Allow or Block an App Through Windows Firewall (11 and 10)

To allow an app: open Control Panel, go to Windows Defender Firewall, click Allow an app or feature through Windows Defender Firewall, click Change settings, and check the box next to your app.

To block an app from the internet, that screen will not do it. Press Windows+R, type wf.msc, go to Outbound Rules, and create a new rule that blocks the program.

Here is why, and it is the thing almost every guide on this topic gets wrong. Unchecking a box in the "Allow an app" list does not block that app from the internet. That list only governs incoming connections. Windows Firewall allows all outgoing traffic by default unless a rule specifically forbids it.

So the app you carefully unchecked last week is still talking to the internet right now. It was never blocked. It just lost permission to receive connections it probably never wanted anyway.

Blocking is a different screen, a different rule, and a different direction — and once you see the inbound-versus-outbound split, the whole tool stops being confusing.

The App Jake's Customer Thought He Had Blocked

A customer came into Jake's shop annoyed about a video editor he had bought once and did not want subscribing him to anything. He had read a guide, found the app in the firewall's allowed list, unchecked it, and felt sensible about it.

Two weeks later the app was still checking in, still showing him upgrade offers, still very obviously online. He had come in convinced the software was malicious — that it was somehow defeating Windows Firewall on purpose.

Jake, to his credit, did not guess. He opened wf.msc, looked at the outbound rules, and found what he expected to find: nothing. No rule mentioned the app at all. The customer had not blocked anything. He had removed a permission for incoming connections that the app had never used.

Ethan's summary, when Jake described it: "He did the equivalent of locking his front door to stop his kids going out."

That is precisely the shape of it. The lock was real, the door was real, and it faced the wrong way. Ten minutes of the right screen and the app went quiet permanently — and the customer left understanding his own computer better than when he came in, which Jake says is the part of the job he actually likes.

What That Checkbox Really Controls

Windows Firewall has two independent halves, and nearly all the confusion on this topic comes from people meeting one half and assuming it is the whole thing.

	Inbound	Outbound
What it means	Something outside starts a connection to your PC	Your PC starts a connection to something outside
Windows default	Blocked unless a rule allows it	Allowed unless a rule blocks it
So a rule here is for	Letting something in — a game server, file sharing, remote desktop	Stopping something going out — the reason you are on this page
The "Allow an app" list	This is what it edits	It does not touch this at all

Read the second row twice. The two directions have opposite defaults, and that asymmetry is the whole explanation. Because outbound is allowed by default, unchecking an app removes a permission that was only ever about incoming traffic. Nothing about the app's ability to reach the internet changes, because that ability never came from the checkbox.

It is a sensible design, incidentally, even if the wording hides it. A firewall that blocked outbound traffic by default would ask you about every program on the machine before it could do anything, and people would click Allow on all of it within a day. Microsoft chose the setting most people can live with, and then put the strict half behind a second console.

Once that clicks, the rest of this page is mechanical. Allowing is one screen. Blocking is another. You just need to know which one you are actually looking for.

Allowing an App, Properly

Use this when something needs to receive connections: multiplayer game hosting, local file sharing, a media server, remote desktop, a printer utility that is not being found.

1. Press Windows+R, type control, press Enter. Open System and Security, then Windows Defender Firewall.
2. On the left, click Allow an app or feature through Windows Defender Firewall.
3. Click Change settings at the top. Until you do, every checkbox on the page is grayed out — this is the step people miss and conclude the screen is broken. It needs administrator rights.
4. Find your app and check its box. Then choose the network types: Private for your home or office network, Public for wifi you do not control.
5. Not in the list? Click Allow another app, then Browse, and select the program's .exe file.
6. Click OK. It applies immediately.

On the Private and Public choice, the honest advice is to check Private only unless you have a specific reason otherwise. Public covers exactly the networks where you do not know who else is connected, and an app listening for incoming connections on cafe wifi is a real if small risk. If something genuinely needs to work in both places, check both — just make it a decision rather than a reflex.

Blocking an App From the Internet

This is the one people actually come looking for. It lives in a different console, and despite the intimidating name it is a five-click job.

