocking an app with an outbound rule in Windows Firewall It's based on the "Advanced Security" console, where you can create, edit, and delete custom rules. Although it might seem confusing, once you do it a couple of times, it becomes quite automatic.
On this console, the “Outbound rules” control what your computer tries to send to the networkIf you block an app here, all outgoing traffic from it will be blocked. You can then review this list to remember what you've blocked and unblock it at any time.
When you configure the rule, you will see options to choose the rule type (in this case, "Program"), the path to the executable, the action to perform, and the network profiles where it applies. The key action is “Block the connection”which is what guarantees that the communication comes to nothing.
The final step is to give the rule a recognizable name. Using clear and consistent names will save you headaches when, after some time, you need to locate which rule is affecting a specific application in order to allow it again.
Temporarily blocking programs with Windows Firewall
There are times when you don't want to permanently block an application's internet accessbut only for a while: while you're doing a test, while you're using a specific network, or while you're in the classroom with students, for example.
The Windows firewall doesn't have a "pause" button for apps, but it does allow you to activate and deactivate individual rules with a right-clickIn practice, this works like a switch for that app: when the rule is on, the connection is cut off; when you turn it off, the program regains access to the network.
This technique has the advantage that You don't have to delete the rule or recreate it from scratch. When you want to resume blocking, simply switch between "Activate rule" and "Deactivate rule" depending on your needs.
If you work with several different applications and policies, it's a good idea to keep a small Internal documentation of which rules are temporary and which are permanentso as not to end up with a firewall full of forgotten rules that you no longer know if they still make sense.
Create a "whitelist" of allowed applications in Windows
In addition to blocking, the Windows firewall lets you define which programs have explicit permission to pass through the firewallThis is usually called a "whitelist" and is the ideal complement to the approach of blocking cases individually.
On the "Allow an app or feature through Windows Defender Firewall" screen, you will see a list of programs and services. By checking or unchecking the "Private" and "Public" boxes, you decide what type of network they can communicate on.Completely unchecking an app can also serve as a quick blocking method.
If the program you're interested in isn't on that list, you can use the option to "Allow another application" to manually add its executableAlthough the name suggests you'll allow it, once it's on the list, nothing prevents you from unchecking it to block it. It's somewhat counterintuitive, but that's how the interface is designed.
Note that Enabling an app on public networks means exposing it to potentially hostile environmentssuch as the Wi-Fi in a coffee shop or hotel. For services that handle sensitive data, it is much wiser to stick to trusted private networks.
Other ways to cut off internet access in Windows
If what you're looking for is a complete disconnection from connectivity, without so many nuances, Airplane mode remains the most powerful and fastest shortcutYou activate it from the Action Center and all connections (Wi-Fi, mobile data, etc.) are disconnected at once, so no app will be able to communicate with the outside world.
For cases where the Windows firewall falls short, there is a fairly broad ecosystem of third-party firewalls for WindowsMany of them are free. These tools typically offer more intuitive interfaces, wizard-based rules, and extra features such as real-time connection monitoring or pre-configured profiles.
It's worth remembering that a bad advanced configuration can be even worse than not touching anything: Creating, modifying, or deleting rules without fully understanding their effect can leave security holes or break critical applications.It's always best to proceed slowly, test things out, and, if possible, keep a backup of your settings.
Finally, if at any point things get complicated or you start noticing strange behavior, you can always resort to the option of restore the firewall to its default stateIt's a sort of "factory reset" button for the firewall, very useful when you don't know which change broke what.
Firewall rules in ESET products for Windows (Home and Small Office)
If you use a security suite like the one from ESET on Windows, you have a product's own integrated firewall This allows you to create specific rules to permit or block application communication. This filtering layer complements or replaces the native Windows firewall, depending on the configuration.
From the program's main window, you can access the Advanced settings by pressing the F5 keyInside, the relevant section is "Network access protection", where the "Firewall" section and the "Edit" button next to "Rules" are displayed.
There you'll find the list of existing rules and the option to “Add” to create a new ruleBy doing so, you define a descriptive name, select the action (allow, block, ask, etc.), indicate the affected application, and the traffic direction.
