0

In our network, we are connected to the outside world with an ADSL modem. A (wireless) router is connected to this ADSL modem, which provides wireless access to 3 laptops, and a USB connection to a printer.

Then, there is a desktop (Running Win7 Pro x64), which is used as a file server/svn repos, which is connected to the network with a wire connection, through the wireless router.

What we want to do is, to disable the internet access for this desktop which we use as a file server and only allow it to communicate with the devices on our network. We'd appreciate your help.

Here's a block diagram of the situation: We want to disable internet access for the Win7 desktop, but allow all the wireless clients to still access the desktop. Is this possible?

||      DSL
||      ||
||      ||               ============== ============== ==============
||      ||               | wireless   | | wireless   | | wireless   |
||   =============       | dhcp client| | dhcp client| | dhcp client|
||   |           |       ============== ============== ==============
||   |   ADSL    |          //               //              //           
||   |  modem    |                              
||   |192.168.1.1|                               
||   =============                      
||      ||
||      ||
||   =============    ==============
||   |           |    |            |
||   |  router   |====|  Win7      |
||   |           |====|  desktop   |
||   |192.168.2.1|    |192.168.2.80|
||   =============    ==============
Improve this question
1
  • If you have a router in place, and no publicly visible open ports on your file server - you are safe from external incoming traffic. Now, if you want to block outgoing http traffic to, you can create a rule in your router / firewall to block all traffic 0 - 1024 port range tcp/udp from that machine IP. make sure your fileserver have a static IP.
    – Mutahir
    Commented Jan 27, 2011 at 9:58

2 Answers 2

Reset to default
2

Use firewall on router or ADSL modem to restricting access to the IP address. Or delete default route on Windows 7 desktop.

Improve this answer
2
  • You will have to assign the fileserver a permanent IP (no DHCP) to make the firewall work over time.
    – Christian
    Commented Jan 27, 2011 at 8:56
  • You could assign a fixed IP address via DHCP if you want. I expect a file server already has a fixed IP.
    – dunxd
    Commented Jan 27, 2011 at 10:13
2

Well, windows will not like being denied Internet access. You need internet access for the patching and time synchronization among other things.

As you are already running NAT you are blocking incoming connections to the windows computer. You can always add an extra layer by configuring the firewall on it to block access to the services you want to protect.

If you really want to prevent internet access the quickest and easiest solution is either to remove the default gateway in the IP configuration, or to setup the windows firewall to only allow connections from 192.168.0.0/24 (which seems to be your network).

Improve this answer
4
  • 1
    +1 for pointing that out given it is a Win 7 desktop being used as a central file store. There are ways around these issues, but probably only warranted in an environment over the OP's size. For example, time synch should probably be done via an internal time server, and the config is pushed out via Active Directory. WSUS and SCCM are there to provide updates without giving direct access to the internet.
    – dunxd
    Commented Jan 27, 2011 at 10:13
  • pehrs: When we remove the default gateway in the IP configuration, the desktop can no longer be accessed by anyone anymore. The default gateway, by default, was set to 192.168.2.1, which is the address of the router.
    – SomethingBetter
    Commented Jan 27, 2011 at 11:49
  • What is the netmask of the server and the clients? Your router in the picture has a different subnet than the rest of the systems, which seems very weird...
    – pehrs
    Commented Jan 27, 2011 at 12:20
  • pehrs: Netmask of the clients are 255.255.255.0, Default gateway for the clients are 192.168.2.1. Netmask of the server is identical to the netmask of the clients. I am sorry for the confusion, the IP addresses in the pictures are not correct, I'll fix it in a second. All the clients, including the server has a 192.168.2.X address.
    – SomethingBetter
    Commented Jan 28, 2011 at 7:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .