1. A processor-readable storage memory having stored thereon processor-executable instructions that, responsive to execution by a client computer, cause the client computer to perform a method comprising: defining by a module locally at the client computer a plurality of network zones each of which includes a different set of network properties and connection policies to associate networks encountered by the client computer with one of the plurality of network zones, the plurality of network zones configured to be enforced by the module to control connections of the client computer to the encountered networks; connecting to at least one of the encountered networks; subsequent to the connecting, assigning the at least one of the encountered networks to one of the plurality of network zones that has network properties corresponding to properties of the at least one of the encountered networks; receiving, from an application program executing on the computer, preference information that identifies one of the plurality of network zones as a preferred network zone; permitting communications between the application program and a network connected to the client computer that is assigned to the preferred network zone, the application program being permitted to communicate with specific network locations on the network that are defined by the preference information received from the application program; and preventing communications between the application program and a network connected to the client computer that is not assigned to the preferred network zone, the application program being prevented from communicating with network locations on the network that are not specified in the preferred network zone.