1. Press Windows+R, type wf.msc, press Enter. This is Windows Defender Firewall with Advanced Security, and it is present on Home as well as Pro.
2. In the left pane click Outbound Rules. In the right pane click New Rule.
3. Choose Program, then Next. Choose This program path, then Browse, and select the application's .exe.
4. Choose Block the connection, then Next.
5. Leave Domain, Private and Public all checked, then Next. Unchecking one here is how people end up with a rule that stops working when they move to another network.
6. Give it a name you will still recognize in six months. "Block Acme Editor outbound" beats "Rule 1". Click Finish.

The block is live immediately — no restart, no sign-out. If the app is running, close and reopen it to see the effect.

The step that decides whether this works is step 3, and it is worth slowing down for. You must point the rule at the file that actually makes the connections, which is frequently not the icon you click. Game launchers start a separate game executable. Many apps update through a helper with its own name. To find the truth, run the app, open Task Manager, switch to the Details tab, right-click the process and choose Open file location. That path is the one your rule needs.

Why a Rule Works at Home and Not at the Airport

Windows Firewall is really three firewalls with one interface. Which one is in charge depends on how Windows has classified the network you are on, and rules apply per profile.

Profile	When it applies	What to know
Domain	The PC can reach a workplace domain controller	Chosen automatically. On a work laptop your rules may be overridden by policy.
Private	A network you marked as home or work	More permissive. Discovery and sharing are expected to work here.
Public	Everything else, and the default for a new network	Strictest, and correctly so. Your PC stays invisible to other devices.

The practical consequence is the one that wastes afternoons. A block rule with only Private checked stops applying the second you join cafe wifi, because Windows switches to Public and your rule is not part of that profile. The app you blocked is online again, and nothing on screen tells you why.

So unless you are doing something deliberately clever, check all three when you create a rule. To see which profile is active right now, open Settings, go to Network & internet, click your connection, and read whether it says Public or Private. Our guide on how to check firewall status in Windows covers reading all three profiles at once, which is the faster way when something is behaving oddly.

Block Always Beats Allow

When traffic matches more than one rule, Windows does not use the newest, the most specific, or the one nearest the top of the list. It evaluates block rules first. If any active block rule matches, the traffic is blocked, and no allow rule anywhere will change that.

This single fact resolves most "my rule does nothing" situations, and it is worth checking before anything else. If you have carefully allowed an app and it still cannot connect, you are not looking for a reason your allow rule failed. You are looking for an older block rule covering the same program — one you made months ago, or one an installer created quietly on your behalf.

To find it, open wf.msc, click the relevant rule list, and sort by the Action column so every Block rule groups together. Scan for anything naming your program or its folder. In PowerShell the same search is Get-NetFirewallRule | Where-Object Action -eq "Block", which is quicker when the list is long.

It also explains a genuinely useful pattern: you can leave broad allow rules in place and add a narrow block rule on top, confident the block will win. That is much easier to reason about later than deleting and rebuilding a set of allow rules you no longer remember the purpose of.

Jake asked Ethan why Microsoft did not just use the top rule in the list, the way a router does. Ethan's answer is worth keeping: "Because order is something you have to maintain and a default is something you cannot get wrong. If the firewall obeyed whichever rule came first, then every installer that added a rule would be quietly re-ordering your security. Block-wins means the strictest thing anyone ever said about that program is the thing that holds."

Which is the right instinct to carry into your own rules. When you are unsure, add the block and leave the allows alone. The firewall is built so that being cautious is also being simple.

Proving the Rule Actually Works

Creating a rule and having a rule take effect are two different events, and assuming the first produced the second is how people end up like Jake's customer — confident about something that was never true.

1. Confirm the rule exists and is enabled. In PowerShell: Get-NetFirewallRule -DisplayName "your rule name". Check Enabled reads True, Direction reads Outbound and Action reads Block.
2. Confirm it points at the right file. Run Get-NetFirewallRule -DisplayName "your rule name" | Get-NetFirewallApplicationFilter and compare the path against what Task Manager showed you.
3. Confirm it covers the profile you are on. The rule's Profile column should read Any, or at minimum include the profile your current network uses.
4. Test the behavior. Open the app and use the part that needs the internet. A blocked app usually reports a connection or timeout error rather than saying anything about a firewall.

If all four check out and the app still connects, the likeliest explanation is a third-party security suite that has taken over firewall duties. Many of those switch Windows Firewall off and run their own, in which case your rule is sitting in a console that is no longer deciding anything. Check whether your antivirus includes a firewall, and make the rule there instead.