By expanding the “Application” field you will be able to Navigate through the system until you locate the executable of the app you want to control.In “Direction” you decide whether the rule applies to incoming connections, outgoing connections, or both, which offers considerable flexibility depending on your objective.
Once these parameters are configured, confirm with “OK” and then with the different “Accept” buttons. Save the changes and activate the rule.From that moment on, the ESET firewall will apply the chosen policy to all traffic generated by that application, integrating with the rest of the suite (threat detection, logging, etc.).
Windows Firewall: Network Profiles, Extra Settings, and Security
In addition to per-program rules, the Windows firewall lets you adjust how it behaves depending on the type of network you are connected to: domain (usually corporate environments), private (your home, your small office) or public (open or untrusted networks).
The main difference between marking a network as private or public is the level of exposure you accept: On private networks you usually allow other devices to see you and even connect to you., whereas on public networks you prefer to go as unnoticed as possible.
In each profile, you can enable or disable the firewall and adjust options such as “Block all incoming connections, including those from the allowed applications list”This box turns the profile into an extremely restrictive mode: anything that tries to enter is rejected, even if the app is marked as allowed.
There are also shortcuts to functions such as Allow specific applications through the firewall, run the network troubleshooter, configure blocking notifications, or enter "Advanced Settings" to tinker with entry, exit, and connection security rules.
If the setup becomes complicated or you suspect that something has changed without your consent, the system itself offers an option to reset firewalls to their default valuesThis clears custom rules and reverts to the factory settings or policies dictated by your organization, if you are in a managed environment.
Rules in WAF (Web Application Firewall) and their role in protecting online services
When we talk about applications that live on the Internet (web pages, APIs, SaaS services…), another key piece comes into play: the WAF or Web Application FirewallUnlike a system firewall, a WAF focuses on inspecting HTTP/HTTPS requests directed to a web application and deciding what to do with them.
The rules of a WAF describe What should the system look at in each request (headers, parameters, body, IP address, route, etc.), what conditions to activate, and what action to take? when that combination is met. Several rules, organized and prioritized, make up what is called a “security policy”.
Because web apps are constantly changing and New threats appear every dayWAF policies cannot be static. It is necessary to continuously update and refine this set of rules to cover new routes, parameters, services, and attack vectors.
WAF providers typically include predefined “ready-to-use” rule setsBased on signatures of known attacks, malicious IP lists, injection patterns, etc. The more complete and up-to-date this initial set is, the better the level of protection the starting product offers.
In advanced solutions, these rules are fed by global threat intelligence (malicious IP feeds, honeypots, deception networks, machine learning) that detects suspicious behavior in real time and automatically adjusts security policy to keep up with attackers.
Metadata, conditions, actions, and priority in WAF rules
The design of a WAF rule typically includes several blocks: metadata, conditions and actionUnderstanding this scheme helps to build cleaner and easier-to-maintain rules.
In the metadata you define a clear name, a description, and the rule's status (activated or deactivated)This information is also recorded in security events so that when something is triggered, you quickly know which rule has been applied and why.
The conditions represent the "if this happens...". Multiple conditions can be configured per ruleFor example: if the path is /login, the method is POST, the parameter “user” contains suspicious characters, and the IP address is within a specific range. Only when all of these conditions are met does the rule come into play.
The action is the "do this other thing". Depending on the type of rule, you can block the request, allow it, redirect it, modify headers, limit the traffic rate, count attempts, or apply extra controlsEach family of actions is often grouped into different types of rules (redirection, security, rewriting, rate limiting, etc.).
At the execution level, WAFs typically establish a order of priority among rule typesFor example, first process redirection rules, then security rules, then rewrite rules… and within each group, assign an internal priority to the rules. This way, you control which rules take precedence when several could apply to the same request.
Predefined rules, custom rules, and positive/negative security models
Vendors like Radware organize their WAF policies by combining predefined rules (maintained automatically by the manufacturer) with custom rules (defined by the customer), to fine-tune the behavior in very specific environments.
