Outbound firewall for WindowsReal firewall rules100% on device
What is your PC
talking to?
The first time an app Blockr doesn't recognize connects, Blockr blocks it and asks you. Allow it and the retry gets through in seconds; block it and it's gone for good. Every connection your PC makes, logged with its verdict. And your answers become real rules in Windows Firewall itself, so they hold even when Blockr is closed.
Coming soon for Windows
See Features
v1.1.0 beta · Windows 10 (1809+) & 11 · 64-bit · Protects with the window closed · No account
01 How it works
Install. Watch. Answer. Enforce.
Install, once
Approve one administrator prompt and Blockr installs into Program Files with its service, which starts with Windows and does the watching and the blocking. The window you use never asks for administrator rights again.
Watch the traffic
Every outbound TCP and UDP connection appears live, grouped by the app that made it, with the host, the port, and a plain Allowed or Blocked verdict.
Answer when asked
The first time an app Blockr doesn't recognize connects, it's blocked and you're asked. That first attempt fails. Choose Allow and the app's retry gets through, usually within seconds.
Enforced, even with the window closed
Your answers become real Windows Firewall rules named
Blockr: …, and Blockr's service keeps catching new apps while the window is closed. Audit the rules yourself any time.02 Features
Every connection, and the rules to match.
A live log of everything your apps reach, alerts for anything new, and rules that are honest about what Windows Firewall can and can't enforce.
Connection alerts
The first time an app Blockr doesn't recognize connects, it's blocked and you're asked: the app name, the exact executable path, and where it's trying to reach. Choosing Allow clears the block immediately, so the app's own retry gets through.
The headline
Per-app and per-host rules
Block an app outright, or scope a rule to one destination: an exact host, an IP or CIDR range (
Two levels
10.0.0.0/8), or a wildcard like *.example.com, with an optional port. Host rules override the app's overall rule.Real Windows Firewall rules
Every app decision and every literal-IP host rule is mirrored as a real, auditable outbound block rule named
Auditable
Blockr: … and grouped under Blockr, so an app you blocked stays blocked even while Blockr's service is stopped.Honest about what can't mirror
Windows Firewall matches IP addresses, not hostnames. It has no equivalent of a wildcard host rule. Those rules are enforced by Blockr's service while it runs and carry a plain "Blockr only" badge, never disguised as something Windows itself is doing.
No overclaiming
Blocklists
Subscribe to a published list of ad, tracker and malware domains (StevenBlack, oisd, HaGeZi or 1Hosts, one tier each) and it is blocked for every app, without a rule for each name. Check a domain says which list blocks it, and one click makes an exception. On Windows a list matches the names Windows looked up, so the first connection to a listed name can get through before Blockr sees it.
Ads, trackers, malware
Network profiles
Give a network its own rules: home, the office, the café's Wi-Fi. Blockr tells networks apart the way Windows does, puts the right rules into Windows Firewall within seconds of you joining one, and nothing about the network leaves your PC.
Per network
The Map
The countries your apps reach and where Blockr turned connections away, on a calm world map with a full table beside it that a screen reader can read and sort. The country data ships with Blockr and is read offline: no address is ever sent anywhere to place it.
Offline
Rule tools
Rules that run out by themselves, rules you can switch off without deleting, a check that names rules doing nothing, import and export (Blockr's own format, hosts files, domain lists), hiding a noisy app from the log, trusting Windows' own components, matching rules against the names Windows looked up, and a Not blocking warning when Windows Firewall itself is off.
Control
Stays on watch
Blockr's service starts with Windows and watches whether or not the window is open: a new app is blocked first and its alert waits for you. Closing the window keeps Blockr in the notification area, where alerts still appear; its icon shows the state at a glance, and its menu pauses, resumes or quits.
Always on
Live connection log
Every connection with its app, remote host, port, protocol, verdict and time. Search by app, host or port, filter to just what was blocked, sort any column. It's kept across launches.
Searchable
Hostnames, not just IPs
Reverse DNS turns a raw address into a hostname you recognize, resolved in the background and cached, so the log reads like something you can act on without slowing the monitor down.
Readable
Confirmation from Windows itself
Where the Filtering Platform Connection audit policy is switched on, Blockr reads the matching security events as independent confirmation of what it blocked. Blockr never turns that policy on for you: Settings shows the exact command and what it costs, and leaves the choice to you.
Independent evidence
Clean removal
Settings ▸ Firewall and Blockr's service ▸ Remove all Blockr firewall rules deletes every rule Blockr created and nothing else. The uninstaller stops the service and runs the same cleanup automatically, so removing Blockr never leaves a machine with apps silently still blocked.
No orphaned rules
Pause protection
Pause for a set time or until you resume. Nothing new is blocked and nothing is asked while paused. Rules you've already made stay in force the whole time.
Temporary
Export & clear
Export the connection log to CSV or JSON whenever you want a record outside the app, and clear it from Settings whenever you don't.
Your data
Updates itself
Blockr checks for a new version and installs it in place (the Windows equivalent of what Sparkle does on the Mac build, since there's no Sparkle here), with one administrator approval, as at install. Nothing downloads or installs without a valid, matching signature.
Stays current
100% on your PC
No account, no usage analytics, nothing about your traffic uploaded. Blockr decides at the moment a connection is seen and never inspects, decrypts or proxies what flows through it.
Privacy
13 languages
English, Spanish, French, German, Italian, Portuguese (BR), Dutch, Polish, Russian, Turkish, Japanese, Simplified Chinese and Korean, detected from your Windows display-language settings.
Localized
Built for everyone
Full keyboard operation, visible focus, screen-reader labels and live regions on every alert, a layout that holds at 380 pixels wide, and every verdict shown with an icon and a word, never color alone. Every state of the window goes through an automated accessibility audit in both color schemes, which finds what such a tool can find; the WCAG criteria it has no rule for, zoom and reflow and timing among them, are covered by keyboard and layout tests instead, and our accessibility report names each one and its evidence. No person has used a screen reader or a real Windows contrast theme on it yet, so neither is claimed.
Audited, not yet certified
03 What a rule can target
Whole app
Exact host
Wildcard host
IP address
CIDR range
Optional port
TCP
UDP
IPv4
IPv6
04 Beta
You're testing the first Windows build.
Blockr has been on the Mac for a while, holding connections open through Apple's Network Extension framework while you decide. This build enforces your answers through Windows Firewall itself, a different mechanism with two honest differences, listed in the questions below. Because this is a firewall, getting block and allow decisions right matters more here than in almost any other app I make.
What would help most
Real block/allow decisions
Block an app you actually rely on, on purpose, and confirm it truly can't reach the network. Then Allow it and confirm the very next attempt gets through. That loop is the whole product. Tell me if any part of it doesn't hold.
Blockr's service
Close Blockr's window, then run an app that has never connected: check it is blocked, and that its alert is waiting when you open Blockr. Stop the service from Services and check the window says so; start it again from Settings. Restart the PC with an alert waiting and see whether it is still there.
What's really in Windows Firewall
Open Windows Defender Firewall with Advanced Security yourself. Check the rules Blockr claims to have written are really there, really named Blockr: …, and really gone after you remove or uninstall.
The install itself
Whether SmartScreen let you through, whether the shortcut and taskbar icon look right, and whether uninstalling truly leaves nothing behind, including the service and the firewall rules.
Please don't share this link publicly yet. It's not announced, and the download URL will change at launch.
06 Pricing
Free for you. Fair for work.
Personal use is free forever: every feature, unlimited rules, no key, no account, no watermarks. If Blockr earns its keep at your job, a one-time business license keeps it supported.
Personal
Free forever
For individuals and personal projects
- The full firewall, every feature
- Unlimited rules, per app and per host
- Connection alerts, live log, CSV/JSON export
- Rules written into Windows Firewall
- 100% on-device, nothing uploaded
- Free updates forever
Business
$19 / computer
One-time payment, no subscription
- Everything in Personal
- Use commercially at work
- One-time payment, no subscription
- Free updates forever
- Supports solo indie development
The personal tier is the full app. Buy a business license only if you use Blockr commercially. One seat per computer, paid once, yours for life. Secure checkout via Stripe; your license key is emailed instantly. The same key works on the Mac build.
