diff --git a/src/network.js b/src/network.js
index bd44e1cc2..753db6fe7 100644
--- a/src/network.js
+++ b/src/network.js
@@ -10,6 +10,7 @@ const assert = require('assert'),
     path = require('path'),
     paths = require('./paths.js'),
     safe = require('safetydance'),
+    settings = require('./settings.js'),
     shell = require('./shell.js'),
     validator = require('validator');
 
@@ -31,6 +32,8 @@ function setBlocklist(blocklist, callback) {
 
     if (!blocklist.every(x => validator.isIP(x) || validator.isIPRange(x))) return callback(new BoxError(BoxError.BAD_FIELD, 'blocklist must contain IP or IP range'));
 
+    if (settings.isDemo()) return callback(new BoxError(BoxError.CONFLICT, 'Not allowed in demo mode'));
+
     const data = safe.fs.readFileSync(paths.FIREWALL_CONFIG_FILE, 'utf8');
     const config = safe.JSON.parse(data) || {};