How to Block a Website or IP Address with Windows Defender Firewall

Windows Defender Firewall can block outbound connections to a specific IP address, which is a quick way to stop a program or your whole PC f...

Windows Defender Firewall can block outbound connections to a specific IP address, which is a quick way to stop a program or your whole PC from reaching a particular server. In this guide I show you both the point-and-click method and the faster PowerShell method, how to find a site's IP with nslookup, and — just as important — where this approach falls short so you don't rely on it for something it can't do.

Prefer video? Here is the walkthrough:

Block vs Allow: Which Direction?

The firewall has inbound rules (traffic coming into your PC) and outbound rules (traffic your PC sends out). To stop your computer from reaching a website, you want an outbound rule that blocks traffic to that site's IP address. The old version of this tutorial focused on inbound rules, but for blocking a website that you visit, outbound is the correct direction — your browser initiates the connection outward.

Figure: An outbound rule drops traffic to the blocked IP while everything else still reaches the Internet

Step 1: Find the Website's IP Address

The firewall works on IP addresses, not on names like example.com, so first translate the name. Open Command Prompt and run nslookup:

nslookup example.com

You will get output similar to this:

Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    example.com
Addresses:  203.0.113.10
          203.0.113.11

The address under the Non-authoritative answer section is the one you block. Note that many sites return several addresses — write them all down, because you will need a rule entry for each. The first few lines show which DNS server answered, not the site itself. (The addresses in this guide are documentation examples from the 203.0.113.0/24 range; use whatever your own nslookup returns.)

Step 2: Block the IP with the Firewall GUI

Open the advanced firewall console:

1. Press Win + R, type wf.msc, and press Enter. This opens Windows Defender Firewall with Advanced Security.
2. In the left pane, click Outbound Rules.
3. In the right pane, click New Rule….

The New Outbound Rule Wizard opens. Work through it:

1. Rule Type: choose Custom, then Next. Custom is the only type that lets you specify a remote IP.
2. Program: leave All programs selected (this blocks the IP for the whole PC), then Next.
3. Protocol and Ports: leave Protocol type as Any, then Next.
4. Scope: this is the key screen. Under Which remote IP addresses does this rule apply to? select These IP addresses, click Add, and type the IP from Step 1 (for example 203.0.113.10). Add each address the site resolved to. Then Next.
5. Action: choose Block the connection, then Next.
6. Profile: leave Domain, Private, and Public all ticked so the rule applies on every network, then Next.
7. Name: give it something you will recognize later, such as Block example.com, and click Finish.

The rule takes effect immediately. The "Scope" screen is where most people get stuck, because the earlier tutorial didn't mention it — the "These IP addresses" option only appears there, not on the Program or Action pages.

Step 3: The Same Thing in One Line with PowerShell

If you block IPs often, the GUI is slow. PowerShell does it in a single command. Open PowerShell as Administrator (right-click, Run as administrator) and run:

New-NetFirewallRule -DisplayName "Block example.com" -Direction Outbound -Action Block -RemoteAddress 203.0.113.10

Breaking that down: -DisplayName is the rule name you'll see in wf.msc; -Direction Outbound blocks traffic leaving your PC; -Action Block drops it; and -RemoteAddress is the IP to block. You can block several addresses in one rule by separating them with commas:

New-NetFirewallRule -DisplayName "Block example.com" -Direction Outbound -Action Block -RemoteAddress 203.0.113.10,203.0.113.11

To confirm the rule exists:

Get-NetFirewallRule -DisplayName "Block example.com"

And to remove it later:

Remove-NetFirewallRule -DisplayName "Block example.com"

Creating and removing rules requires an elevated prompt; in a normal PowerShell window New-NetFirewallRule and Remove-NetFirewallRule return an access-denied error.

Step 4: Test the Block

Try to reach the site in a browser, or ping the IP from Command Prompt:

ping 203.0.113.10

You should see Request timed out or General failure, and the website should fail to load. If it still loads, the site is probably resolving to a different IP than the one you blocked — see the limitations below.

One thing worth knowing while you test: your browser and the operating system cache DNS answers and web pages, so a site may appear to load for a short while even after the rule is active. Clear the DNS resolver cache from Command Prompt with ipconfig /flushdns, then try again in a fresh browser tab or a private window. If you are blocking the IP for a single program rather than the whole PC, re-run the wizard and, on the Program page, choose This program path and browse to that application's executable — the rule then applies only to that program's outbound traffic and leaves everything else alone.

Important Limitations

Blocking a website by IP in the firewall is handy, but it is a blunt tool. Know what it cannot do:

• Websites change IP addresses. Large sites, and anything behind a CDN like Cloudflare, Akamai, or a cloud provider, serve from many addresses that rotate over time. The IP you block today may not be the one the site uses tomorrow, so the block quietly stops working.
• One site can be many IPs. A single domain may resolve to a dozen addresses. Block one and the browser simply uses another. You would have to block them all, and the list keeps changing.
• Shared IPs cause collateral damage. CDNs host thousands of unrelated sites on the same IP. Block that address and you may knock out many other sites you actually wanted.
• It does not read the website name. Defender Firewall matches only on addresses, ports, protocols and programs. It has no option to match the hostname (the HTTP Host header or the TLS SNI field), so it cannot block by domain name the way a web filter or DNS filter can.

Better Alternatives for Some Jobs

Depending on what you are trying to do, another tool may fit better:

• Hosts file — for blocking a site by name on one PC. Edit C:\Windows\System32\drivers\etc\hosts as Administrator and add lines like 0.0.0.0 example.com and 0.0.0.0 www.example.com. This points the name at an unusable address. It is name-based, so it survives IP changes, but it is easy to bypass and does not cover subdomains automatically.
• DNS filtering — for blocking by name across a whole network. Services such as a Pi-hole on your LAN, or a filtering DNS resolver, block domains at lookup time for every device. This is the cleanest way to block a site reliably, because it works on the name before any IP is chosen.
• Router or parental-control software — for blocking on all devices in the house, often with category-based filtering and schedules.

Use the firewall when you need to block a specific server or IP for a specific machine. Use the hosts file or DNS filtering when you want to block a website by name reliably.

Summary

To block an IP on one PC: find the address with nslookup, then create an outbound rule that blocks that remote IP — through the wf.msc wizard (remember the Scope page) or in one line with New-NetFirewallRule. Just remember the firewall only understands IP addresses, so for blocking a whole website by name — especially a big one behind a CDN — a hosts-file entry or DNS filtering will serve you far better.

Related tutorials

• Site-to-Site IPsec VPN on Cisco Routers: Packet Tracer Lab
• Wi-Fi vs Ethernet: Comparing WLANs and Wired LANs

Sources

• Microsoft, "Windows Defender Firewall with Advanced Security" documentation
• Microsoft, "New-NetFirewallRule" PowerShell reference