07 Download & install
Get set up in about a minute.
Run the installer and approve one administrator prompt: Blockr installs into Program Files with the service that does its blocking. After that, the window you use never needs administrator rights.
Coming soon for Windows
Version 1.1.0 beta · Blockr-Setup.exe · about 14 MB · Free updates forever
Windows 10 (version 1809 or later) or Windows 11 · 64-bit
Everything Blockr needs is inside the installer: no Python, no runtime to chase down. It does use the Microsoft Edge WebView2 Runtime to draw its interface, which ships with Windows 11 and reaches almost every Windows 10 machine through Windows Update. On the rare PC without it, Blockr will say so on launch and Microsoft's free installer is a one-click fix.
An administrator installs it, once
Blockr installs into
C:\Program Files\Blockr with a small Windows service, BlockrService, that watches connections and writes Blockr's firewall rules. Adding a service is something only an administrator can do, so Setup asks once. An earlier copy installed for your account alone is replaced, and your rules carry over. Uninstall from Settings → Apps → Installed apps like anything else.The window never runs as administrator
Blockr is a firewall: creating and removing Windows Firewall rules is a privileged operation, and Windows requires administrator rights for it. So Blockr's service does it, run by Windows itself, and the window you use never asks for elevation. An administrator's window changes rules and answers alerts as it is. A standard user's window shows that account's own connections and the rules, read only, and an alert about one of their own apps waits, blocked, for an administrator. If the service isn't running, the window says so, and an administrator can start it from Settings with one prompt. It never fails silently.
The first connection from a new app fails, on purpose
Windows has no way to hold a connection open while you decide, unlike the Mac version. When an app Blockr doesn't recognize connects, Blockr blocks it and then asks. That first attempt genuinely fails. Choose Allow and Blockr removes the block immediately; most apps retry within seconds and the next attempt gets through. The alternative would need a kernel-level filter driver, and Blockr for Windows deliberately ships without one, so it installs and uninstalls as cleanly as any ordinary app.
Windows may warn you the first time. Here's the honest story.
Blockr is Authenticode-signed, so the publisher shows as a real, verified name rather than "Unknown publisher." But signing alone does not switch SmartScreen off: Microsoft builds reputation per file, and a brand-new build starts with none. Until this exact file has been downloaded enough times, you may still see a blue "Windows protected your PC" box.
- Click More info
- Check the publisher name shown
- Click Run anyway
08 FAQ
Common questions.
Is Blockr really free?
Personal use is free forever: the full firewall, unlimited rules, no account, no trial timer, no nag screens. If you use Blockr at work, a one-time $19 business license per computer keeps it supported.
Does Blockr need administrator rights?
To install, yes, once: Setup adds a small Windows service, and only an administrator can do that. To run, no: the window never asks for elevation. Blockr's service, started by Windows, creates and removes the firewall rules, because Windows requires administrator rights for that specific operation. An administrator's window changes rules and answers alerts as it is; a standard user's window shows that account's own connections and the rules. If the service is stopped, Blockr says so plainly; it never pretends to be blocking when it isn't.
What happens when an app I've never seen connects?
Blockr blocks it immediately, then shows an alert naming the app, its exact executable path, and where it's going. You can Allow or Block, remember the answer as a rule or not, and scope it to the whole app or just that one host. Because the block happens before the alert, that first connection attempt genuinely fails. See the next question.
Why did my app fail to connect the first time?
Windows has no way to hold a connection open while a person decides, so Blockr can't pause it the way the Mac build does. Instead it blocks the connection immediately and asks you right after. If you choose Allow, Blockr removes the block and the app's own retry (which most well-behaved apps attempt within seconds) gets through normally. If you never see the app again, it probably already succeeded quietly on retry.
Can I allow an app but block one destination?
