Can't block a specific application in Windows 7 Firewall

29
2013-07
  • sadav

    I am using Windows 7 64 bit and trying to block a specific application from accessing the internet using "Windows Firewall with Advanced Security" (wf.msc).

    The rule is set to be applied for all profiles, all protocols, all IP addresses. The rule is turned on. Action is "Block the connection". I select a program by browsing to %ProgramFiles% (x86)\Mozilla Firefox\firefox.exe (I am sure that my Firefox runs from this executable). But the rule doesn't work and the application has access to the internet!

    I also tried to insert a path manually as "C:\Program Files (x86)\Mozilla Firefox\firefox.exe". I also tried to apply the rule for other apps: "%ProgramFiles% (x86)\Opera\opera.exe", "%ProgramFiles% (x86)\Google\Chrome\Application\chrome.exe". The result is still unsuccessful.

    If I change the "Programs" setting in "Programs and services" tab from "This program" to "All programs that meet the specified conditions", then firewall works and the connection is blocked in all applications, including the above browsers.

    I tried to make the rule for outbound connections, for inbound ones and for both at once. No luck.

    I tried to do the same using

    netsh advfirewall firewall add rule name="My Application" dir=out action=block program="C:\Program Files (x86)\Mozilla Firefox\firefox.exe"
    

    The new rule appears in "Windows Firewall with Adv. Sec." app but it doesn't work as in the above case.

    What am I doing wrong?

  • Answers
  • sadav

    It seems that a 3rd party software was interfering with firewalling. In my case it was Avast Antivirus which has some modules for Internet. I turned off "Network" and "Web" "Shields" in it, and the rule is now applied correctly. So the moral seems to be that a 3rd party software may interfere in such a way that Windows Firewall is not able to block (or maybe apply any rules) in application-specific way.

  • slhck

    You can use Firewall App Blocker (portable freeware) to block an application easily through Windows firewall.

    enter image description here

  • Jeremy W

    I am had the same problem with Windows 7 Ultimate 64 bit firewall rules not being applied. I tried Sadaf's suggestion but it didn't work for me. I also disabled all the Avast shields but that didn't work either.

    The rules on my firewall starting work again once I uninstalled Avast completely from my computer.

    I tried re-installing Avast in hopes that both Avast and Windows Firewall could live in peace together but the firewall rules stop working immediately.

    The strange and dangerous part in all of this is that there was no notification indicating a problem with the firewall... except that your once-blocked programs suddenly start accessing the internet...

    I did try out Avast Internet Security (which contains its own firewall) at one point in time. Perhaps something remained even after I removed it and causes this problem.

  • Brian

    Firewall rules must be prioritized. If you have a rule to allow the connection before the blocking rule guess what will happen. Rearrange the order so blocking happens first.

  • Brian

    OK its been a while since I have looked at the firewall features. In Windows Firewall with Advanced Features create an Outbound Rule blocking application Mozilla Firefox. I tested it and it works for me. If it doesnt work for you maybe you can reset the rules to default and try again.

  • JoshP

    I've been having the exact same problem:

    The outbound rule of the Advanced Part of Windows Firewall didn't work for one program. But stupid as I am, I realized that I forgot to remove this same program from the exception list, which you can access in the basic configuration of Windows Firewall.

    Once on the Windows Firewall page of the Control Panel, you have the possibility to manage the list of allowed applications thanks to a link on the left hand part of the window.

    So for my part, I just removed the program from the exceptions list and then my blocking rule from the advanced part started working.



  • view all most popular Amazon Coupons
    .

    Related Question

    security - Windows 7: Windows Firewall: Logging/Notifying on Outgoing Request Attempts
  • Maxim Zaslavsky

    I'm trying to configure Windows Firewall with Advanced Security to log and tell me when programs are trying to make outbound requests. I previously tried installing ZoneAlarm, which worked wonders for me with this in XP, but now, I'm unable to install ZA on Win7. My question is, is it possible to somehow monitor a log or get notifications when a program tries to do that if I set all outbound connections to auto-block, so that I can then create a specific rule for the program and block it.?

    Thanks!

    UPDATE: I've enabled all the logging options available through the Properties windows of the Windows Firewall with Advanced Security Console, but I am only seeing logs in the %systemroot%\system32\LogFiles\Firewall\pfirewall.log file, not in the Event Viewer, as the first answer suggested. However, the logs that I can see only tell me the request's or response's destination IP and whether the connection was allowed or blocked, but it doesn't tell me what executable it comes from. I want to find out the file path of the executable that each blocked request comes from. So far, I haven't been able to.


  • Related Answers
  • 8088

    You should be able to see this in Event Viewer. First you'll need to tweak the logging options in the Advanced Settings Console:

    alt text

    In the Event Viewer's left pane, expand to Applications and Services Log -> Microsoft -> Windows -> Windows Firewall with Advanced Security:

    alt text

    There, you can create a custom view and filter the log to only outbound connection attempts.