How to block online games at work
Games no longer arrive as a single installer that IT can spot. They come as browser tabs, launchers, multiplayer clients, cloud streams and phone apps, each needing a different control.
This guide is for IT admins, MSPs, school network teams and filtering vendors. It maps each route to a control, shows how to handle the endless supply of new game sites, and ends with a test plan.
Why organisations block online games
Productivity is the obvious reason, but security and capacity are often the ones that persuade management. This register lists the main risks with an example and the control that addresses each one.
| Risk | What it looks like | Main control |
|---|---|---|
| Malware | Cheat tools, mods, cracked games and "free game" downloads that bundle unwanted software | Block installs on managed devices, block malware and freeware download sites |
| Scams | In game chat used for phishing, fake item trades and account theft | Block games on work devices, security awareness training |
| Bandwidth | Launchers downloading very large game files and updates | Application control, traffic shaping, schedules |
| Productivity | Browser games in a background tab during working or teaching hours | Gaming category on DNS or firewall |
| Gambling exposure | Skin betting and loot style mechanics that sit next to gambling | Block the gambling category alongside gaming |
| Licensing | Unlicensed software installed on company assets | Application allowlisting, software inventory |
Five ways games reach your network
Each route needs a different control. Most game blocks fail because they cover one or two routes and leave the rest open.
Browser games
Thousands of small game portals and single game sites. Many are short lived and change domains often, especially sites aimed at students.
Launchers and stores
Desktop clients that sell, download and update games, such as Steam (steampowered.com, steamcommunity.com, steamstatic.com) or the Epic Games launcher (epicgames.com).
Multiplayer clients
Games that connect to their own servers, such as Roblox (roblox.com, rbxcdn.com). Gameplay often uses UDP on wide port ranges after sign in.
Cloud gaming
Games streamed from a data centre to a browser or small app. No install is needed, and the traffic looks like video.
Mobile games
Apps on company phones and tablets, and on personal phones using staff or guest Wi-Fi.
Not sure whether a hostname in your logs belongs to a game? Look it up in the domain category lookup tool before you add a rule.
Choose the policy before the controls
Three policy shapes cover most organisations. Write down which one you choose and why, then build to it.
No games, anywhere
Games are blocked on all networks and devices at all times.
- Secure sites, call centres, regulated firms
- Kiosks and shared terminals
- Primary and middle school student networks
Breaks only
Browser games open at lunch or after hours on staff Wi-Fi. Installs stay blocked.
- Offices with a relaxed culture
- Secondary schools after lessons
- Break room or staff lounge networks
Own network for gaming
Gaming is allowed only on a separate network with its own limits.
- University residences and esports clubs
- Hotels and venues
- Youth centres with supervised sessions
Esports and game design are real work. Colleges with esports teams, studios and game design courses need games to run. Give them a dedicated network and a clear exception, rather than weakening the policy for everyone.
Control matrix: which method stops which route
Read across a row to see what a control covers. A complete block uses at least one strong control for each column you care about.
| Control | Browser games | Launchers | Multiplayer | Cloud gaming | Mobile |
|---|---|---|---|---|---|
| DNS filter with Gaming category | Strong | Partial | Partial | Partial | Wi-Fi only |
| Firewall URL category | Strong | Partial | Partial | Partial | Wi-Fi only |
| Firewall application signatures | Partial | Strong | Strong | Strong | Wi-Fi only |
| Port rules | None | Partial | Partial | None | None |
| Endpoint application control | None | Strong | Strong | Partial | None |
| Managed browser policy | Strong | None | None | Strong | None |
| MDM app restrictions | None | None | Mobile only | Mobile only | Strong |
The pattern is clear: a category rule handles the web, endpoint control handles installs, and MDM handles phones. No single row covers every column.
"Partial" usually means the control stops the sign in page or store website but not traffic that is already flowing, or that it works only while the device is on your network. Plan a second control for every column marked partial that matters to your policy.
Step by step: network and endpoint
Start with the network rule, because it protects every device on day one. Then lock down managed endpoints so the block follows laptops home.
Network layer
- Enable the Gaming category on your DNS filter or firewall web filter for staff and student networks.
- Add application signatures for the launchers and multiplayer games your logs show.
- Block outbound DNS to other resolvers and public DNS over HTTPS endpoints.
- Optionally block UDP 443 so browsers fall back to TCP that your firewall classifies more reliably.
- Add port rules only for specific games where the publisher documents them, for example the Steam client ranges published by the platform.
- Attach schedules if you allow games at breaks.
Endpoint layer
- Remove local admin rights from standard users.
- On Windows, use application control policies through Microsoft Intune to block launcher and game executables, including those that install in the user profile.
- Push managed browser policies with URL block lists for roaming devices.
- On Chromebooks, use the Google Admin console URL blocklist and block game apps and extensions.
- On phones and tablets, block game apps through your MDM.
The browser game problem
Browser game sites are the hardest part of any game block, especially in schools. Understanding why helps you choose the right tools and set fair expectations.
They move constantly. New game portals appear every day, often copying popular sites under new names. A list you wrote last month is already out of date.
Some hide among legitimate content. Game pages are sometimes published on free site builders or shared hosting platforms that also host school projects and business sites. A domain level block on the whole platform would break legitimate work.
What works: a Gaming category feed with daily updates for new domains, URL path rules on a proxy for shared platforms, and managed browser policy on school devices. Our guide to blocking newly registered domains adds a useful safety net.
Sector playbooks
The same controls apply everywhere, but the balance changes by sector. These short playbooks reflect common practice among the organisations and service providers that use category data.
