No internet after blocking something? How to get it back

If you have no internet after blocking something in NetSecWall, check the status bar at the bottom of the window first. If the mode chip ends in ⛔ Block-all ON, all outbound traffic is being cut on purpose, and turning that off brings the connection back. If it doesn't say that, the cause is almost always a single rule, and the Rules tab will show you which one.

Go through the checks below in order. The most common causes come first.

No internet after blocking: the checklist

1. Is Block all outbound on?

Three different switches can turn on the same block-all rule, and the status bar shows ⛔ Block-all ON whenever any of them is active.

1. Open Protection ▸ Filtering mode and choose Monitor only (no blocking) or Learning — ask when a new app connects.
2. Right-click the NetSecWall tray icon and make sure Block ALL internet is not ticked.
3. Check the status bar again. The Block-all ON label should be gone.

If you manage this PC over Remote Desktop, Block all cuts that session too, so you'll need someone at the keyboard to turn it off.

2. Is it bedtime, or is the daily limit used up?

Parental controls switch the internet off with the same block-all rule. The status bar shows Bedtime while the curfew or the daily time limit is active, and the tray says "Parental controls — internet paused". To change the hours or the limit, open Protection ▸ Parental controls…, which asks for the parental password. The daily limit resets when the date changes. See internet bedtime.

3. Did NetSecWall close badly last time?

If NetSecWall crashed or was killed while Block all was on, the block-all rule can stay in Windows Firewall. The next time NetSecWall starts, it finds the rule, shows Block ALL internet as on, and pops up a tray message saying "⛔ All internet is blocked". Untick Block ALL internet in the tray menu. If your PC has no tray, a dialog called "All internet is blocked" offers Turn off Block ALL internet and Keep blocking.

So if NetSecWall isn't running and nothing connects, start it. That's how the leftover rule gets found and removed.

4. Did a category or country block catch a shared address?

Category and country blocks work on IP addresses. Big sites share addresses on content delivery networks (CDNs), so blocking a category or a country can take down an unrelated site that happens to use the same address.

• Category: open Protection ▸ Content categories… and untick Block for the category you last turned on, or choose Protection ▸ Profile ▸ Relaxed (nothing blocked).
• Country: in the Live tab, set View to By Country, right-click the country and choose Unblock followed by its two-letter code. You can also delete its NetLens Geo Block: rules in the Rules tab.

There's no per-domain allow list on Windows. If a category keeps catching a site you need, don't block that category.

5. Did Learning mode hold the app?

In Learning mode, a new app is blocked first and stays blocked until you answer the pop-up. If nobody answers within 30 seconds, it stays blocked until NetSecWall restarts. Any program that wasn't online when you turned Learning on counts as new, and that includes a browser you opened afterwards. Approvals are remembered by file path, so an app that updates itself into a new folder gets asked about again.

The Events tab shows what happened, for example "blocked for this session (no answer to the prompt)" or "you blocked it from connecting". To undo it, delete that app's NetLens App Block: rule in the Rules tab. More in Learning mode.

6. Did you block svchost.exe?

Don't block svchost.exe as a whole. It hosts many Windows services, including Windows Update, time sync and license activation, and Windows usually sends its DNS lookups from a service inside it too. Blocking it can make every site fail to load. Remove that rule and block the specific app you meant instead.

Find the rule that's causing it

1. Open the Rules tab. If a settings password is set, click Unlock… first.
2. Set Show: to NetSecWall rules. The rules NetSecWall creates have names starting with NetLens, such as NetLens App Block: …, NetLens Content Block …, NetLens Geo Block: … and NetLens Block All. Blocks from the packet filter show NetSecWall · WFP in the Owner column.
3. Select the rule and choose Delete ▾ ▸ Delete selected.

The Live tab doesn't mark connections as blocked. To see blocked attempts, open Protection ▸ Blocked connections (firewall log)…. It needs a Windows audit setting, and if the list is empty the dialog shows the command that turns it on. See the firewall log and unblocking an app.

Rule NetSecWall out properly

Switching to Monitor only doesn't test anything. It only turns off Learning prompts and Block all, and every app, category, country and custom block keeps applying. To take NetSecWall out of the picture:

1. If the background service is installed, choose Tools ▸ Background service ▸ Stop.
2. Right-click the tray icon and choose Quit.
3. Test your connection.

When NetSecWall stops, it removes its own Windows Firewall rules, and its packet-filter blocks stop with the process. If the internet comes back, a NetSecWall block was the cause. Start NetSecWall again (it re-applies your saved blocks) and use the Rules tab to find the culprit. If the internet still doesn't work, the problem is somewhere else. The one exception is any rule you made yourself with New rule…. Those are ordinary Windows Firewall rules and stay in place whether NetSecWall runs or not.