Block websites on Windows 11 with the firewall
Windows 11 allows you to block outgoing connections to specific IP addresses using the Windows Firewall, without installing any additional software. This procedure can be used to temporarily restrict access to a service, but it's not the same as permanently blocking a domain: modern websites often use multiple addresses, content delivery networks, IPv6, and shared servers.
Direct answer: To block a site with the firewall, you must first find out all its IPv4 and IPv6 addresses and then create a custom exit rule that blocks those IPs. The blocking will work as long as the site continues to use those addresses and the connection doesn't go through a VPN or proxy.
Do not enter a URL like https://ejemplo.com/pagina on the firewall: The standard console works with IP addresses, protocols, ports, and programs, not with specific web pages or paths.
Important limitation before starting
A single IP address can host multiple websites or services. If you block an address shared by a content delivery network (CDN), pages, images, logins, or applications you didn't intend to block might also fail. Therefore, it's a good idea to note which IP address you added and give the rule a clear name so you can quickly disable it.
When is it appropriate to block sites with the firewall?
Firewall blocking is useful when you want to prevent the entire computer—or a specific program—from connecting directly to certain remote addresses. For common distractions, family monitoring, or frequently changing domain lists, there are easier-to-maintain methods.
| Method | What blocks | Main advantage | Limitation |
|---|---|---|---|
| Firewall de Windows | IP addresses and network traffic | It can be applied to the entire team or to a program | IPs can change or be shared |
| Hosts File | Specific hostnames | Simple for a few domains on a PC | Each variant of the domain must be added. |
| Browser extension | Domains, pages, and schedules | Suitable for productivity | It only works in the browser where it is installed. |
| Family Safety | Sites allowed or blocked for a family account | Centralized family management | Microsoft's web filter requires Edge |
| Router or filtered DNS | Domains for multiple devices | It covers the home network | It depends on the router and may require additional configuration. |
What do you need
- An account with administrator privileges in Windows 11.
- The exact domain you want to block, including variations such as
www.ejemplo.comandejemplo.com. - The IPv4 and, if available, IPv6 addresses associated with the domain.
- A record of the added IPs to review or remove the rule later.
1. Find the website's IP addresses
A domain can return more than one address, and results may vary depending on location, internet service provider, or time of the query. To reduce errors, check both the primary domain and its variant with www.
Recommended option: query DNS using PowerShell
- Right-click on Start and open Terminal (Administrator).
- Run the following commands, replacing the example domain:
Resolve-DnsName ejemplo.com -Type A Resolve-DnsName www.ejemplo.com -Type A Resolve-DnsName ejemplo.com -Type AAAA Resolve-DnsName www.ejemplo.com -Type AAAARecord the values in the column IPAddressThe records To correspond to IPv4 and the records AAAA to IPv6. If a query returns no results, it may mean that that variant does not have that type of address.
Check the result more than once. If the site uses dynamic addresses, the list may change. A rule created today may stop blocking it when the domain points to new IPs.
Visual option: check IPs with IPVOID
The original captures use IPVOID. This can serve as a visual check, although an external web tool does not replace local verification and may only show some of the available addresses.
- Access to IPVOID from the browser.
- Enter the site name in the indicated field and select Find Website IP.
- Carefully write down each address that appears on the list.
To better understand what information an address can and cannot reveal, also consult our guide on IP leaks.
2. Create an outbound rule to block the site
With the addresses noted, create a custom rule in the Windows Firewall with advanced securityThe outbound rule prevents programs on the computer from initiating connections to the specified IP addresses.
- Open Windows Search and type Windows Defender Firewall with advanced securityYou can also press Windows + R, write
wf.mscand press To enter.
If the Windows Search or Security app doesn't open correctly, check out our guide on what to do when Windows Security won't open.
- If you have opened the classic firewall view, select Advanced settings.
- In the left panel, select Exit rules.
- In the right panel of Actions, click on New rule.
- In Rule typeselect Customized and press Following.
- In Program, leave the option selected All programs If you want to apply the block to all browsers and applications, select [option]. To limit it to a single application, select [option]. This program access path and choose your executable file.
- In Protocol and ports, keep Any protocol and leaves ports unrestricted. This way the rule won't depend on whether the site uses HTTP, HTTPS, or another port.
- On the screen Scope, located To which remote IP addresses does this rule apply? and brand These IP addresses.
- Select Add Enter each IPv4 or IPv6 address separately. Do not add the domain or protocol.
https://not even a page path.
Advice: Create one rule per site or service instead of mixing many domains into a single rule. This will allow you to quickly identify which block is causing a problem.
- In Actionselect Block the connection and press Following.
- In Profilebrand Domain, Private and Public If you want the blocking to apply across any type of network, and if the computer belongs to an organization, a managed policy can limit or override local rules.
- Assign a descriptive name, for example Block example.com — exitIn the description, note the domain, the added IPs, and the creation date. Then select Finish.
3. Check if the lock works
- Completely close the browser or application that was connected to the site.
- Open it again and try visiting the main domain and its variant with
www. - Try also using another browser installed on the same computer if you chose All programs.
- Check that other frequently used websites are still working.
When the rule matches the remote address, the browser will typically display a connection error, a timeout, or a page similar to the following:
The site continues to open: causes and solutions
Addresses are missing
Repeat the DNS queries for the primary domain, www and other subdomains that the service actually loads. Add any missing IPv4 and IPv6 records.
