You want the program to reach the shared folder, the network printer and the office server — but never the internet. A normal block rule kills both. A scoped block rule kills only the internet. Here is the trick, step by step.
Windows Firewall block rules can be limited to certain remote IP addresses. So instead of blocking the program everywhere, you block it only towards public internet addresses and leave the private address ranges of your local network untouched. It is one extra step on the normal rule — the Scope tab — and it works with the GUI and with netsh.
Every local network uses private IP ranges: 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255. Your router, printer, NAS and other PCs all live inside these ranges. Everything outside them is the internet.
So the plan is simple: make the block rule apply only to remote addresses outside the private ranges. The four ranges in the panel above are exactly "the whole internet, minus private networks".
wf.msc → Outbound Rules, double-click your rule → open the Scope tab0.0.0.0 to 172.15.255.255, then 172.32.0.0 to 191.255.255.255, then 193.0.0.0 to 223.255.255.255, then 224.0.0.0 to 255.255.255.255For a script or a quick setup, one administrator command creates the whole thing:
netsh advfirewall firewall add rule name="MyApp LAN Only" dir=out program="C:\Program Files\MyApp\MyApp.exe" action=block remoteip=0.0.0.0-172.15.255.255,172.32.0.0-191.255.255.255,193.0.0.0-223.255.255.255,224.0.0.0-255.255.255.255
The remoteip list is the scope — the same four ranges, comma separated, no spaces.
Honest limits: this trick judges by destination IP address, nothing else. If the app reaches a company VPN whose addresses are public, that traffic is blocked too — connect through the tunnel first and test. And if your office uses a rare public range inside its own building network, add that range to an allow rule above the block. For normal home and small-office LANs — 192.168.x.x like almost everyone's router — it works exactly as described.
Watch the video for the base block rule — then add this page's Scope step to keep the LAN alive.
▶️ Watch Full VideoYes. The unblocked gaps cover all three private ranges — 10.x.x.x, 172.16 to 172.31.x.x and 192.168.x.x. Whichever one your router uses, local traffic stays open.
This rule controls only connections the app starts (outbound). Connections from other PCs into the app are inbound — governed by inbound rules, which this guide does not change.
For one app, yes. The rest of the PC — browser, Windows Update, other programs — keeps full internet access. Only the selected program is fenced to the LAN.