Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In our network, we are connected to the outside world with an ADSL modem. A (wireless) router is connected to this ADSL modem, which provides wireless access to 3 laptops, and a USB connection to a printer.

Then, there is a desktop (Running Win7 Pro x64), which is used as a file server/svn repos, which is connected to the network with a wire connection, through the wireless router.

What we want to do is, to disable the internet access for this desktop which we use as a file server and only allow it to communicate with the devices on our network. We'd appreciate your help.

Here's a block diagram of the situation: We want to disable internet access for the Win7 desktop, but allow all the wireless clients to still access the desktop. Is this possible?

||      DSL
||      ||
||      ||               ============== ============== ==============
||      ||               | wireless   | | wireless   | | wireless   |
||   =============       | dhcp client| | dhcp client| | dhcp client|
||   |           |       ============== ============== ==============
||   |   ADSL    |          //               //              //           
||   |  modem    |                              
||   ||                               
||   =============                      
||      ||
||      ||
||   =============    ==============
||   |           |    |            |
||   |  router   |====|  Win7      |
||   |           |====|  desktop   |
||   ||    ||
||   =============    ==============
share|improve this question
If you have a router in place, and no publicly visible open ports on your file server - you are safe from external incoming traffic. Now, if you want to block outgoing http traffic to, you can create a rule in your router / firewall to block all traffic 0 - 1024 port range tcp/udp from that machine IP. make sure your fileserver have a static IP. – rihatum Jan 27 '11 at 9:58

Use firewall on router or ADSL modem to restricting access to the IP address. Or delete default route on Windows 7 desktop.

share|improve this answer
You will have to assign the fileserver a permanent IP (no DHCP) to make the firewall work over time. – Christian Jan 27 '11 at 8:56
You could assign a fixed IP address via DHCP if you want. I expect a file server already has a fixed IP. – dunxd Jan 27 '11 at 10:13

Well, windows will not like being denied Internet access. You need internet access for the patching and time synchronization among other things.

As you are already running NAT you are blocking incoming connections to the windows computer. You can always add an extra layer by configuring the firewall on it to block access to the services you want to protect.

If you really want to prevent internet access the quickest and easiest solution is either to remove the default gateway in the IP configuration, or to setup the windows firewall to only allow connections from (which seems to be your network).

share|improve this answer
+1 for pointing that out given it is a Win 7 desktop being used as a central file store. There are ways around these issues, but probably only warranted in an environment over the OP's size. For example, time synch should probably be done via an internal time server, and the config is pushed out via Active Directory. WSUS and SCCM are there to provide updates without giving direct access to the internet. – dunxd Jan 27 '11 at 10:13
pehrs: When we remove the default gateway in the IP configuration, the desktop can no longer be accessed by anyone anymore. The default gateway, by default, was set to, which is the address of the router. – SomethingBetter Jan 27 '11 at 11:49
What is the netmask of the server and the clients? Your router in the picture has a different subnet than the rest of the systems, which seems very weird... – pehrs Jan 27 '11 at 12:20
pehrs: Netmask of the clients are, Default gateway for the clients are Netmask of the server is identical to the netmask of the clients. I am sorry for the confusion, the IP addresses in the pictures are not correct, I'll fix it in a second. All the clients, including the server has a 192.168.2.X address. – SomethingBetter Jan 28 '11 at 7:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.