In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has many .exe files in its directory, as well as additional ones in its sub directories.
So my question is: do I need to make separate rules for each .exe file, which in this case would mean about 50 rules? Or is there a way to block the traffic for a group of .exe files based on their location on the local hard drive?

  • Might be worth investigating which of the 50 files handles network traffic.
    – MCW
    Commented Nov 27, 2012 at 11:39
  • Here's a simplier way: sites.google.com/site/mytools4000/home/… Although @saber tabatabaee yazdi answer is much more thorough.
    – RASMiranda
    Commented Jan 18, 2013 at 15:35
  • @MarkC.Wallace, And how would you even do that assertatively?
    – Pacerier
    Commented Mar 28, 2015 at 17:26
  • Is the question about both inbound and outbound rules, or only inbound?
    – user598527
    Commented Oct 21, 2016 at 18:54

4 Answers 4


You can use a Simple Batch File. Open Notepad and copy/paste the script below into a blank document. Save the file as BLOCKALL.BAT. Now copy that file to the same directory as the EXEs you want to block and double click it. It will add outbound rules to advanced Windows Firewall settings blocking all EXEs in that folder and sub-folders as well.

It is tested with Windows 7, but it should work with other versions of Windows that use Windows Firewall.

NOTE: Batch starts itself in system32. Thus you need to prepend it with cd /d "%~dp0" to make it work in current directory.

The resulting script would be as follows:

@ setlocal enableextensions 
@ cd /d "%~dp0"

for /R %%a in (*.exe) do (

netsh advfirewall firewall add rule name="Blocked with Batchfile %%a" dir=out program="%%a" action=block

  • 4
    If you need to "Run as Administrator" then you will need to edit the file to look like this: @ setlocal enableextensions @ cd /d "%~dp0" for /R %%a in (*.exe) do ( netsh advfirewall firewall add rule name="Blocked with Batchfile %%a" dir=out program="%%a" action=block ) If you Run as Administrator, and don't edit the file to look like that. It will just add all your exe files from the system32 folder to the firewall. It happens because the batch files runs from system32 when running as an Administrator.
    – user109756
    Commented May 5, 2016 at 21:02
  • @user109756 - Can you or someone update/ add this comment into the answer for greater clarity. It is hard to read and apply. Thanks.
    – Alex S
    Commented May 2, 2017 at 17:35
  • 1
    Elaborating on setlocal enableextensions. This ensures that environment changes made are local to the batch file and restored upon exit. It might be useless for such a simple script, but nonetheless might be a nice touch to it.
    – PF4Public
    Commented Jun 1, 2017 at 15:22
  • Now that was beautiful. Worked like a charm! Thank you very much for your contribution.
    – malvadao
    Commented Sep 4, 2018 at 2:57

Firewall App Blocker (Fab) added a feature to block all executable files in a folder in version 1.5. You can select between inbound and outbound rules.

Fab options


**Configure and Add rules in windows firewall based on dynamic content (exe files) in that folder: **

you should work with PowerShell or command line tools that run everyday.

like this : Article Link

function Add-FirewallRule {
      $appName = $null,
      $serviceName = $null
    $fw = New-Object -ComObject hnetcfg.fwpolicy2 
    $rule = New-Object -ComObject HNetCfg.FWRule
    $rule.Name = $name
    if ($appName -ne $null) { $rule.ApplicationName = $appName }
    if ($serviceName -ne $null) { $rule.serviceName = $serviceName }
    $rule.Protocol = 6 #NET_FW_IP_PROTOCOL_TCP
    $rule.LocalPorts = $tcpPorts
    $rule.Enabled = $true
    $rule.Grouping = "@firewallapi.dll,-23255"
    $rule.Profiles = 7 # all
    $rule.Action = 1 # NET_FW_ACTION_ALLOW
    $rule.EdgeTraversal = $false
# Sample Usage
Add-FirewallRule "Test port 1234" "1234" $null $null
Add-FirewallRule "Test port 5555-6666" "5555-6666" $null $null
Add-FirewallRule "Test port 2222 Calc" 2222 "c:\windows\system32\calc.exe" $null
Add-FirewallRule "Test port 3333 W3SVC" 3333 $null "W3SVC"

There are also some good VBScript samples on MSDN which I used as a starting point.

BUT recommended that you add firewall or proxy in edge of your network, like ISA or SQUID for all of your inbound traffic in your LAN.

open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Block responses containing Windows executable content visit this Article here

To block responses containing Windows executable content 

 1. In the console tree of ISA Server Management, click Firewall Policy.

 2. In the details pane, click the applicable access rule or Web
        publishing rule.
 3. On the Tasks tab, click Edit Selected Rule.
 4. On the Traffic tab (for Web publishing rules) or on the Protocols
        tab (for access rules), click Filtering, and then click Configure
 5. On the General tab, click Block responses containing Windows
        executable content.

in our network that based on windows we have cache server named SQUID :

Squid content filtering: Block / download of music MP3, mpg, mpeg, exec files

  1. First open squid.conf file /etc/squid/squid.conf:

    vi /etc/squid/squid.conf

  2. Now add following lines to your squid ACL section:

    acl blockfiles urlpath_regex "/etc/squid/blocks.files.acl"

  3. You want display custom error message when a file is blocked:

    Deny all blocked extension

    deny_info ERR_BLOCKED_FILES blockfiles

    http_access deny blockfile


If the .exe's are located in the same folder you can probably add it in the windows firewall list.If they are located in different folders then you have to manually add those.In general,the firewall will ask for user's permission if an .exe tries to access the network i.e one that is not recognized as a trusted application.But it wont track what are the individual exe's that are called inturn by that process.You can either disable all ports or specific ports.

In general the windows firewall is not my recommendation unless you update your windows everyday.Use Comodo's free edition to have better control and it can be easily setup.

  • 1
    If the .exe's are located in the same folder you can probably add it in the windows firewall list. How - I am only able to add one .exe per rule, but I can't find an option to add a whole folder containing .exes to a rule. Commented Nov 27, 2012 at 14:25
  • @AlexPopov instead of selecting the .exe file, select the folder. Then teh rule will block all the exe's in that folder. Commented Jan 5, 2017 at 10:46
  • 1
    I have just tested the method, and it does not work (Windows 10 Enterprise x64). I have blocked outbound, folder c:\program files\mozilla firefox, scopes Default Gateway and Internet. However, Firefox still loads all internet pages.
    – Binarus
    Commented Apr 18, 2019 at 7:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .