Blocking the application from accessing the Internet

Discussion in 'Scripting' started by Klarinka14, Jan 9, 2022.

  1. Klarinka14

    Klarinka14 MDL Junior Member

    Oct 22, 2021
    53
    12
    0
    #1 Klarinka14, Jan 9, 2022
    Hi,

    Is there a universal method or command that would force all remote IP calls to be directed to localhost for .exe file aplications?
    (similar functions "hosts" file in WIndows without knowledge of specific IPs)
     
  2. xteam

    xteam MDL Novice

    Jun 23, 2015
    16
    1
    0
    #2 xteam, Jan 9, 2022
    block the application from accessing the internet using windows firewall
     
  3. Klarinka14

    Klarinka14 MDL Junior Member

    Oct 22, 2021
    53
    12
    0
    #3 Klarinka14, Jan 9, 2022 (OP)
    my bad, I forgot to emphasize that I am looking for a method that does not use firewall settings, that the program can easily bypass.
     
  4. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream

    Dec 21, 2012
    6,359
    7,078
    210
    #4 Carlos Detweiller, Jan 9, 2022
    A properly configured firewall cannot be easily bypassed by and program. Not speaking of Windows Firewall, obviously.

    Otherwise, you'd need a local proxy (that handles all traffic) and redirect it to 0.0.0.0 (localhost can cause delays with lots of traffic).
     
  5. Klarinka14

    Klarinka14 MDL Junior Member

    Oct 22, 2021
    53
    12
    0
    #5 Klarinka14, Jan 9, 2022 (OP)
    I was wondering if there was a program on a similar principle as: https://www.nirsoft.net/utils/run_as_date.html

    Which would force/modify the application to communicate only on the local port or at all (all traffic dropped).

    RunAsDate intercepts the kernel API calls that returns the current date and time (GetSystemTime, GetLocalTime, GetSystemTimeAsFileTime, NtQuerySystemTime, GetSystemTimePreciseAsFileTime), and replaces the current

    Isn't there something similar for ports?
     
  6. Carlos Detweiller

    Carlos Detweiller Emperor of Ice-Cream

    Dec 21, 2012
    6,359
    7,078
    210
    #6 Carlos Detweiller, Jan 10, 2022
    Sorry, but I'm not aware of any. The only thing I'm proxy-ing on my machines is DNS (via unbound/Acrylic, which features an extended HOSTS file supporting wildcards and regular expressions), but that excludes direct IP calls.
     
  7. seilent

    seilent MDL Novice

    Apr 2, 2015
    6
    4
    0
    #7 seilent, Jan 11, 2022
    Not quite sure how some app can bypass firewall.
    But maybe you can try proxifier too as alternative. Works for assigning proxy, load balancing, dropping, also can run as service if necessary.
     
  8. Deleted member 1385001

    Deleted member 1385001 Guest

    #8 Deleted member 1385001, Jan 11, 2022
    Last edited by a moderator: Jan 11, 2022
    control panel - windows defender firewall - advanced settings - right click first one on top left - properties - inbound block all outbound block for all three profiles .

    or apply this reg:

    Code:
    
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
"DisableNotifications"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PrivateProfile]
"DisableNotifications"=dword:00000000

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\PublicProfile]
"DisableNotifications"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall"=dword:00000001
"DisableNotifications"=dword:00000000
"DefaultOutboundAction"=dword:00000001
"DefaultInboundAction"=dword:00000001
"DoNotAllowExceptions"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall"=dword:00000001
"DisableNotifications"=dword:00000000
"DefaultOutboundAction"=dword:00000001
"DefaultInboundAction"=dword:00000001
"DoNotAllowExceptions"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=dword:00000001
"DisableNotifications"=dword:00000000
"DefaultOutboundAction"=dword:00000001
"DefaultInboundAction"=dword:00000001
"DoNotAllowExceptions"=dword:00000001
    1 Quest Why are you creating many threads everywhere if you can create a single thread & name it as Help or Urgent help so that all your queries be discussed in a single thread of yours.
    or
    might be you are having fun doing so on MDL.