How to Block an App's Internet Access: Android and Windows in 2026

Why block internet access for an app

Fully cutting network access for a single app isn't exotic — it's a practical privacy tool. LiMP VPN for Android has built-in app filtering: you can choose which apps route through the VPN tunnel and which go around it, without installing a separate firewall; see the LiMP VPN features page for details. Here are five typical scenarios.

• An offline app (flashlight, calculator, document scanner) quietly sends telemetry and analytics — it doesn't need network access to function, but its developer wants the data.
• An APK installed from a third-party source, or a cracked version of a paid app — risky to let it reach the internet until you've verified it isn't "phoning home."
• You cancelled a subscription inside an app, but it keeps checking payment status and sending reminders — cutting its network access is simpler than digging through its settings.
• Your kid's phone has games that should only work offline — no access to stores, chats, or in-game ad networks.
• On roaming or a limited data plan, you need to temporarily cut "heavy" apps — streaming, cloud sync — off mobile data while keeping only messaging and maps working.

A related reason is reviewing the permissions an app already has: even if it honestly requested camera or microphone access, that doesn't mean it needs network access right now.

What Android itself can do without third-party apps

Before installing a firewall, check the built-in settings first — for many scenarios, they're enough.

Turn off background data

Settings → Apps → the app in question → Data usage (or "Mobile data & Wi-Fi") → turn off "Background data." This doesn't block the network completely: while the app is open and active on screen, it still has internet access. As soon as you minimize it or lock the screen, its network access disappears. For most scenarios from the list above (background telemetry, "phoning home" after cancelling a subscription), this is enough and doesn't require third-party apps.

Data Saver

A global toggle (usually under "Data usage" or "Network & internet") limits background data exchange for all apps at once, but lets you add exceptions for specific apps. Handy if you want to save data overall rather than block one app completely — which fits the roaming scenario better than a single targeted block.

Samsung One UI: allowed networks per app

Samsung devices have a more granular setting: Settings → Connections → Data usage → the per-app allowed-networks section (depending on the One UI version, it may be labeled "Mobile data only" for apps or similar). There, for each app, you can choose Wi-Fi, mobile data, both, or neither — and "neither" is exactly a full network block for that specific app, straight from system settings, no firewall needed.

Xiaomi and HyperOS: per-app network access

On Xiaomi, the equivalent feature is usually under Security → Data usage (or "Network connections" in HyperOS) → a list of apps with separate Wi-Fi and mobile-data toggles. The exact wording changes between MIUI/HyperOS versions, but the underlying logic — choosing network access per app — has stayed the same for several generations.

One caveat applies to "stock" Android — a Pixel, for example: there's no app-level network switch there, only background data and the overall Data Saver option above. A full network block for an arbitrary app on such a device is only possible through a firewall, covered below.

No-root firewalls on Android: how they work and why they conflict with VPN

Firewalls like NetGuard, NoRoot Firewall, or RethinkDNS don't require root — which means they technically can't intercept traffic at the kernel level the way a classic Linux firewall does. Instead, they use the public VpnService system API: the app registers itself as a local VPN tunnel, all device traffic logically passes through it, and the firewall decides whether to let a given app's packets through or drop them. Traffic never leaves to an external server — this isn't a proxy or a real VPN, just a mechanism Android provides for local interception. While such a firewall is active, the status bar shows a key icon — the same indicator used for an active VPN.

The limitation is built into the platform itself: Android supports only one active VpnService at a time. Turn on NetGuard's firewall and it takes that slot; as soon as you connect LiMP VPN (or any other VPN client), the system revokes the firewall and switches on the VPN, and vice versa. You can't keep both active at once — this isn't a bug in any one app, it's an architectural limit of Android. If the firewall has an Always-On mode enabled, trying to launch a VPN client can cause "flapping," where the two services keep snatching the slot back and forth from each other.

If you still need such a firewall (say, for fine-grained control over which apps have network access at all), it matters which one you install. Safe choices are open-source apps (you can review the code — NetGuard's is public on GitHub) or well-reviewed apps from Google Play with a solid reputation. A separate risk is apps that disguise themselves as a "privacy firewall" while actually intercepting your traffic and sending it to a third-party server — the same threat that applies to malicious VPN apps, just with a firewall doing the disguising instead of a VPN. RethinkDNS is more interesting in this regard: besides per-app blocking, it can route traffic through its own WireGuard config, combining a firewall and a VPN client in one app — an option for people willing to deal with manual setup, though not a universal solution.

If you keep a VPN on all the time (for example, in Always-On mode), installing a VpnService-based firewall alongside it is pointless — it simply won't run in parallel. In that case, a targeted network block for one app is better handled with the system tools from the section above.

How to block a program's internet access on Windows 10 and 11

On a computer, the situation is simpler: there's no conflict with a VPN, because the VPN client and a firewall rule are two independent mechanisms at the Windows level, not a shared slot like on Android.

