Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up a Windows 7 machine in our warehouse and I don't want the users to have internet access from this machine. They users still need access to the LAN to do their jobs.

Does anyone know how to achieve this? (preferably without any third party software).

share|improve this question
    
What kind of router does your location have? –  Caleb May 3 '11 at 8:06
add comment

3 Answers

Block the machine in your firewall/router and/or put it on a network with no internet route and/or put it on a separate network that is blocked in your firewall/router.

If your LAN consists of more than one network it will still need a gateway set to reach those.

What level of security do you need and do the users have physical access to the computer's ports while using it?

share|improve this answer
add comment

To keep this easy just configure a wrong gateway on the computer ip configuration (like 133.133.133.133) it should be enough for a non tech-savy user :)

share|improve this answer
4  
This feels like security by obscurity to me... –  Oskar Duveborn May 3 '11 at 9:53
    
Agreed with Oskar. Security by obscurity is always a bad idea, no matter how computer-illiterate your audience is. It's more important to first identify the available equipment and base a decision on this information. These days even basic routers have MAC blocking capabilities, and this would certainly be better than leaving control in the hands of the end-user. –  Richard Keller May 3 '11 at 11:38
    
I do get the point... The same kind of solution giving the user a non-administrative account is enough to keep him out. Of course fine tuning a router would do a perfect job but it looks a bit harder to do for someone asking the question asked :) –  Pitto May 3 '11 at 15:06
    
As it stated "warehouse" I based my thoughts on this on not being a typical home use-situation in which mac address filtering or gateway fiddling could be fine ^^ Also, physical access to a machine generally equals very easy pwnage regardless of being local admin or not and regardless of actual know-how (yes it can sort of be addressed but it's not an easy task). –  Oskar Duveborn May 9 '11 at 13:24
add comment

just set a static IP on these machines and remove the gateway and/or DNS

share|improve this answer
    
why the hell was this downvoted? setting a static IP address with no default route in a flat network is a fine answer to this question. –  SpacemanSpiff Jun 7 '12 at 4:47
    
@SpacemanSpiff: What's to stop them changing it back again? Or plugging something else in, for that matter? –  SamB Oct 11 '12 at 3:39
    
Okay fine, put the warehouse users on their own subnet and policy route that traffic sourced from that subnet to a forwarding instance that does not have a default route. Done. –  SpacemanSpiff Oct 11 '12 at 14:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.