Lesson time first
- Block Gaming on student networks during lessons, with stricter rules for younger year groups.
- Use managed browser policy on school Chromebooks so the block works at home.
- Allow approved educational games by adding them to an allow list above the category rule.
- Review blocked attempts by category totals, not by individual student, unless safeguarding requires it.
Installs are the real risk
- Block launchers and clients on every managed device.
- Decide whether browser games open at lunch.
- Keep gaming off the corporate network, and on guest Wi-Fi if at all.
- Add games to the acceptable use policy so the rule is clear.
One template, many tenants
- Ship a default profile with Gaming blocked and a scheduled variant.
- Bundle the VPN and proxy block with the gaming block.
- Report gaming attempts per tenant in monthly reviews.
- See the MSP web filtering notes for multi tenant design.
Game downloads and bandwidth
Even where games are allowed, launchers can swamp a link with very large downloads and patches. If capacity is the concern, these controls help without a full block.
| Control | What it does | When to use it |
|---|---|---|
| Traffic shaping | Caps game downloads to a share of the link per client | Residences, hotels and guest networks |
| Schedules | Allows launcher downloads only overnight | Sites with quiet hours and spare night capacity |
| Separate network | Puts gaming devices on their own SSID or VLAN with limits | Esports rooms and youth centres |
| Application block | Stops launcher traffic entirely | Offices, schools and metered links |
For video streaming and other heavy traffic, see our guide to blocking streaming sites to save bandwidth.
Bypass routes to close
These are the usual gaps after a game block goes live. They are listed for administrators planning controls.
VPN and proxy apps
Block the VPN / Proxy / Anonymizers category and VPN application signatures.
Portable game files
Games that run without installing. Application control by publisher or hash catches them better than install blocking.
Encrypted DNS
Disable browser DNS over HTTPS by policy so your resolver sees every lookup.
USB and downloads
Games copied on removable drives. Device control and download category blocks help.
Cloud gaming in a tab
Looks like video. Block the services by category and signature, not by port.
Mobile hotspots
Personal phones sharing their data connection. Device policy can restrict hotspot use on managed laptops.
Testing checklist
Test each route with a standard user account. Then repeat a week later, because game blocks often leak through new domains or updates. Test on every network the policy covers, including Wi-Fi in break rooms.
- A large game portal shows your block page.
- A small game site you never listed is also blocked.
- A launcher installer is refused on a managed laptop.
- An already installed launcher cannot sign in or download.
- A multiplayer client fails to connect over the staff network.
- A cloud gaming service in the browser is blocked.
- Game apps are hidden or blocked on managed phones.
- Schedules open and close at the right time.
- Esports or exempt networks still work as intended.
- DNS and firewall logs show no new game domains passing.
- An approved educational game on the allow list still loads.
- A common VPN app is refused on a managed device.
Tell people before you test in production. A short note explaining that games are now blocked, why, and when breaks are open prevents a wave of tickets. Include how to request an exception for esports, training or game design work.
Keep the results. Save the checklist with dates and outcomes. When a firmware update or new launcher version appears, run the same list again and compare.
Category based blocking with our database
Game sites are a moving target. Vendors and MSPs license our data so their filters recognise new portals, launchers and mirrors without manual updates.
Categories that work together for games
Gaming
Game portals, browser games, launchers, game publishers and game communities.
Gambling
Betting, casino and skin betting sites that often sit next to gaming.
Freeware/Software
Download sites that may carry repacked games and cheat tools.
File Sharing/P2P
Peer to peer and torrent sites used for cracked games.
Streaming Media
Game streaming and video, relevant for cloud gaming and bandwidth.
VPN / Proxy / Anonymizers
The main bypass category to block alongside games.
A domain can carry several ranked categories. A game publisher's corporate site may rank Business first and Gaming second, so you can choose whether to block on the primary category only.
Licensed data runs inside your own systems, with a lookup API included. See the web filtering database overview for formats and delivery.
Game specific guides
Online games blocking FAQ
What is the best way to block online games at work?
Combine a Gaming category block on your DNS filter or firewall with application control on managed endpoints. The category rule stops browser games and launcher websites; endpoint control stops installed launchers and clients.
Why do browser game sites keep getting through?
Many game sites are short lived and move to new domains often, and some are hosted on free site builders or shared hosting next to legitimate content. A category feed with daily updates catches new domains faster than a manual list.
Should I block game ports on the firewall?
Port rules help for some multiplayer games but are not enough alone, because many games use common ports such as 443 or wide UDP ranges. Use application signatures and domain categories first, and port rules only as an extra layer.
Can staff play games during breaks?
If your policy allows it, schedule the Gaming category to open during breaks or keep it open on guest Wi-Fi. Keep game installs blocked on managed devices either way.
Are online games a security risk?
They can be. Cheat tools, mods, cracked games and fake free game downloads are common carriers of malware, and game chat is used for scams. Blocking installs on work devices removes most of that risk.
How do I keep a game block current?
Use a Gaming category feed with daily updates, keep firewall application signatures current, and review DNS logs and endpoint inventory every quarter for new launchers or clients.
Keep up with every new game site
Daily updated Gaming, Gambling and bypass categories for your filter or gateway product. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Steam is a trademark of Valve Corporation. Epic Games and Fortnite are trademarks of Epic Games, Inc. Roblox is a trademark of Roblox Corporation. Minecraft is a trademark of Microsoft Corporation. Microsoft, Intune and Windows are trademarks of Microsoft Corporation. Google, Chromebook and Google Admin are trademarks of Google LLC.
These names are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.