Doing It From the Command Line

Useful when you are setting up several machines, or when you want a repeatable note rather than a memory of which buttons you clicked. Both need an administrator prompt.

Blocking a program's outbound traffic with netsh:

netsh advfirewall firewall add rule name="Block MyApp" dir=out program="C:\Program Files\MyApp\myapp.exe" action=block

The same thing in PowerShell, which reads more clearly and is easier to script:

New-NetFirewallRule -DisplayName "Block MyApp" -Direction Outbound -Program "C:\Program Files\MyApp\myapp.exe" -Action Block

Allowing an inbound connection follows the same shape with dir=in and action=allow, or -Direction Inbound -Action Allow. Removing a rule is Remove-NetFirewallRule -DisplayName "Block MyApp". Rules made this way are ordinary rules: they show up in wf.msc next to everything else and can be edited there.

One caution worth stating plainly. Rules created without a profile specified apply to all profiles, which is usually what you want. If you add -Profile Private because it looks tidier, you have just built the airport problem from the previous section into your own script.

When the Rule Does Nothing

Symptom	Most likely cause	Fix
Blocked app still connects	Rule points at the launcher, not the process doing the work	Find the real path in Task Manager, Details tab, and re-point the rule
Allowed app still cannot connect	An older block rule is winning	Sort by Action in wf.msc and delete or disable the block
Rule works at home, not elsewhere	Only one profile was checked	Open the rule's properties, Advanced tab, check all three profiles
Checkboxes are grayed out	You have not clicked Change settings, or you lack admin rights	Click Change settings; sign in as an administrator if prompted
Rules vanish after a restart	Group Policy on a managed machine is reapplying its own set	On a work device, this is intended. Ask whoever manages it.
Nothing in the console has any effect	A third-party suite replaced Windows Firewall	Make the rule in that product instead

If the console itself will not open, or the firewall reports that it is off and refuses to turn on, the problem is a layer below rules. That is a service issue, and our guide to the firewall service refusing to start covers it — including the detail that the firewall depends on three services rather than the one everybody names.

And if the rule list has become a mess of things you no longer recognize, resetting is a legitimate move rather than an admission of defeat. Resetting the firewall to defaults clears every custom rule, including ones installers added without asking. Note down what you want to keep first, because there is no undo.

A Correction to What This Page Said in 2016

Most of the time when we rewrite an old post here, the original was right for its moment and the product moved underneath it. This one is different, and it deserves saying plainly rather than quietly fixing.

The 2016 version of this page walked you to the "Allow an app" screen and said: check the box to allow, uncheck the box to block. The first half was correct. The second half was wrong, and it was wrong when we published it. Unchecking that box has never blocked an app from reaching the internet, because outbound traffic has always been allowed by default. We repeated a misunderstanding that was common then and is still repeated widely now, and anyone who followed that advice believed they had blocked something they had not.

If that was you, the fix is the outbound rule section above, and it takes about two minutes.

We are not going to dress this up as the product changing. It did not. The correction is the reason this rewrite leads with the inbound and outbound split instead of the button-clicking, because the button-clicking was never the hard part — knowing which of the two firewalls you are standing in front of is.

Your Questions, Answered Straight

Does unchecking an app in Allow an app block its internet access?

No, and this is the single biggest misunderstanding about Windows Firewall. That list controls incoming connections. Windows allows outgoing traffic by default unless a rule specifically forbids it, so an app you removed from the list can still reach the internet perfectly well. To stop an app going out you have to create an outbound block rule in Windows Defender Firewall with Advanced Security.

How do I actually block an app from the internet in Windows 11?

Press Windows+R, type wf.msc and press Enter. Select Outbound Rules, then New Rule. Choose Program, browse to the application's .exe file, choose Block the connection, leave all three profiles checked, and give the rule a name you will recognize later. The block takes effect immediately, with no restart needed.

What is the difference between inbound and outbound rules?

Inbound rules govern connections started from outside your computer coming in. Outbound rules govern connections your computer starts going out. Windows blocks unsolicited inbound traffic by default and allows outbound traffic by default, which is why allowing something is usually an inbound job and blocking something is almost always an outbound one.

Why does my firewall rule stop working when I change networks?

Because rules apply per profile, and Windows switches profile depending on the network. There are three: Domain for a workplace network, Private for home, and Public for everything else. A rule checked only for Private stops applying the moment you join cafe wifi and Windows switches to Public. When creating a rule, leave all three profiles selected unless you have a specific reason not to.

