How to Use Windows Firewall to Block Remote Internet Traffic While Allowing Local Computer Traffic

Introduction

Windows Firewall is a built-in security feature on Windows operating systems that monitors and manages incoming and outgoing network traffic. It allows users to create rules that allow or block traffic based on various criteria, such as the source and destination IP addresses, protocols, and ports. In this blog post, we will discuss how to use Windows Firewall to block remote internet traffic while allowing local computer traffic.

Understanding Subnets and Subnet Masks

Before we dive into the details of using Windows Firewall to block remote internet traffic, it’s important to have a basic understanding of subnets and subnet masks. A subnet is a logical subdivision of an IP network, while a subnet mask is a 32-bit number that defines the network portion and host portion of an IP address.

For example, if an IP address is 192.168.1.100 and the subnet mask is 255.255.255.0, the network portion of the IP address is 192.168.1, and the host portion is 100. The subnet mask is used to determine which portion of an IP address belongs to the network and which portion belongs to the host.

Subnets and subnet masks are used to create network boundaries and allow communication between devices within the same network while preventing communication with devices outside the network.

Blocking Remote Internet Traffic

To block remote internet traffic using Windows Firewall, you can create an outbound rule that blocks all traffic to remote IP addresses. Here’s how to do it:

1. Open Windows Firewall by typing “firewall” in the search bar and clicking “Windows Defender Firewall.”

2. Click “Advanced settings” on the left-hand side of the window.

3. Click “Outbound Rules” on the left-hand side of the window.

4. Click “New Rule” on the right-hand side of the window.

5. Select “Custom” and click “Next.”

6. Select “All Programs” and click “Next.”

7. Select “Any” for the protocol type and click “Next.”

8. Leave the “Any IP address” option selected for the remote IP address and click “Next.”

9. Select “Block the connection” and click “Next.”

10. Leave all the profile options selected and click “Next.”

11. Name the rule and click “Finish.”

This rule will block all outbound traffic to remote IP addresses. However, it will still allow local computer traffic.

Allowing Local Computer Traffic

To allow local computer traffic while blocking remote internet traffic, you can create a second outbound rule that allows traffic to local IP addresses. Here’s how to do it:

1. Open Windows Firewall by typing “firewall” in the search bar and clicking “Windows Defender Firewall.”

2. Click “Advanced settings” on the left-hand side of the window.

3. Click “Outbound Rules” on the left-hand side of the window.

4. Click “New Rule” on the right-hand side of the window.

5. Select “Custom” and click “Next.”

6. Select “All Programs” and click “Next.”

7. Select “Any” for the protocol type and click “Next.”

8. Select “These IP addresses” and click “Add.”

9. Enter the IP address range for your local network, such as 192.168.1.1-192.168.1.254, and click “OK.”

10. Select “Allow the connection” and click “Next.”

11. Leave all the profile options selected and click “Next.”

12. Name the rule and click “Finish.”

This rule will allow outbound traffic to local IP addresses while still blocking outbound traffic to remote IP addresses.

Blocking Specific Programs

If you want to block specific programs from sending or receiving traffic to and from sources and destinations beyond your local computer, you can create an outbound rule that blocks traffic for those programs. Here’s how to do it:

1. Open Windows Firewall by typing “firewall” in the search bar and clicking “Windows Defender Firewall.”

2. Click “Advanced settings” on the left-hand side of the window.

3. Click “Outbound Rules” on the left-hand side of the window.

4. Click “New Rule” on the right-hand side of the window.

5. Select “Program” and click “Next.”

6. Click “Browse” and select the program you want to block.

7. Select “Block the connection” and click “Next.”

8. Leave all the profile options selected and click “Next.”

9. Name the rule and click “Finish.”

This rule will block the program from sending or receiving traffic to and from sources and destinations beyond your local computer. However, it will still allow the program to interact within the same computer.

Conclusion

Windows Firewall is a powerful tool that can help you protect your computer from unwanted network traffic. By creating rules that allow or block traffic based on various criteria, you can ensure that your computer is only communicating with trusted sources. In this blog post, we discussed how to use Windows Firewall to block remote internet traffic while allowing local computer traffic and how to block specific programs from sending or receiving traffic to and from sources and destinations beyond your local computer. We hope this information helps you better understand how to use Windows Firewall to protect your computer.

