Can't block a specific application in Windows 7 Firewall

Question

I am using Windows 7 64 bit and trying to block a specific application from accessing the internet using "Windows Firewall with Advanced Security" (wf.msc).

The rule is set to be applied for all profiles, all protocols, all IP addresses. The rule is turned on. Action is "Block the connection". I select a program by browsing to %ProgramFiles% (x86)\Mozilla Firefox\firefox.exe (I am sure that my Firefox runs from this executable). But the rule doesn't work and the application has access to the internet!

I also tried to insert a path manually as "C:\Program Files (x86)\Mozilla Firefox\firefox.exe". I also tried to apply the rule for other apps: "%ProgramFiles% (x86)\Opera\opera.exe", "%ProgramFiles% (x86)\Google\Chrome\Application\chrome.exe". The result is still unsuccessful.

If I change the "Programs" setting in "Programs and services" tab from "This program" to "All programs that meet the specified conditions", then firewall works and the connection is blocked in all applications, including the above browsers.

I tried to make the rule for outbound connections, for inbound ones and for both at once. No luck.

I tried to do the same using

netsh advfirewall firewall add rule name="My Application" dir=out action=block program="C:\Program Files (x86)\Mozilla Firefox\firefox.exe"

The new rule appears in "Windows Firewall with Adv. Sec." app but it doesn't work as in the above case.

What am I doing wrong?

Solution 1

It seems that a 3rd party software was interfering with firewalling. In my case it was Avast Antivirus which has some modules for Internet. I turned off "Network" and "Web" "Shields" in it, and the rule is now applied correctly. So the moral seems to be that a 3rd party software may interfere in such a way that Windows Firewall is not able to block (or maybe apply any rules) in application-specific way.

Solution 2

You can use Firewall App Blocker (portable freeware) to block an application easily through Windows firewall.

Solution 3

I am had the same problem with Windows 7 Ultimate 64 bit firewall rules not being applied. I tried Sadaf's suggestion but it didn't work for me. I also disabled all the Avast shields but that didn't work either.

The rules on my firewall starting work again once I uninstalled Avast completely from my computer.

I tried re-installing Avast in hopes that both Avast and Windows Firewall could live in peace together but the firewall rules stop working immediately.

The strange and dangerous part in all of this is that there was no notification indicating a problem with the firewall... except that your once-blocked programs suddenly start accessing the internet...

I did try out Avast Internet Security (which contains its own firewall) at one point in time. Perhaps something remained even after I removed it and causes this problem.

Comments

[Admin]

It works fine for me, both when adding the rule from wf.msc as well as from the command prompt - Firefox is unable to access the internet. Try double- and triple-checking that you're really running Firefox from the path that's specified in the rule.

[sadav]

1) How do you rearrange/prioritize rules? 2) I don't have any other rules for these applications. 3) If I make the rule non application-specific, then it seems to work...

[Indrek]

The order in which the rules are shown is irrelevant. Block rules will always take priority over Allow rules (with the exception of "Allow if secure" rules which can be set to override Block rules).

[Brian]

I've reread your question and it looks like you did do everything correctly. If you could just reset to default rules and try again this way we can be as confident as possible that another application did not create a conflicting rule. Perhaps you can export the ruleset as well and post it here somehow?

[sadav]

Thank you for your answer. I've found "Restore default policy" action, did it, but I still have the same unsuccessful result. Update: I wanted to share my policy and added a link to it, but now, when the question seems to be resolved, I deleted this comment.