Block apps from accessing internet by default...

I consider my usage 'low risk'. Thats because I always scan every executable that I download with the resident security solution (BitDefender/ Norton/ Malwarebytes/ etc.), then I upload the file to virustotal.com for a second opinion. Only then I actually install the software, and I also pay attention to the options the installer gives to avoid unasked bundles. Despite all that, I have made a mistake a handful of time with very well known softwares like FileZilla, etc. And yeah, I always download from the official site, unless they link me to something like sourceforge, etc.

Given that I do believe that my usage behaviour constitutes 'low risk', I have also decided to stick with Windows Defender & Windows Firewall for security, despite having over a year remaining in my current BitDefender Total 2020 subscription. Thats because I want to keep my system as lean/ lightweight, and therefore as fast, as possible.

On a personal level, I like to have variety on a few choices, and therefore I like testing/ experimenting with stuff. This also has the benefit of not monopolising existing players, and giving opportunities for new developers to bring out new products and support development. 

Before installing any software, I read several online reviews before narrowing down my choice. For example, there is no video file that VLC can't play, yet I wanted to try a different video player because I was tired of VLC interface. So based on several reviews, I found most of them recommended PotPlayer, so I tried it out. But I found that upon launching, it started giving me video recommendations, and I don't like that 'feature'. I just want it to play my local files and do absolutely nothing more. One way of doing that is to completely disable internet access to that app. I will update it as and when I want. Same principle holds true for other apps too.

While it is a good practice to stick with tried and tested softwares (by the way the latest version of VLC is flagged by one of the engines on VirusTotal) only, I think it is also fine to try a few other alternatives available in the market.

As with sticking with Store apps alone, while I too want to move in that direction, but we know that some of the best solutions live outside the store (probably to increase developer income) for genuine reasons. Why not support those? I don't mind paying for a software, but only as long as I am able to put sufficient safeguards in place.

By the way, what do you think about TinyWall (https://tinywall.pados.hu/)? It seems to have the ability to allow LAN only access, something I (desperately) want.

Ideally, I would like to configure the Firewall to Block by default all outbound rules (just like how it is for inbound rules), and then add exceptions (whitelisting) as and when a program requests. While I know how to change the default setting, I don't know how to whitelist all existing rules (which are allowed by default in a fresh Windows installation). If this can be done in a simple way, a batch file such as the one in the link would be unnecessary.

I found this link:

https://old.reddit.com/r/Piracy/comments/btxlmc/how_to_automatically_add_everything_in_a_folder/epr971j/

Basically, running the following command in Powershell as Administrator will automate this process:

Get-ChildItem -Path C:\Programs -Filter *.exe |

Select-Object Name,FullName |

ForEach-Object `

{New-NetFirewallRule -DisplayName "Block $($_.Name) Inbound" -Direction Inbound -Program "$($_.FullName)" -Action Block;

New-NetFirewallRule -DisplayName "Block $($_.Name) Outbound" -Direction Outbound -Program "$($_.FullName)" -Action Block}

Get-ChildItem -Path C:\Programs -Filter *.dll |

Select-Object Name,FullName |

ForEach-Object `

{New-NetFirewallRule -DisplayName "Block $($_.Name) Inbound" -Direction Inbound -Program "$($_.FullName)" -Action Block;

New-NetFirewallRule -DisplayName "Block $($_.Name) Outbound" -Direction Outbound -Program "$($_.FullName)" -Action Block}

Here, C:\Programs is the folder where I am installing the programs. You have to change that to the location where you install your programs.

That said, I have already run both the above commands on my computer. The question is will this keep duplicating the firewall entries as before? Or only add the new ones?

Further, has anyone set this up successfully?

Sounds to me like you've defined your own personal issue, which is wanting to download software from anywhere and install all sorts of potentially risky software, but wanting to protect from something unexpected getting through that potentially risky activity.

Most of us have learned that avoiding this practice of installing and testing all sorts of software is the better method, carefully choosing the relative handful of important apps and only installing from the vendors or another highly vetted source like the Microsoft Windows 10 Store.

This is the direction that Microsoft has taken with Windows 10 S mode, not only limiting apps to the Store, but also removing most of the vulnerabilities from the operating system itself that have consistently led to malware.  On top of this, it removes many of the scripting and other tools that have been abused and sandboxes apps which only have limited ability to access the operating system and none to modify it.

This is where Microsoft is focusing efforts, with the obvious eventual intent to drop Windows traditional desktop and executables completely, since that's the true problem you're trying to solve with a firewall workaround.

You're putting lots of effort into an unwinnable game, playing with potential malware rather than truly avoiding it.  I've seen this many times in my computing career, while the only methods that truly work are always much simpler.

Rob

3. Running the batch every time will indeed create duplicate firewall rules. I wish there was some built-in checks that prevents duplication.

For now, the only solution I can think of (and tested to confirm it works) is to reset the Firewall to default settings every time before running the batch file. That way there won't be any duplication.

I hope someone helps with answering the remaining questions.

Thanks.