Blocking: rules and what they actually do
One-click blocks, country and category rules, the two engines, and exactly what a blocked app experiences.
Blocking is the part that changes your machine, so it's worth understanding precisely what a rule does before you make one. The short version: a blocked program is not killed, not quarantined, and not modified. It loses network access, and it behaves exactly as it would on a machine with no internet.
What a blocked app actually experiences
Its connection attempts fail. What that looks like depends entirely on how well the program handles losing the network — which varies enormously:
- A well-written app shows “no connection” and retries later.
- A badly written one hangs on a timeout, sometimes for 30 seconds, sometimes forever.
- An app that checks a license online at startup may refuse to run at all.
- Anything mid-transfer loses that transfer. A block takes effect immediately, not at the next restart.
svchost.exe wholesale will break Windows Update, time sync, license activation, and more, because dozens of services share that process. If a svchost row is what caught your eye, read the Service column and deal with the service, not the host process.The kinds of rule
| Rule | Scope | Notes |
|---|---|---|
| Block this app | Every connection by that executable | The common case. Keyed to the program's path, so an update in place keeps the rule. |
| Block a country | All traffic to addresses geolocated there | Geolocation is approximate and CDNs move. Expect occasional surprises. |
| Block a category | Sites classified in that category | Shares its list with parental controls. |
| Block everything | All outbound traffic | The panic switch. Remote sessions and any live download die with it — including, on a remote machine, your way back in. |
Ask before a new app connects
Approval mode intercepts the first time a program you've never seen tries to reach the internet, and asks. There are three answers: allow once, allow permanently, or block. It's the most informative way to run NetSecWall for the first week and the most annoying way to run it forever. Most people use it briefly, answer the prompts, then turn it off with a rule set that reflects their actual machine.
Every rule is listed in one place, along with where it came from, and you can remove any of them from there.
Rules persist. That's the point, and the risk.
A block survives reboots, and — with the Windows Firewall engine — survives NetSecWall not running. That's deliberate: a rule that evaporates when the app closes is not protection. The flip side is that if you block something and forget, then three weeks later wonder why an app is broken, nothing will remind you. The Rules tab is the first place to look when something stops working.
Choosing an engine
Both engines block the same things; they differ in where the rule lives. See the comparison in How NetSecWall works. In practice:
- If nothing else manages your firewall, use the Windows Firewall engine.
- If a security suite already does, switch to the packet filter or use Companion mode, so the two don't overwrite each other.
Switching engines re-applies your existing rules through the new one. Rules made by the old engine are removed as part of the switch, so you shouldn't end up with both enforcing.
Undoing a block
Remove the rule in the Rules tab and it stops applying immediately — there's no reboot and no waiting period. An app that was hung on a timeout may need restarting before it notices, which is the app's behavior rather than the firewall's.
Still stuck? Open a support ticket — we reply within one business day.