Products/GeoIP Blocker

See which countries your PC is talking to. Then cut the ones it should not.

GeoIP Blocker is an outbound firewall for Windows that works by country, by network operator and by application. Every connection lands on a world map as it happens, with the process that opened it. Pick a country and it is blocked at the kernel through Windows Filtering Platform. Add the Spamhaus and FireHOL lists and known-bad networks go with it, whatever country they sit in. One signed exe, no driver, no service, no account.

Download v1.0.0 30-day trial, then $9.99

Windows 10 / 11 x6430-day trial, $9.99 oncePortable zip, 10.4 MBSHA256 c1f8aa2b424f...Released 2026-10-25Signed, ITITSOLUTION SOFTWARE LLC

GeoIP Blocker, live connections, 4 countries blocked

ProcessRemoteCountry / ASNRuleState

msedge.exe142.250.72.14:443US / AS15169 Google-Allowed

Teams.exe52.113.194.132:443US / AS8075 Microsoft-Allowed

updater.exe45.142.212.61:8080RU / AS48666Country RUBlocked

svchost.exe20.42.73.29:443US / AS8075 Microsoft-Allowed

helper.exe185.220.101.4:443DE / AS205100Spamhaus DROPBlocked

javaw.exe104.21.6.90:443US / AS13335 CloudflareApp not in baselineBlocked

1,284 connections today, 37 blocked3 alerts: new country for helper.exe

What it does

Four ways to say no, one map to see why

Block by countryClick a country on the map or pick it from the list. Every outbound connection to an address registered there is dropped by WFP before it leaves the machine. The GeoIP table ships inside the exe, so it works offline from the first launch.

Block by network operatorBad actors rent space in every country. Block individual ASNs, or turn on the Spamhaus DROP, ASN-DROP and FireHOL level 1 feeds and refresh them on a schedule you choose.

Block by applicationPick an exe or a whole folder and that program loses internet access. Programs it spawns at runtime are caught too. Trusted Microsoft-signed system binaries stay out of the way.

Baseline modeLet it watch for a day or a week. It learns which countries and networks each program normally uses, then alerts on, or blocks, anything new. A per-app snapshot does the same for one program.

Live world map, linked both waysConnections draw as arcs to their destination. Click a country and the processes talking to it light up; hover a process and the countries it uses flash. Tooltips name the ASN and the rule that fired.

Logs you can keepOne JSONL line per connection start, end or block, with CSV export on demand. Alerts are kept with severity scoring: unsigned exe in a temp folder talking to a new country scores higher than a signed browser.

Compared honestly

Where it sits next to the firewalls you already know

Checked October 2026 against each vendor's published feature list. If we got a row wrong, email [email protected] and we will fix it.

Capability	GeoIP Blocker	Windows Defender Firewall	SimpleWall	GlassWire
Price	30-day free trial, then $9.99 once per workstation	Included with Windows	Free, open source	Free tier, paid from $2.99/month
Block by country	Yes, built-in map and list	No (manual IP ranges only)	No	No
Block by ASN / threat feed	Yes, Spamhaus and FireHOL	No	Partial, via blocklist import	No
Block by application	Yes, exe or folder, child processes included	Yes	Yes	Yes
Learn normal traffic, alert on new	Yes, baseline and per-app snapshots	No	No	Partial, new-connection alerts
Live map of connections	Yes, linked to the process list	No	No	Graph, no map
Install footprint	One exe, WFP user-mode API, no driver	Built in	One exe, WFP	Installer plus driver and service
Inbound filtering	Not yet (outbound only in 1.0)	Yes	Yes	Yes
Telemetry or account	None	Microsoft diagnostics	None	Account for paid tiers

If you need inbound rules or a full replacement for the Windows firewall, keep Defender Firewall or SimpleWall; GeoIP Blocker runs alongside either. It earns its place when the question is "why is this machine talking to that country" and you want it answered, and stopped, in one window.

Download

Verify it before you run it

The zip contains one signed exe, a README and the license and attribution notices. Compare the hash below with what you downloaded. The signature publisher reads ITITSOLUTION SOFTWARE LLC.

PS> Get-FileHash .\GeoIPBlocker-1.0.0-portable.zipSHA256 c1f8aa2b424fc86e8f091c1d8c82a6801f21e6a663d7c1bf10cd16c0e44bc166

PS> Get-FileHash .\geoipblocker.exeSHA256 59601d03b76bef5c382454e176dfd99d4a7efd0deab6d21cf68670de126b8831

Every download is a full 30-day trial. After that a key costs $9.99 per workstation, once, and covers every 1.x release. Key activation ships in the next update; 1.0 keeps running past 30 days in the meantime, and keys go on sale here and on the pricing page the day it does.

GeoIP Blocker 1.0.0, portableGeoIPBlocker-1.0.0-portable.zip, 10.4 MB, 2026-10-25

Download zip

Activation key$9.99 after the 30-day trial. One workstation, transferable, all 1.x releases. On sale when activation ships in the next update.

Notify me

ChecksumsGeoIPBlocker-1.0.0-portable.zip.sha256, sha256sum -c format

Download .sha256

System requirements Windows 10 64-bit or Windows 11. Administrator rights: the exe is manifested requireAdministrator because the Windows Filtering Platform API needs an elevated token. No .NET, Java, VC++ or WebView2 runtime. Roughly 32 MB on disk; the GeoIP table and the world map are embedded.

FAQ

Common questions

GeoIP Blocker is signed with a Microsoft Artifact Signing certificate; the publisher shows as ITITSOLUTION SOFTWARE LLC. Windows may show a SmartScreen prompt on first run until the publisher has built reputation. Click "More info", confirm the publisher name matches, then "Run anyway". Compare the SHA256 above if you want certainty.

Blocking happens in the Windows Filtering Platform, the same layer Defender Firewall uses. Adding and removing WFP filters requires an elevated token, so the exe asks for UAC on launch. The optional "Start with Windows" scheduled task runs it elevated at logon without a prompt.

No. It uses the user-mode WFP API. By default the filters are dynamic: close the app and every rule disappears. If you turn on persistent rules so blocks survive a reboot, the tray menu has "Remove all rules and exit", and geoipblocker.exe --remove-all-rules does the same from an elevated prompt.

DB-IP Country Lite and ASN Lite (CC BY 4.0) are embedded in the exe, so it works offline. You can download a newer table from inside the app at any time; it is stored beside the exe and takes precedence.

Nothing on its own. The Spamhaus and FireHOL feeds and GeoIP table updates are fetched only when you turn them on, directly from those publishers. There is no telemetry, no update check and no account.

Yes. Add an exe or a folder to the blocked apps list and it loses all outbound access. Child processes it launches are blocked too. Baseline mode goes the other way: it learns what each program normally does and blocks or alerts on anything new.

Not in 1.0; it is outbound only and runs alongside Defender Firewall or any other inbound firewall. An inbound toggle is planned for 1.1.

30-day free trial with every feature, then $9.99 per workstation, paid once, covering every 1.x release. Version 1.0 has no key or trial check yet, so it runs fully while activation is being finished; keys go on sale with the update that adds it. Volume and site licensing are on the pricing page.