The IP address changed
The domain may have rotated to a different address. Update the rule with the latest DNS results and remove any IPs that no longer match.
There is a VPN or a proxy
In that case, the firewall can see the connection to the VPN or proxy server, not to the final IP address of the site. Disconnect it to test the direct rule.
The rule is disabled
Verify that it appears with the enabled status, output address, blocking action, and correct network profiles.
If other pages stopped working
Disable the rule immediately. It's likely that one of the blocked IPs belongs to a shared infrastructure. Don't expand the address range to try to "force" the block; you could affect many unrelated services.
Block websites with PowerShell
The same type of rule can be created from PowerShell. Open Terminal (Administrator) and replace the example IPs with the ones you verified. Do not copy addresses from another tutorial: they must correspond to the domain you want to block.
New-NetFirewallRule ` -DisplayName "Bloquear ejemplo.com - salida" ` -Direction Outbound ` -Action Block ` -RemoteAddress "203.0.113.10","2001:db8::10" ` -Profile AnyTo disable, re-enable, or remove it:
Disable-NetFirewallRule -DisplayName "Block example.com - exit" Enable-NetFirewallRule -DisplayName "Block example.com - exit" Remove-NetFirewallRule -DisplayName "Block example.com - exit"The directions 203.0.113.10 and 2001:db8::10 These are examples reserved for documentation purposes. They don't block a real site. Replace them with the addresses obtained from your own query.
How to disable or delete the rule
Disabling preserves the settings for later use. Deleting permanently removes the rule. For testing or temporary blocking, it's best to disable it first.
- Open Windows Firewall and select Advanced settings.
- On the left panel, enter Exit rules.
- Locate the rule by the name you assigned, right-click, and select Disable ruleTo delete it, use Eliminate.
After disabling it, close and reopen your browser. Access should be restored, unless there is another block in the Hosts file, an extension, your router, DNS, or a managed policy.
Other ways to block sites in Windows 11
Hosts file: appropriate for a few domains
The Hosts file allows you to associate a specific name with a local address, for example 127.0.0.1 or ::1It's more intuitive than maintaining a list of remote IPs, but you must add each name you want to block, such as the main domain and the variant with wwwAdditionally, some applications may use other subdomains or external services.
127.0.0.1 ejemplo.com 127.0.0.1 www.ejemplo.com ::1 ejemplo.com ::1 www.ejemplo.comThe file is usually located in C:\Windows\System32\drivers\etc\hosts It requires administrator privileges to save. Make a copy before modifying it and avoid downloading Hosts files from unknown sources.
Chrome or Edge extensions: best for controlling distractions
Extensions like BlockSite or StayFocusd They allow you to create schedules, limits, or lists of pages without managing IP addresses. Install them only from the official store, check the developer, the update date, and the permissions requested, as a blocker needs browsing access to recognize websites.
Microsoft Family Safety: Family account control
For a child or family account, Microsoft Family Safety allows you to authorize or block websites and apply content filters. Its main limitation is that the web and search filters work with Microsoft Edge and require the user to use their configured Microsoft account.
Router or filtered DNS: for multiple devices
If the goal is to block a domain on computers, phones, TVs, and game consoles on the same network, a router rule or a filtered DNS service is usually more scalable. The procedure depends on the router model and may not apply if a device uses a VPN, mobile data, or an independently configured DNS.
Frequently Asked Questions
Can a firewall block a specific page within a website?
Not through a normal IP rule. With HTTPS, the firewall doesn't manage routes like that. /videos or /newsTo block specific pages or sections, use an extension, a filtering proxy, or a web control solution.
Does the rule block the site in all browsers?
Yes, provided you have chosen All programs and the traffic goes directly to an IP address included in the rule. A VPN, a proxy, a new domain address, or an intermediary service can prevent the connection from matching.
Can I block the site in only one browser?
Yes. In the stage Program, select the browser executable path instead of All programsAnother simpler option is to use an extension installed only in that browser.
Does the block also affect my phone?
No. A rule created in Windows Firewall only applies to that computer. To cover other devices, configure blocking on each one, or use your router or a filtered DNS server.
Why does a blocking rule take precedence over a permitting rule?
Windows Firewall prioritizes explicit blocks when a conflict exists. Therefore, an overly broad rule might block connections that another rule is trying to allow.
Which method to choose to block sites in Windows 11
To temporarily block connections to specific IP addresses or restrict a program, a firewall outbound rule is sufficient. For one or two domains on a single PC, the Hosts file is usually easier to maintain. To control distractions with scheduled access, a file extension is more practical; and for multiple users or devices, it's best to apply filtering through Family Safety, the router, or a DNS service.
The key is not to confuse an IP block with a permanent domain block. After creating the rule, test other services, keep a list of used addresses, and review the configuration if the site becomes available again or if unexpected errors occur.
Sources and official documentation
- Microsoft Learn: Windows Firewall Rules.
- Microsoft Learn: Resolve-DnsName.
- Microsoft Support: Restoring the Hosts file in Windows 11.
- Microsoft Support: filtros web de Family Safety.
- Google Chrome: Install and manage extensions.
Guide revised for Windows 11 in July 2026. The exact names of some menus may vary slightly depending on the language and installed build.
