Windows Firewall - how to block inbound for all .exe files in a folder

Question

In Windows Firewall with Advanced Settings I can create a rule which blocks all inbound or outbound traffic for particular program by pointing to its .exe file. The problem is that this program has many .exe files in its directory, as well as additional ones in its sub directories.
So my question is: do I need to make separate rules for each .exe file, which in this case would mean about 50 rules? Or is there a way to block the traffic for a group of .exe files based on their location on the local hard drive?

Answer 1

You can use a Simple Batch File. Open Notepad and copy/paste the script below into a blank document. Save the file as BLOCKALL.BAT. Now copy that file to the same directory as the EXEs you want to block and double click it. It will add outbound rules to advanced Windows Firewall settings blocking all EXEs in that folder and sub-folders as well.

It is tested with Windows 7, but it should work with other versions of Windows that use Windows Firewall.

NOTE: Batch starts itself in system32. Thus you need to prepend it with cd /d "%~dp0" to make it work in current directory.

The resulting script would be as follows:

@ setlocal enableextensions 
@ cd /d "%~dp0"

for /R %%a in (*.exe) do (

netsh advfirewall firewall add rule name="Blocked with Batchfile %%a" dir=out program="%%a" action=block

)

Answer 2

Firewall App Blocker (Fab) added a feature to block all executable files in a folder in version 1.5. You can select between inbound and outbound rules.

Answer 3

**Configure and Add rules in windows firewall based on dynamic content (exe files) in that folder: **

you should work with PowerShell or command line tools that run everyday.

like this : Article Link

function Add-FirewallRule {
   param( 
      $name,
      $tcpPorts,
      $appName = $null,
      $serviceName = $null
   )
    $fw = New-Object -ComObject hnetcfg.fwpolicy2 
    $rule = New-Object -ComObject HNetCfg.FWRule
        
    $rule.Name = $name
    if ($appName -ne $null) { $rule.ApplicationName = $appName }
    if ($serviceName -ne $null) { $rule.serviceName = $serviceName }
    $rule.Protocol = 6 #NET_FW_IP_PROTOCOL_TCP
    $rule.LocalPorts = $tcpPorts
    $rule.Enabled = $true
    $rule.Grouping = "@firewallapi.dll,-23255"
    $rule.Profiles = 7 # all
    $rule.Action = 1 # NET_FW_ACTION_ALLOW
    $rule.EdgeTraversal = $false
    
    $fw.Rules.Add($rule)
}
# Sample Usage
Add-FirewallRule "Test port 1234" "1234" $null $null
Add-FirewallRule "Test port 5555-6666" "5555-6666" $null $null
Add-FirewallRule "Test port 2222 Calc" 2222 "c:\windows\system32\calc.exe" $null
Add-FirewallRule "Test port 3333 W3SVC" 3333 $null "W3SVC"

There are also some good VBScript samples on MSDN which I used as a starting point.

BUT recommended that you add firewall or proxy in edge of your network, like ISA or SQUID for all of your inbound traffic in your LAN.

open ISA Server Management, click Start, point to All Programs, point to Microsoft ISA Server, and then click ISA Server Management.

Block responses containing Windows executable content visit this Article here

To block responses containing Windows executable content 

 1. In the console tree of ISA Server Management, click Firewall Policy.

    
 2. In the details pane, click the applicable access rule or Web
        publishing rule.
 3. On the Tasks tab, click Edit Selected Rule.
 4. On the Traffic tab (for Web publishing rules) or on the Protocols
        tab (for access rules), click Filtering, and then click Configure
        HTTP.
 5. On the General tab, click Block responses containing Windows
        executable content.

in our network that based on windows we have cache server named SQUID :

Squid content filtering: Block / download of music MP3, mpg, mpeg, exec files

1. First open squid.conf file /etc/squid/squid.conf:

   vi /etc/squid/squid.conf

2. Now add following lines to your squid ACL section:

   acl blockfiles urlpath_regex "/etc/squid/blocks.files.acl"

3. You want display custom error message when a file is blocked:

   Deny all blocked extension

   deny_info ERR_BLOCKED_FILES blockfiles

   http_access deny blockfile

Answer 4

If the .exe's are located in the same folder you can probably add it in the windows firewall list.If they are located in different folders then you have to manually add those.In general,the firewall will ask for user's permission if an .exe tries to access the network i.e one that is not recognized as a trusted application.But it wont track what are the individual exe's that are called inturn by that process.You can either disable all ports or specific ports.

In general the windows firewall is not my recommendation unless you update your windows everyday.Use Comodo's free edition to have better control and it can be easily setup.