Predefined rules can be generated from machine learning algorithms, massive analysis of traffic data, and feeds from active attackersThis allows the protection to be adapted to new vulnerabilities and attack patterns without the administrator having to spend all day tweaking the configuration.
Custom rules, on the other hand, are those that you create yourself for adjust the WAF to the specific logic of your application: protect certain routes, apply quotas to API endpoints, block specific countries, control response delivery, manage bots, etc.
A good WAF policy combines negative security model (defining what is prohibited) and positive security model (defining what is permitted)With the negative approach, you rely on lists of signatures and patterns that you know are malicious. With the positive approach, you define what type of input is valid for each parameter and block anything that falls outside those ranges, which is crucial for stopping zero-day attacks.
Working solely with positive or negative rules can become very costly and error-prone if done manually. That's why modern WAFs incorporate automation and automatic policy generation, which observe legitimate transactions, profile normal traffic and propose “permission” rules based on that behavior.
Automatic generation and continuous optimization of WAF policies
To minimize manual labor and the risk of creating safety gaps, many WAFs implement automatic policy generation mechanisms using machine learningThe system observes how legitimate traffic behaves, what values the parameters usually have, what routes are used and how, and from there suggests or creates rules that describe that pattern as acceptable.
This approach allows adjust positive safety profiles without relying so heavily on the human eyeminimizing configuration errors that could leave an application exposed or, conversely, excessively block good users.
At the same time, it is essential that the WAF conducts periodic reviews. activity logs and generate continuous optimization proposalsThe idea is to maintain a high level of security while reducing false positives so that protection does not interfere with normal traffic.
The combination of machine learning, log review, and external threat intelligence allows the WAF evolves in tandem with your application and the ecosystem of attacks that surrounds it.without forcing you to redo the policy from scratch every few months.
Blocking apps in Linux: iptables, user groups, and destination filters
In Linux systems, the approach is different: There is no universal graphical panel, but there is a powerful packet filtering subsystem based on iptables or nftables.Depending on the distribution and version, you can block traffic globally, by user, by group, or by destination address.
A first idea for blocking a specific program could be cut off access to the addresses or domains you useTo discover these destinations you have several options: use netstat (or ss) while the app is connecting, or monitor DNS requests with services like dnsmasq run in verbose mode.
Once the domains have been identified, you can redirect them to your own machine by adding entries of the type “127.0.0.1 domain_to_block” in /etc/hostsThus, any attempt to resolve that domain will remain local and the app will not be able to contact the real server.
If you prefer to work directly with IPs, you can also create iptables rules like “iptables -I OUTPUT -s ip_a_block -j DROP”These rules discard all outgoing traffic to that address. To ensure they survive reboots, it's common practice to include them in boot scripts like /etc/rc.local (before the "exit 0" line), or to use rule saving/restoration systems.
The drawback of this approach is that The blockage affects the entire systemAny application that wants to communicate with those domains or IPs will be affected, not just the one you're interested in. Furthermore, those addresses may belong to shared services that you do need in other contexts.
Filtering by user group in Linux to block only certain apps
A finer alternative is to lean on the Linux user permissions and groups systemThe idea is to create a special group for "filtered" processes and tell iptables to block all traffic coming from processes running with that group.
The typical flow would be something like this: first You create a new group (for example, “filtered”) with groupaddThen you add the users you want to control (for example, "student") to the group with adduser, so that those users also belong to that group.
Next, you define the iptables rule, for example “iptables -A OUTPUT -m owner –gid-owner filtered -j REJECT”This tells the system that any output packet generated by a process whose effective group is "filtered" should be rejected.
To launch a program under that specific group, you can use the command “sg filtered «programname»”This changes the primary group of the process to "filtered" during execution. From that point on, iptables restrictions apply only to those processes, without affecting the rest of the system.
This approach allows design different groups with different levels of accessThis allows some apps to send traffic only to certain destinations or protocols, while others are completely blocked. This is especially useful in educational or shared environments, where multiple users share a machine and you need to restrict traffic to only certain tools.
When you combine this technique with domain and port filtering, You can build very precise policies for each usage context, although at the cost of greater administrative complexity and the need to thoroughly test each change.