Through Windows Defender Firewall

1. Open "Windows Defender Firewall with Advanced Security" — fastest via Win+R → wf.msc.
2. In the left panel, select "Outbound Rules."
3. In the right panel, click "New Rule."
4. Choose the "Program" rule type and specify the full path to the program's .exe file.
5. On the Action step, choose "Block the connection."
6. Check the profiles the rule applies to — Domain, Private, Public (usually you need all three, or the program stays connected when the network profile changes).
7. Give the rule a clear name and save it — the block takes effect immediately, no restart needed.

With a single PowerShell command

You can get the same result without the GUI — with a PowerShell command run as administrator:

New-NetFirewallRule -DisplayName "Block App" -Direction Outbound -Program "C:\\Path\\app.exe" -Action Block

Or the classic netsh command, which works all the way back to very old Windows versions:

netsh advfirewall firewall add rule name="Block App" dir=out program="C:\\Path\\app.exe" action=block

Both create an outbound rule — in practice the program's traffic ends up blocked both ways (it can't establish an outbound connection either), but technically it's described as blocking outbound connections.

Pitfalls

Many programs don't have just one .exe — there's the main process, a background updater, a helper process. If you block only the main file, the updater will keep reaching the network — check all the program's processes in Task Manager and create a rule for each .exe separately.

For Microsoft Store (UWP) apps, the .exe path often doesn't apply — these apps are blocked by package name rather than by file, through a different rule type or through the app's own privacy settings.

An inbound rule doesn't replace an outbound one: if you've only blocked inbound connections, the program can still freely reach out to the internet itself — a full block requires an outbound rule specifically.

And most importantly for this article: a firewall rule works the same way whether or not your VPN is on. Don't accidentally block the VPN client itself — its executable needs to stay allowed, or the VPN will stop connecting. You can grab the desktop client from the LiMP VPN apps page.

These rules don't touch Windows' own system telemetry (as opposed to individual programs) — that's a separate topic.

Blocking method vs. VPN compatibility

How to combine network blocking and VPN

Which method to pick depends on what matters more at that moment — keeping the VPN on all the time, or guaranteeing a full block for one app.

If the VPN needs to stay on continuously — say, you often work from public Wi-Fi or connect to work resources — use Android's system-level restrictions: turning off background data, or choosing allowed networks on Samsung/Xiaomi. They don't take the VPN's slot and keep working while the VPN is active. If you need finer routing — which apps go through the VPN and which bypass it — that's what split tunneling on the VPN client itself handles; we cover it in detail in our guide on configuring per-app VPN routing. That's a different task: split tunneling decides where an allowed app's traffic goes, not whether it has network access at all.

If you need a guaranteed full block for one specific app and that matters more than the VPN at that moment, turn on a VpnService-based firewall, knowing the VPN will be disconnected while it runs. For many of the scenarios from the start of this article (checking an offline app, temporarily cutting off a suspicious APK), this is a one-off operation that takes a few minutes, after which you can turn the VPN back on.

On a PC, there's no such tradeoff — a firewall rule and a VPN client work in parallel without conflict, which makes Windows simpler in this respect. On top of per-app blocking, you can also encrypt your DNS requests — it doesn't replace a firewall, but it closes off leaks through unencrypted DNS lookups.

If you're on Android and regularly need that balance between privacy and an always-on VPN, it's worth looking at LiMP VPN for Android — its split tunneling for specific apps solves this without switching between VPN and firewall every time.

How to check that the block is actually working

After setting up any of these methods, it's worth confirming the app is genuinely cut off from the network, not just appearing that way at a glance.

On Android, the most reliable way is to open the app in airplane mode and compare its behavior with the block enabled but airplane mode off: if the result is the same (the app won't load data, shows a network error), the block is working. A second way: after some time, go to Settings → Apps → the app in question → "Data usage" and check that its traffic counter isn't growing — it should normally show 0 bytes since the block was applied. If you're using a firewall like NetGuard, it keeps its own log — you can see every attempt the app makes to reach the network and its status (allowed/blocked).

On Windows, it's handy to turn on logging of dropped packets in the firewall itself (under the profile properties → "Logging" section; the file is usually called pfirewall.log) — it shows the specific blocked connection attempts, including the program and address.

It's also worth checking the flip side: after you turn off the Android firewall (to get the VPN back), make sure the VPN actually reconnected and isn't stuck in a disconnected state — otherwise you might think you're protected while your traffic is actually going out over the open network.

Checklist: what to do right now

• Make a list of apps that don't need network access at all to function (calculator, offline games, local utilities).
• Turn off background data for apps on that list in Android's system settings.
• On Samsung or Xiaomi, go through the allowed-networks section and explicitly set "no network" wherever it makes sense.
• On your computer, create a separate firewall rule for every .exe of the program you want to isolate from the network, including helper processes.
• Never block Android system components (Google Play Services) or the VPN client's own process — doing so breaks notifications, updates, and the VPN connection, respectively.
• If you're installing a firewall on Android, pick an open-source or well-reviewed Google Play app, not the first one you find online.
• Periodically check "Data usage" per app to catch unexpected traffic before it becomes a problem.
• A suspicious app (a questionable APK, a cracked version) is better uninstalled than just network-blocked — blocking doesn't remove the risk if the app already has access to files or data on your device.