To block an app from the internet in Windows 11, create an outbound firewall rule. Open Windows Defender Firewall with Advanced Security, click Outbound Rules > New Rule, choose Program, browse to the app’s .exe file, select Block the connection, and give the rule a name. The app can still run, but it can’t reach the internet until you disable or delete the rule.
This is useful for stopping an app from updating itself, keeping an offline tool offline, or cutting background data use on your own PC.
Quick Answer
Start > wf.msc > Outbound Rules > New Rule > Program > browse to the .exe > Block the connection > all profiles > name it > Finish.
Create the Block Rule
- Press Windows + R, type wf.msc, and press Enter. (Or search Start for “Windows Defender Firewall with Advanced Security”.)
- Click Outbound Rules on the left, then New Rule on the right.
- Choose Program and click Next.
- Select This program path, click Browse, and pick the app’s .exe (often under C:\Program Files). Click Next.
- Choose Block the connection and click Next.
- Leave Domain, Private and Public checked, then click Next.
- Name the rule clearly, such as “Block PhotoApp internet”, and click Finish.
For complete isolation, create a matching Inbound rule the same way.
Test, Pause or Remove the Rule
- Test: Open the app and try something that needs the internet. It should fail.
- Pause: Right-click the rule in Outbound Rules and choose Disable Rule.
- Remove: Right-click the rule and choose Delete.
Which Approach Fits?
| Situation | Approach |
|---|---|
| Desktop app with a known .exe | Outbound firewall rule (this guide) |
| App uses a separate updater or helper | Block each .exe in the app’s folder |
| Microsoft Store app | Harder to target with a path rule; check the app’s own offline or update settings |
| Limiting a child’s apps | Family Safety app and screen-time limits |
Before installing new software, read our guide to downloading apps safely.
To find which app is using the network, open Task Manager and check the Network column.
Troubleshooting
- The app still connects: It may use another .exe (an updater or helper), or a third-party security suite may be managing the firewall. Check the app folder and your security software.
- Can’t create rules: You need administrator rights.
- Something else stopped working: Make sure you blocked the right program, not a shared system file.
- Need to allow traffic instead? See how to open ports on Windows 11. Don’t turn the firewall off to fix connection issues; if you’re troubleshooting, see turning the firewall off safely and turn it back on after.
Frequently Asked Questions
Does blocking an app stop it from updating?
Usually, if the update runs through the blocked .exe. Separate update services need their own rule.
Can I block an app without third-party software?
Yes. The built-in firewall does it, as shown above.
Does the rule survive a restart?
Yes. It stays until you disable or delete it.
Summary
- Open wf.msc and go to Outbound Rules.
- New Rule > Program > browse to the .exe.
- Block the connection on all profiles and name the rule.
- Disable or delete the rule to restore access.
Kermit Matthews is a freelance writer based in Philadelphia, Pennsylvania with more than a decade of experience writing technology guides. He has a Bachelor’s and Master’s degree in Computer Science and has spent much of his professional career in IT management.
He specializes in writing content about iPhones, Android devices, Microsoft Office, and many other popular applications and devices.