Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm setting up a Windows 7 machine in our warehouse and I don't want the users to have internet access from this machine. They users still need access to the LAN to do their jobs.

Does anyone know how to achieve this? (preferably without any third party software).

share|improve this question
What kind of router does your location have? – Caleb May 3 '11 at 8:06

Block the machine in your firewall/router and/or put it on a network with no internet route and/or put it on a separate network that is blocked in your firewall/router.

If your LAN consists of more than one network it will still need a gateway set to reach those.

What level of security do you need and do the users have physical access to the computer's ports while using it?

share|improve this answer

To keep this easy (without messing with router or other tasks):

  1. Remove gateway from desired pc TCP/IP configuration
  2. Modify user permission to standard user (so he/she can't modify TCP/IP settings to insert correct gateway)

Profit :)

share|improve this answer
This feels like security by obscurity to me... – Oskar Duveborn May 3 '11 at 9:53
Agreed with Oskar. Security by obscurity is always a bad idea, no matter how computer-illiterate your audience is. It's more important to first identify the available equipment and base a decision on this information. These days even basic routers have MAC blocking capabilities, and this would certainly be better than leaving control in the hands of the end-user. – Richard Keller May 3 '11 at 11:38
I do get the point... The same kind of solution giving the user a non-administrative account is enough to keep him out. Of course fine tuning a router would do a perfect job but it looks a bit harder to do for someone asking the question asked :) – Pitto May 3 '11 at 15:06
As it stated "warehouse" I based my thoughts on this on not being a typical home use-situation in which mac address filtering or gateway fiddling could be fine ^^ Also, physical access to a machine generally equals very easy pwnage regardless of being local admin or not and regardless of actual know-how (yes it can sort of be addressed but it's not an easy task). – Oskar Duveborn May 9 '11 at 13:24
Or -on the same note- if you have a dhcp server that allows, add a reservation with a fake gateway. Nonetheless, blocking on the firewall is still the best option. Most soho routers have some form of Lan >Wan deny/block – Joe Feb 3 at 19:15

just set a static IP on these machines and remove the gateway and/or DNS

share|improve this answer
why the hell was this downvoted? setting a static IP address with no default route in a flat network is a fine answer to this question. – SpacemanSpiff Jun 7 '12 at 4:47
@SpacemanSpiff: What's to stop them changing it back again? Or plugging something else in, for that matter? – SamB Oct 11 '12 at 3:39
Okay fine, put the warehouse users on their own subnet and policy route that traffic sourced from that subnet to a forwarding instance that does not have a default route. Done. – SpacemanSpiff Oct 11 '12 at 14:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.