I have a specific software that I cannot let out to the internet but it is crucial that it has access to the local network. I can create an inbound and an outbound Block rule for the main application's .exe file(s).

Under their firewall properties, Scope tab, Remote IP window I can add "Internet". That blocks all internet access but the local network is still accessible.

My big question is: How on earth do I know that the application only uses the exe file(s) in its Program Files folder and not anything else? For instance it could use a windows service like svchost.exe to "disguise" itself for communications? There are dozens of uniform windows service processes that can handle the task I guess. So how do I know what else I need to create a Block rule for? I guess I could monitor with Wireshark but I wouldn't be able to tell if it weren't the exe file(s) in the Program Files folder.

Or is it the case that if I block all exe files in the respective Program Files folder the program will be completely restricted to the Firewall rules?

  • You want this one program to be blocked but allow everything else on the host to connect to the Internet? – schroeder Mar 20 at 15:06
  • yes, everything else can be left as default, allowed to access the internet – Rororo Mar 20 at 15:07
  • Do you know where it might want to reach out to, or do you expect it to be arbitrary in its outbound connections? – schroeder Mar 20 at 15:14
  • Sounds like a job for a container, not a firewall, to be honest. – schroeder Mar 20 at 15:14
  • I have no idea where it might reach out to. Obviously not completely random but can be anything. So it is a known-unknown case. I have no experience with containers. – Rororo Mar 20 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.