how to allow LAN, but block Internet, on certain computers?

Posted on 2009-04-27
Last Modified: 2013-11-16
Hi. I run a LAN - 50 computers, Windows, AD Domain (for fileserver), kinda standard. I want to add a new Windows computer, but to be restricted to LAN only (i.e. filesharing), WITHOUT any access to the Internet. I want this computer to be blocked, from incoming and outgoing Internet traffic. (this is for its own protection - it's a mission-critical PC.)

How do I accomplish this? Are there software Firewall ports I can open/close? Am I missing something obvious?

Question by:soyproduct
    LVL 9

    Accepted Solution

    Are you running XP or Vista? You can use ip security to block ports 80 and 443, which would allow all other traffic, including email. In XP, you add a rule blocking all tcp packets to those two ports in control panel>Administrative tools>Local computer policy>IP Security Policies on local computer. Once you have created your rule, make sure you assign it. I haven't tried this on Vista, since we added a Cymphonix appliance before Vista came out. Some sort of appliance based filtering would work as well, but kind of pricey for a single system.
    LVL 3

    Assisted Solution

    Well, the simplest thing you can do is to not specify gateway and DNS for that computer, at network settings you just put in IP adress, netmask and leave blank the gateway and DNS. That way the computer cannot connect to the intenet. Or you can block the computer's IP adress's access to the internet from the router/firewall. If you tell us what do you use for internet access (router or windows/ISA server) I'm sure somebody will give you details on how to block an IP adress's access to the internet, but I personally think that not giving that computer gateway and dns would do it. And maybe you should restrict the user's rights so they cannot change network settings.
    LVL 2

    Expert Comment

    Blocking this computer's ip/MAC address in the gateway/router is the simpliest.

    Author Comment

    thanks people, I'll try these things later this week, and I'll post here again soon...

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Suggested Solutions

    I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    779 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now