What happens if an app has both an allow rule and a block rule?

The block wins. Windows evaluates block rules before allow rules, so traffic matching both is blocked. This is useful to know when a rule appears to do nothing: rather than hunting for the reason your allow rule is ignored, look for an older block rule covering the same program that you or an installer created earlier.

How do I open Windows Defender Firewall with Advanced Security?

Press Windows+R, type wf.msc and press Enter. You can also reach it from Control Panel, Windows Defender Firewall, then Advanced settings on the left. It exists on Windows 11 Home as well as Pro, despite a widespread belief that it is a Pro-only tool.

Does Windows 11 Home have the advanced firewall console?

Yes. wf.msc is present on Home, and outbound block rules work exactly the same way there. What Home lacks is Group Policy for managing rules centrally, which matters on a company network and not at all on a personal machine.

My app is not in the Allow an app list. How do I add it?

Click Change settings, then Allow another app, then Browse, and point it at the program's .exe file. If the button is grayed out you have not clicked Change settings first, which needs administrator rights. Store apps often will not appear through Browse, and those are better handled through a rule in wf.msc.

How can I check whether my block rule is actually working?

Open the app and see whether the part that needs the internet fails. For something clearer, run Get-NetFirewallRule -DisplayName "your rule name" in PowerShell and confirm Enabled is True, Direction is Outbound and Action is Block. Checking the rule exists and checking it applies are two different things, so do both.

Can I block an app using the command line?

Yes. From an administrator prompt, netsh advfirewall firewall add rule name="Block MyApp" dir=out program="C:\Path\To\app.exe" action=block creates an outbound block rule. In PowerShell the equivalent is New-NetFirewallRule with -Direction Outbound and -Action Block. Both take effect immediately and appear in wf.msc alongside rules made through the wizard.

Will blocking an app stop it updating itself?

Usually yes, and that is worth thinking about before you block anything. Many programs update through a separate helper process with its own .exe, so a rule against the main program may leave the updater free while a rule against the updater stops security fixes arriving. Blocking a browser or anything security related is rarely a good trade.

Why does my game or app still connect after I blocked it?

Most often the rule is against the wrong file. Launchers start a separate game executable, and blocking the launcher does nothing to it. Check the real process name in Task Manager under Details while the app is running, then point the rule at that exact path. A second cause is a third-party security suite that has taken over firewalling entirely.

Should I block outbound traffic for everything by default?

Not on a machine you use for ordinary work. You can set the outbound default to Block in the firewall properties, but Windows itself needs outbound access for updates, activation, time sync and licensing, so you will spend weeks writing exceptions and diagnosing odd failures. Targeted block rules for specific programs give you most of the benefit and almost none of the pain.

Do these firewall rules protect me from malware?

Only in a limited way. A block rule stops a named program at a known path from making connections. Malware commonly runs from a different path, injects itself into a program that is already allowed, or simply uses your browser. The firewall is one layer that handles a specific job well and it is not a substitute for keeping Windows updated and running Defender.

How do I remove or undo a firewall rule?

Open wf.msc, choose Inbound Rules or Outbound Rules, find your rule by the name you gave it, then right-click and choose Delete. If you would rather keep it for later, choose Disable Rule instead. This is why naming rules something recognizable at the moment you create them saves real time later.

What should I do if the firewall is behaving strangely overall?

Reset it to defaults, which clears every custom rule including any an installer added without telling you. In wf.msc choose Restore Default Policy, or run netsh advfirewall reset from an administrator prompt. Write down the rules you want to keep first, because the reset removes all of them and there is no undo.

Worth Reading Next

Revision note. Originally published July 18, 2016 and lightly updated in November 2021. Rewritten August 22, 2026 for Windows 11 and Windows 10. This rewrite carries an open correction: the original told readers that unchecking an app in the "Allow an app" list would block it, and that was never true, because Windows allows outbound traffic by default. The outbound rule section above is what that advice should have said. Also new: the three network profiles and why a rule can stop applying when you change networks, rule precedence, command-line equivalents, and a troubleshooting table. If you followed the old advice and believed an app was blocked, we are sorry — two minutes in wf.msc puts it right, and you did nothing wrong by trusting a page that said so plainly.