How does the block actually happen?

Syspeace tells the blocking provider to effect the block. Ordinarily, this is the Windows Firewall, but it may also be the IP Security Policy component in environments where Windows Firewall is unavailable (Windows Server 2003 or when the Windows Firewall is managed by another security product).

See also: What does an attacker see when they are blocked?