The rule exists, it says Block, it is enabled — and the app is still online. This is the most common firewall complaint there is, and the rule is almost never broken. The wrong file is blocked. Here is how to find the right one.
A Windows Firewall program rule blocks one exact file. Modern apps are not one file: a launcher starts the real program, an updater runs separately, helpers handle downloads. Block the launcher and the real program walks straight past your rule. Work through these checks in order — number 2 is the culprit in most cases.
Rule out the simple mistakes first. Open wf.msc → Outbound Rules, double-click your rule and check:
All three correct? Then the rule is fine — the app is using a different file. Continue.
While the app is open and doing something online:
Typical pattern: Launcher.exe only starts AppCore.exe. Blocking the launcher changes nothing, because it never connects itself.
Many apps install each version in its own folder, like app-1.9 and later app-2.0. Your rule still points at the old folder — correct file, wrong generation.
C:\Program Files and C:\Program Files (x86) — a reinstall can move the app from one to the otherSome programs do their networking through a background Windows service, not the window you see. Then the connecting file is the service's own .exe, which you can find in services.msc (open the service → Path to executable) and block that file instead.
And one warning: also block the updater file if you see one, otherwise the app updates itself into a new folder and escapes again.
The honest limit: a program determined to hide its traffic can route it through shared Windows components. A simple program rule is the right tool for normal apps — it is not a cage for software that is actively fighting you.
Usually, no. When an app starts a connection, the replies come back through that same connection — firewall people call this stateful return traffic — so an inbound block does not stop it. The outbound rule on the correct file is the whole fix. An inbound rule only matters if other computers should never connect into the program, for example a local server tool you use at home but do not want the office network to reach.
Watch the video to see the rule being created — then use this page's checklist if the block does not bite.
▶️ Watch Full VideoAlmost always an update. The app installed a new version — often in a new folder — and your rule still points at the old file. Update the path in the rule and it works again.
Then check two things: a third-party antivirus firewall may be in charge instead of Windows Firewall, or the app works through a Windows service or system component. Both cases are covered in this guide series.
Yes. Adding block rules for the launcher, the main program and the updater together is a common and safe combination — local features keep working, only network access stops.