Yes, that's what host rules are for. A host rule overrides the app's overall rule, so you can allow an app in general and still block a single tracker, an analytics endpoint, or a whole domain with a wildcard like
*.example.com. Rules for a literal IP address or range become real Windows Firewall rules; rules for a hostname or wildcard can't be, since Windows Firewall only matches addresses. Those are enforced by Blockr itself and carry a "Blockr only" badge so you always know which kind you're looking at.Why doesn't Blockr just pause the connection, like it does on Mac?
On macOS, Blockr uses a Network Extension, a system extension Apple provides for exactly this, which can genuinely hold a connection open while you decide. Windows has no equivalent way to do that from ordinary application code: reaching it would mean shipping a kernel filter driver. Blockr for Windows deliberately ships without one, so it installs and uninstalls exactly like any other application, with no reboot and no driver-signing baggage. The trade-off is the "blocks first, asks after" behavior described above. It's a real difference from the Mac build, and it's documented here rather than smoothed over.
What happens when I close Blockr's window?
Blockr keeps running in the notification area by the clock and still brings up alerts, the way Blockr for Mac stays in the menu bar; its service keeps watching either way. Its icon shows the state at a glance and its menu pauses, resumes or quits. To close Blockr altogether, right-click the icon and choose Quit Blockr, or press Ctrl+Q in the window: alerts about new apps then wait, with the apps blocked, until you open Blockr again.
What happens when Blockr's window isn't open?
Nothing changes about protection. Blockr's service starts with Windows and runs whether or not anyone has Blockr open: a brand-new app is blocked first, as always, and its alert waits until you open Blockr. Rules already in Windows Firewall keep working even if the service itself is stopped; that's the whole point of writing them there. While the service is stopped, nothing new is blocked, and the window says so.
Does Blockr upload anything?
No. Every connection record, rule and hostname stays on your PC: there is no account and no usage analytics, and Blockr never sends your traffic anywhere. The only network calls it makes are an optional reverse-DNS lookup (to resolve a hostname you're already connecting to), a weekly check for a new version, (only if you buy one) validating a business-license key, and (only for the blocklists you subscribe to) downloading each list straight from its publisher, at most once a day:
raw.githubusercontent.com for HaGeZi, 1Hosts and StevenBlack, oisd.nl for oisd. The country data behind the Map ships with Blockr and is read offline.Will Windows warn me the first time I run Blockr?
Possibly, even though the installer is signed. SmartScreen builds trust per file over downloads and time, and a fresh build starts from zero. Code signing gives you a verified publisher name in the dialog but doesn't skip the warning by itself. Click More info → check the publisher → Run anyway. See the install section for the full explanation.
How do I update Blockr?
It updates itself. Blockr checks for a new version and, when one exists, downloads the installer, verifies its signature and version before running anything, installs over itself (with one administrator approval, as at install) and reopens. If any of those checks fail it deletes the download and sends you to this page instead. Your rules, history and settings carry over.
How is this different from the Mac version?
Same rules, same intent, a different enforcement mechanism. Mac Blockr holds new connections open through a Network Extension (a system extension, not a kernel component); Windows Blockr blocks first and asks after, because there's no driver to hold anything open. Both keep protecting with their window closed: Mac Blockr through its system extension, Windows Blockr through its service. Host rules for a hostname or wildcard apply on Windows while Blockr's service runs, since Windows Firewall can't match names the way the Mac filter can. Everything else (the alert, the rule model, the log) works the same way on both.
What does uninstalling remove?
The uninstaller stops Blockr's service, removes every Windows Firewall rule named
Blockr: … (because leaving firewall rules behind with no app left to manage them would be worse than not cleaning up at all), removes the service, and deletes the application from C:\Program Files\Blockr. If the rules can't be removed, it tells you exactly how to remove them yourself in Windows Defender Firewall with Advanced Security. Your rules and history in %ProgramData%\Blockr, and the window's settings in %APPDATA%\Blockr, are left in place so reinstalling picks up where you left off; delete those folders to remove them too.