How to block an app from accessing the internet

To block an app from the internet, right-click it in the Live tab and choose ⛔ Block this app (firewall), then Block (permanent), Block for 10 minutes or Block for 1 hour. NetSecWall adds an outbound block for that program and closes its open IPv4 connections straight away. The app keeps running; it just can't reach the network.

Blocking is part of the Family and Pro plans and the 7-day trial. On Monitor or Plus it is locked — see the plans.

Block an app from the internet in the Live tab

1. Open the Live tab and set View to Apps.
2. Find the program. Typing part of its name in the filter box narrows the list.
3. Right-click the program's own row — the top-level row with its name, not one of the connection rows under it.
4. Point to ⛔ Block this app (firewall).
5. Choose Block (permanent), Block for 10 minutes or Block for 1 hour.
6. If a settings password is set, enter it.

What happens when you block an app

• A block rule is created. It is an outbound block keyed to the program's full path. With the default Windows Firewall (rules) engine it is a Windows Firewall rule named NetLens App Block: <program>; with Packet filter (WFP) it is a filter in the Windows Filtering Platform; with Both, it is both. The enforcement engines article explains the difference.
• Open connections are cut. NetSecWall force-closes the app's established IPv4 TCP connections at once. Windows has no way to force-close IPv6 connections, so those end on their own — but new connections of either kind are blocked.
• Permanent blocks are remembered. NetSecWall applies them again every time it starts.
• Timed blocks lift themselves when the 10 minutes or the hour is up. They are not carried over a restart.

The blocked app gets no warning from NetSecWall. It behaves as if the PC were offline: it may show an error, retry, or wait quietly.

Other ways to block an app

• Rules tab ▸ Block an app… — pick the program's .exe file. Handy when the app isn't online right now. This is a permanent block; it doesn't force-close connections the app already has open.
• The Learning mode pop-up ▸ Block — for programs connecting for the first time.
• Detections tab ▸ Block selected — for a program with a worrying risk score. Same permanent block, and it closes the app's live connections too.
• Protection ▸ Parental controls… ▸ Always-blocked apps — on Family and Pro, behind the settings password.

Don't block svchost.exe

Many Windows services run inside svchost.exe. Because a block is keyed to the executable, blocking svchost.exe blocks every one of them at once: Windows Update, time sync, license activation and more. Look at the Service column to see which service is actually talking, and read what svchost.exe is doing on your network before you act.

Check that the block worked

1. Open the Rules tab.
2. Set Show: to NetSecWall rules.
3. Look for App Block: with the Owner NetSecWall, or WFP block: with the Owner NetSecWall · WFP if you use the packet filter.

Back in the Live tab, the app's connections close and no new ones appear. For a record of refused attempts, turn on the Windows log described in see what was blocked.

A block follows the file path, not the app's name. If an app updates itself into a new folder, block the new path too. Some apps also run a separate helper or updater program; block each executable you want offline.

To undo any of this, see unblock an app or remove a rule.