Using Windows Firewall to block remote internet traffic while allowing local computer traffic can be a great way to protect your system from malicious external threats. This can be done by using subnets and subnet masks which can be used to deny or accept traffic from certain sources or destinations. By using the two commands above, you can block all traffic from entering or leaving your local network. However, if you want to allow certain programs to communicate within the local machine, you will need to configure your firewall settings accordingly.

The first step to take in order to configure your firewall settings is to understand the concept of subnets and subnet masks. A subnet is a group of computers that can communicate with each other directly and a subnet mask is a number that identifies the range of IP addresses within the subnet. It’s also important to note that the subnet mask can only be used on the same physical network, meaning that the computers within the subnet must be connected via the same router.

Once you have a basic understanding of the concept of subnets and subnet masks, you can begin to configure your Windows Firewall settings. To do this, you will need to open the Windows Firewall settings in the Control Panel and click on the Advanced Settings tab. From here, you will be able to add new rules and customize existing ones. To block traffic from outside the local computer, you can use the “Block all connections” rule and specify the IP addresses or subnets you wish to block.

If you want to allow certain programs to communicate within the local computer, you can create a specific rule for each program. For example, if you want to allow the program “Skype” to communicate within the local computer, you can add the following rule:

Allow all connections initiated from 127.0.0.1 to program “Skype”

This rule will allow the program “Skype” to communicate within the local computer, but will block it from communicating with sources or destinations outside the local computer.

By using Windows Firewall to block remote internet traffic while allowing local computer traffic, you can protect your system from malicious threats while ensuring that the programs and services you use are communicating securely within the local computer. In addition to creating specific rules for each program you wish to restrict, you can also use the “Block all connections” rule to block external traffic.

In summary, Windows Firewall can be used to block remote internet traffic while allowing local computer traffic by creating specific rules for each program you wish to restrict. You can also use the “Block all connections” rule to block all external traffic. This is a great way to protect your system from malicious external threats and ensure that your programs and services are communicating securely within the local computer.

If you have any additional questions or need more help, please feel free to reach out.

To block traffic to and from sources and destinations outside your local computer using Windows Firewall, you can use the netsh command-line utility to create firewall rules that block specific programs from accessing the internet. Here’s how you can do it:

1. Open the Command Prompt as an administrator.
2. Type the following command to list all the programs that are currently being allowed or blocked by Windows Firewall:

netsh advfirewall firewall show rule name=all

3. To block a program from accessing the internet, use the following command:

netsh advfirewall firewall add rule name="Blocked: ProgramName" dir=out program="C:\Path\To\Program.exe" action=block

Replace “ProgramName” with the name of the program you want to block, and “C:\Path\To\Program.exe” with the full path to the program’s executable file. 4. To allow a program to access the internet, use the following command:

netsh advfirewall firewall add rule name="Allowed: ProgramName" dir=out program="C:\Path\To\Program.exe" action=allow

The key is to avoid utilizing the outdated “netsh advfirewall firewall” interface in the Command Prompt and instead use the newer PowerShell interface.

New-NetFirewallRule -DisplayName "Blocked: $file" -Direction Outbound -RemoteAddress Internet -Program "$file" -Action Block

The above command blocks the file stored in the “$file” variable. In my use case I had this:

$fileNames = Get-ChildItem -Path $scriptPath -Recurse -Include *.exe

foreach ($file in $fileNames) {
    New-NetFirewallRule -DisplayName "Blocked: $file" -Direction Outbound -RemoteAddress Internet -Program "$file" -Action Block
    New-NetFirewallRule -DisplayName "Blocked: $file" -Direction Inbound -RemoteAddress Internet -Program "$file" -Action Block
}

The PowerShell script mentioned above has the capability to prevent all communication between the internet and *.exe files situated in a specific directory, with recursive functionality.

The most important aspect of this solution is the utilization of the “Internet” macro within the New-NetFirewallRule’s -RemoteAddress, which automatically identifies packets to and from the internet.