Firewall App Blocker

Firewall App Blocker stops a program from reaching the internet with a drag and a drop. Pull an executable onto its window and a blocking rule is written into the firewall already built into the system. Pull it off the list, or untick it, and the program connects again. Nothing new filters the traffic. The built-in firewall does the work, and this tool is the friendly face it never had, replacing a trip through several control panel pages with one gesture.

Three modes sit under the Firewall menu and decide how strict the whole machine is. Default mode blocks only what you list. Whitelist mode reverses that, blocking every program except the ones you have allowed, which is the setting for a machine running software you do not fully trust.

Block Internet shuts everything off until you switch it back, useful when something suspicious is running and you want it isolated at once. Firewall App Blocker needs the built-in firewall enabled and does nothing when a third-party firewall has replaced it, which is its one hard requirement.

Blocking a program, a folder or a process

The Firewall App Blocker window lists the rules it has created, with a tick box to enable or disable each one and the usual add and remove buttons. Drop a file onto the list or browse for it, and the rule is written. Drop a folder and every executable inside it is blocked in one pass, which is how a program that spreads itself across a dozen executables gets cut off at once. The window also accepts a running process picked from a list, so something you spotted in the process list can be blocked without hunting down its file.

Outbound and inbound rules live on separate tabs. Outbound is the one most people want, stopping a program from calling out. Inbound matters for servers and anything that listens for connections.

Blocking a program’s updater or its telemetry while leaving the program itself working is the everyday case, and it takes a single drop of the right executable.

Whitelist mode for untrusted machines

Switch to whitelist mode and the firewall denies every outbound connection from every program, then allows only what you add to the list. The browser, the mail client and the updater you trust go on the list, and anything else that tries to connect simply fails. It is the same idea as a default-deny firewall, achieved with the built-in engine and no extra driver.

That mode demands care. A program silently failing to connect is baffling if you forget the whitelist is on, and system components that need the network can be caught too. Turning the mode on, then adding programs as you notice them failing, is the practical way through the first day.

For a firewall built around default-deny from the start, with a hotkey to allow whatever window is in front, TinyWall does the same job with more polish.

Restricting, exporting and the context menu

A right-click Firewall App Blocker entry can be added so any file in the file manager offers Block or Allow directly, which turns the tool into a background convenience rather than a window you open. Rules export and import, so a blocking set built on one machine moves to another. A Restrict Firewall Options setting locks the system firewall pages against changes by other users, and the File menu shows the equivalent netsh commands for anyone who wants to script the same rules. For finer per-port rules on the same engine, a rule-based firewall front end goes further.

The whole thing is a single executable that runs from a folder with no installation, and the interface comes in many languages.

What it is not

It writes rules and nothing more. There is no monitoring of which programs are connecting right now, no alert when an unknown program tries to reach out, no per-port or per-address control for a given program, and no log of what was blocked.

For watching traffic as it happens, GlassWire shows the connections and asks the questions.

Conclusion

Firewall App Blocker suits anyone who wants to cut a particular program off from the internet without learning the system firewall’s rule editor, and anyone who wants a default-deny machine built from the engine already installed. The drag and drop, the folder blocking and the whitelist mode cover those jobs with almost nothing to learn.

It is not a monitor and it will not tell you what is trying to connect. Keep the built-in firewall on, use whitelist mode with patience, and pair it with a traffic monitor when you need to see what the rules are stopping.