*** THIS WORKS WITH WINDOWS 10 AS WELL. I have tested on Windows 8.x and Windows 10! ***
RECOMMENDED, SEE ALSO: How to disable Windows 10 spyware telemetry logging.
How to use Windows Firewall in an efficient manner (BLOCK ALL EXCEPT) (poor man's firewall)?
That is, what if you wanted to block everything, all traffic from all applications except for certain applications and/or ports? It is not as easy as you would think because it would also kill off your Internet connection completely. 
Of course, I wanted this because I hate installing extra crap in my system so I try to avoid it as much as possible. Even and extra firewall software is crap if I can use the Windows built-in stuff... and cheaper!
After a lot of trial and errors, I managed to use Windows Firewall like a tiny little firewall because usually, the firewall applications are super bloated, they do lots of stuff I don't want them to do. I needed a simple "kill everything except this" functionality.
This also works with a guest operating system inside Hyper-V. I will explain that as well because I needed the file sharing to work in my guest system.
Bear in mind that this works in my system. Will probably work in most systems but it's at least a good base and you can try and see how this works for you.
WARNING: THESE SETTINGS WILL ALSO KILL OFF YOUR ENTIRE WINDOWS SYSTEM FROM THE INTERNET. IT MEANS YOUR WINDOWS WILL NOT GET WINDOWS UPDATES! I have NOT found a solution to how to enable Windows Update as an individual rule but I have a rule which allows "C:Windowssystem32svchost.exe" as "Outbound rule". I enable it manually to check for updates and then disable the rule again.
This how you setup the host operating system to kill everything, except whatever you choose:
- windows firewall 01.png (51.12 KiB) Viewed 44406 times
- windows firewall 02.png (44.24 KiB) Viewed 44406 times
- windows firewall 03.png (39.12 KiB) Viewed 44406 times
UPDATE FOR "windows firewall 04.png", IT SEEMS THAT UNICAST RESPONSE SHOULD BE ALLOWED. SET IT TO "YES". If your line glitches, it won't be able to reconnect if you set it to "no", so you must set it to "YES". This of course may depend on your router but for me, looks like I must set it to "Yes (default)".
- windows firewall 04.png (70.65 KiB) Viewed 44406 times
- windows firewall 04 addendum.png (19.51 KiB) Viewed 44402 times
UPDATE FOR "windows firewall 04.png", IT SEEMS THAT UNICAST RESPONSE SHOULD BE ALLOWED. SET IT TO "YES". If your line glitches, it won't be able to reconnect if you set it to "no", so you must set it to "YES". This of course may depend on your router but for me, looks like I must set it to "Yes (default)".
- windows firewall 05.png (42.38 KiB) Viewed 44406 times
- windows firewall 06.png (153.58 KiB) Viewed 44406 times
- windows firewall 07.png (146.43 KiB) Viewed 44406 times
If you have done so according to the pictures above, all your Internet connectivity should now be lost. You can't even get an IP address from your (DHCP) router. Nothing goes in or out.
- windows firewall 08.png (56.75 KiB) Viewed 44406 times
- windows firewall 09.png (67.04 KiB) Viewed 44406 times
The two above pictures show which firewall rules you need to enable to get file sharing and Internet connectivity in the host operating system.
- windows firewall hyper-v 10.png (31.81 KiB) Viewed 44406 times
- windows firewall hyper-v 11.png (32.77 KiB) Viewed 44406 times
The two above pictures show which firewall rules you need to enable to get file sharing and Internet connectivity in the guest operating system.
...and of course, this is how you add a new rule. For example, if you need to enable a certain application (Firefox etc.) to be able to have access to the Internet:
- windows firewall new rule.png (107.67 KiB) Viewed 44406 times
UPDATE: Windows Update uses "svchost.exe" to reach out to the Internet but we don't want the "svchost.exe" to be able to access the Internet all the time so you can create a new rule, for example call it "Windows update" and then you can just make a batch file to enable/disable it when you need to run the Windows Update. You probably can also use scheduling for it if you need to automate the process.
Command line, ENABLE A RULE CALLED "Windows update":
netsh advfirewall firewall set rule name="Windows update" new enable=yes
Command line, DISABLE A RULE CALLED "Windows update":
netsh advfirewall firewall set rule name="Windows update" new enable=no
- windows update svchost.exe.png (32.75 KiB) Viewed 44394 times
