How would I go about preventing a specific .exe from accessing any network (TCP) resources, with the exception of 1 or 2 IP addresses?

Can it be done with Windows Firewall (netsh or UI) and/or IPSec? If so, how?


  • I don't want to set my default firewall behavior to BLOCK.
  • OS is Windows 10 Pro

Thank you!

  • You say "I want to prevent, but don't want to BLOCK". Isn't that contradictory? – RonJohn Oct 14 '18 at 0:00
  • @RonJohn, don't want to set my default network action on my NIC to deny/block. Do want to set the network action for that process/exe to deny/block, though – Adam Plocher Oct 14 '18 at 8:46

According to this answer you can't create an exception for an outgoing block rule.

So instead you will need to create multiple block rules for the executable, so as to cover the entire IP address range apart from those addresses you want to allow.

For example, if you wanted to only allow traffic to, you would create block rules for and through

  • Ah hah, good idea.... gonna try that and I'll report back shortly. Thank you – Adam Plocher Oct 13 '18 at 21:59
  • I do believe that worked, thank you. Btw, it can be done with a single rule with multiple IP ranges. Thanks! – Adam Plocher Oct 13 '18 at 22:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.