Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to have one of my PCs available to the rest of my home network for file sharing and VNC access, but I want to block any Internet traffic going to and from the PC.

In other words, I want all local PCs I have connected to the router functioning as any normal LAN would, but when it comes to the Internet I want one particular PC to be "safe" from the Internet. My guess is that this is some sort of port blocking or some other router function, but I'm not quite sure.

share|improve this question
up vote 1 down vote accepted

Using your router should keep any packets from reaching the computer. As long as you don't have a DMZ setup or any port forwarding rules to the computer you should be protected from incoming traffic.

For outgoing traffic you can setup your non-internet connected PC to have a static IP address on your network. In your static IP configuration leave the default gateway field blank. This will keep this computer from sending its internet-bound traffic to the router and any attempt should return with an no route to host error, however, the machine should still be abel to talk to the other computers on the LAN.

Note: This is not a completely secure implementation. There is no firewall keeping outgoing packets from reaching the internet, so in theory a specially crafted packet could still get to the internet from this machine, but for most purposes this should work.

share|improve this answer
Maybe I should be more detailed: the single PC I want to isolate from the Internet is for media playing - I don't need the Internet features of the media PC, thus I want it to only have LAN and not Internet access. I only want LAN access so I can use VNC and file sharing so I can transfer files back/forth, and remotely control it without actually having to be at the machine. – user17348 Apr 26 '10 at 18:34

This is a bit pointless. If any of the machines on the network have the ability to receive connections then you should assume that they all can, since it is possible to surreptitiously set up a forwarder on the machine that can be accessed from the Internet.

Having said that, Internet access control is a function of the router. On my router it's under Access Restrictions | Internet Access, but it varies.

share|improve this answer

Another option is to use parental control software (e.g. NetNanny) on the restricted PC. If it's a Mac then it has parental controls built in under the user admin settings.

share|improve this answer
I expanded on my question above, thanks for the suggestion but it's not exactly what I'm trying to do =) – user17348 Apr 26 '10 at 18:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.