How to block Steam on your network
Steam is not one website. It is a store, a social network, a download service and a game streaming tool, all behind one client. Decide which parts you need to stop, then block them precisely.
Why organisations block Steam
The reasons differ a lot by sector. A bank cares about unapproved software; a university cares about bandwidth in halls; a school cares about lesson time. Knowing your reason tells you which part of Steam to block.
| Sector | Main concern | Typical choice |
|---|---|---|
| Business | Unapproved software on managed PCs, licence and security risk, time on non-work tasks. | Block the client with application control; block the Gaming category. |
| University | Large game downloads saturating links in halls and labs, especially at the start of term and on big release days. | Allow in residences with download throttling; block in teaching spaces. |
| K-12 school | Gaming during lessons, chat with strangers, spending. | Full block on student networks and devices. |
| Public library | Public PCs tied up with games, downloads on shared links. | Block the client and downloads; often allow store browsing. |
| Government and regulated | Software control rules, data protection, peer-to-peer style traffic. | Full block plus application control and logging. |
| Hospitality guest Wi-Fi | Guests downloading large games on a shared link. | Throttle downloads rather than block. |
Steam is four services: domains for each
Each part of Steam runs on its own hosts. That is useful: you can block downloads without blocking the store, or block everything at once.
Store
store.steampowered.comsteamstatic.comProduct pages, prices and checkout. Static images and scripts load from steamstatic.com.
Block: no browsing or buyingCommunity
steamcommunity.comsteamusercontent.comProfiles, groups, forums, workshop items and screenshots uploaded by users.
Block: no social featuresClient and downloads
steamcontent.comsteamserver.netapi.steampowered.comClient sign-in and connection servers, plus the content hosts that deliver games and updates.
Block: no installs or playRemote Play
Steam clientSteam Link appStreams a game running on one computer to another device, including over the internet.
Block: by applicationFull list of official Steam domains
steampowered.comStore, help site, client APIs and downloads of the client itself.steamcommunity.comCommunity, profiles, market and chat on the web.steamstatic.comStatic content: images, styles, avatars, client updates.steamcontent.comContent servers for game downloads and updates.steamserver.netConnection servers the client uses to sign in and stay online.steamusercontent.comUser uploads such as screenshots and workshop files.s.teamOfficial short links used in chat and sharing.Valve's network is on its own autonomous system (AS32590), but game downloads are also served through third-party CDNs. Do not block CDNs wholesale. Use domains, the Gaming category and application control instead.
Hosts change with client updates. Check any new host from your logs with the domain category lookup before you add it to a rule.
Choose a scope
Pick the narrowest scope that solves your problem. Narrow scopes cause fewer complaints and fewer exceptions. You can also mix them: a full block on staff PCs and a download throttle on guest Wi-Fi is a common pairing.
Throttle downloads
- Shape traffic to steamcontent.com and the games category.
- Or allow downloads only overnight.
- Store, community and play still work.
Block downloads
- Block steamcontent.com and client update hosts.
- Existing games still run if already installed.
- Good for libraries and shared links.
Block social features
- Block steamcommunity.com and steamusercontent.com.
- Removes chat, forums and trading on the web.
- Rarely used alone.
Block Steam completely
- All domains above plus the Gaming category.
- Application control on managed PCs.
- The default for workplaces and schools.
Blocking methods, layer by layer
For managed PCs, application control does the heavy lifting. For everything else on your network, DNS and the firewall carry the load. Most organisations use at least three of the layers below together, so that one missed rule does not reopen access.
- Remove local admin rights from standard users, so games cannot be installed at all.
- Create an application control rule that blocks files signed by Valve, the publisher of Steam.
- Apply it in audit mode for a week, check the report, then switch to enforce.
- Do the same for other game launchers if your policy covers them.
Publisher rules stop portable copies too, because they match the signature, not the install path.
- Block the games URL category and the Steam domains in a URL filter profile.
- Add the Steam application signature to an application control rule.
- For throttling, use a traffic shaping policy on the same application or category.
- Block QUIC so the firewall sees TLS server names.
Most next-generation firewalls identify Steam as an application.
- Block the Gaming category and the seven Steam domains with subdomains.
- Force port 53 to your resolver and drop DNS over TLS on port 853.
- On a small router, add the domains to the blocked sites list.
Steam uses standard web ports for sign-in and downloads as well as its own ports, so port rules alone will not stop it. Read DNS filtering vs web filtering.
- Add the Steam domains to Chrome URL blocking for the right units.
- Block the Steam Link and Steam Mobile Android apps on managed Chromebooks.
- Block the Steam Mobile and Steam Link apps on supervised iOS and fully managed Android.
- On Macs, block the Steam app through restricted software settings.
- Push a device filter profile so the block applies off your network.
Client, browser and Remote Play
Most of Steam happens inside the client, not the browser. Blocking the website only removes the shop window. The client keeps its own connections, its own updater and its own login, so it needs its own controls.
In the browser
Store and community pages. Easily blocked by domain and category, with a visible block page.
In the client
Sign-in, library, downloads, chat and play. Stopped by domain blocks, application signatures and, on managed PCs, application control.
Remote Play
A work device becomes a screen for a game running at home. It needs the Steam client or Steam Link app on the work device, so app blocking closes it.
What happens to games that are already installed
A network block stops new connections. It does not delete anything already on a device, and that catches some admins out.
Offline modeSteam has an offline mode. A user who set it up before the block may still launch some single-player games. Only application control stops this.MultiplayerOnline matches need Steam's connection servers, so they stop once steamserver.net and the client APIs are blocked.Cloud savesSave sync fails quietly. Users may lose progress, which is worth mentioning in your announcement.UpdatesGames that need an update before launch will not start, because the content hosts are blocked.On managed PCs, pair the network block with an inventory report of installed Steam clients, then remove them or let application control block them at launch.
Game development and esports. Some courses publish to Steam, and esports clubs play on it. Give those machines their own VLAN or group with Gaming allowed and downloads throttled in teaching hours.
Campus playbook: Steam in halls of residence
Universities rarely block Steam in residences, because students live there. The task is to keep game downloads from crowding out teaching traffic and everyone else's evening. Plan around the moments that cause the biggest spikes.
Move-in week
- Hundreds of new devices download whole game libraries at once.
- Apply a stricter download cap for the first two weeks.
- Tell students in the welcome pack, so a slow download is not reported as a fault.
Big launches and sales
- Popular releases and seasonal sales cause sudden peaks.
- Shape the Steam application and content hosts, not the whole link.
- Keep teaching and research VLANs on a separate queue.
Quiet hours
- Some residences reduce gaming bandwidth in study hours.
- A schedule on the shaping rule does this without a full block.
- Agree it with student representatives first.
Teaching spaces
- Lecture halls, libraries and labs block Gaming by default.
- Esports and game design rooms get their own VLAN.
- Staff PCs follow the corporate policy.
Some large campuses and LAN event organisers run a local content cache, so each game is downloaded from the internet once and served locally after that. If you allow Steam at scale, it is worth evaluating before you reach for a block.
Questions the help desk will get
"Steam says no connection"
Expected where Steam is blocked. Give agents a one-line answer that points to the acceptable use policy and the exception process.
"My download is very slow"
On shaped networks this is the throttle working. Tell users when downloads are faster, for example overnight.
"I need it for my course"
Route to the course lead. If approved, add the user or machine to the game development exception group with an end date.
Bypass routes and how to close them
Steam blocks rarely fail at the domain level. They fail through the routes below, most of which involve software running on the device rather than traffic your firewall can see. That is why managed PCs need application control as well as network rules.
| VPN apps | Block the VPN / Proxy / Anonymizers category and VPN signatures; stop VPN installs with application control. |
| Portable copies | A copied Steam folder runs without an installer. Publisher-based application control blocks it. |
| Remote Play from home | Block the client and Steam Link app on managed devices; Gaming category on the network. |
| Cloud gaming in a browser | Covered by the Gaming category, which includes cloud gaming services. |
| Custom DNS | Force DNS to your resolver; block DNS over TLS and browser DNS over HTTPS by policy. |
| Games brought on USB | Application control and removable storage policies on managed PCs. |
How to test the Steam block
Test as a standard user on a standard build. For throttling, measure download speed during and outside the shaped hours. Record each result, then repeat the full run after Steam client updates and firewall signature updates, since either can change what gets through.
- Run
nslookup store.steampowered.comandnslookup steamcommunity.com: both blocked. - Open the store and community in Chrome, Edge and Firefox: block page.
- Download the Steam installer and run it: blocked by application control.
- On a test PC with Steam installed, start the client: it cannot sign in.
- Copy a Steam folder from another machine and try to run it: blocked by publisher rule.
- Try a free VPN: it cannot connect.
- In a club or lab exception group, confirm Steam works and downloads are shaped as planned.
- Review logs for Gaming hits and application control events.
Category-based blocking with our database
Steam is a handful of domains. The ecosystem is far bigger: key resellers, trading sites, skin gambling sites, game wikis, mod hosts and cloud play. A Gaming category catches them as they are categorized.
GamingSteam, game stores, launchers, game portals, cloud gaming.GamblingSkin betting and case-opening sites around game items.VPN / ProxyThe bypass category; block it wherever Gaming is blocked.MarketplacesKey and item resale sites, for stricter policies.Vendors and MSPs license the database as files with a lookup API to run inside their own platforms; For campus networks, see higher education web filtering; for companies, corporate web filtering.
Related guides: how to block Fortnite and how to block Minecraft.
Steam blocking FAQ
Which domains does Steam use?
The main official domains are steampowered.com, steamcommunity.com, steamstatic.com, steamcontent.com, steamserver.net, steamusercontent.com and the s.team short link domain. Block them with subdomains and add the Gaming category for related sites.
Can I block Steam downloads but allow the store?
Yes. Downloads come from content hosts, while the store is on steampowered.com and steamstatic.com. Block or throttle the content hosts, or use a schedule, and leave the store pages open.
Is blocking ports enough to stop Steam?
No. Steam logs in and downloads over standard web ports as well as its own ports. Use domain, category and application control rules instead of port rules alone.
How do I stop staff installing Steam?
Remove local admin rights and use an application control policy in Intune that blocks software published by Valve. That also stops portable copies that do not need an installer.
What is Steam Remote Play and should I block it?
Remote Play streams a game from one computer to another device. On a work network it lets someone play a game running at home. Block the Steam client and Steam Link app, plus the Gaming category, to close it.
Our university esports club needs Steam. What should we do?
Put club machines on their own VLAN with Gaming allowed, apply bandwidth limits to downloads during the day, and keep the default campus policy unchanged.
Will blocking Steam affect other Valve or game services?
Blocking the Steam domains stops every game that relies on Steam for sign-in or downloads, including games bought elsewhere but activated on Steam. Other launchers are not affected unless you also block the Gaming category, which covers them too.
Can I allow Steam for one group only?
Yes. Most firewalls, DNS filters and Intune policies apply per user or device group. Create a group for approved users or machines, allow Gaming and the Steam domains for it, exclude it from the application control block, and keep the default policy blocking Steam.
Does Steam use peer-to-peer traffic?
Steam can use peer-to-peer connections for some multiplayer games, voice and Remote Play. That is one more reason to block it by application and domain rather than trying to track individual connections.
Gaming data for firewalls, DNS filters and MSPs
License 120 million categorized domains to run inside your own product. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.
Steam, Steam Link, Steam Remote Play and Valve are trademarks of Valve Corporation. Microsoft, Intune and AppLocker are trademarks of Microsoft Corporation; Google, Chrome and Chromebook of Google LLC.
They are used here only to identify the products discussed. Web Filtering Database is not affiliated with, sponsored or endorsed by any of these companies.