Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I need to connect a specific Windows PC which is currently sitting on an existing office LAN to the Internet. The LAN itself, the switch, and the other PCs connected to it do not require Internet connection.

Can I install an additional network card on that specific PC, attach a LAN cable from it to a broadband router, and thus have Internet access on that machine?

Would there some special network settings or DOS commands that I need to do in order to achieve this? Thanks for any pointers.

Additional info requested by Hennes:

  • Which OS does the PC run.

    Windows 7

  • Which network range is the LAN. Is it a single range or multiple.

    This hasn't been determined yet, but it could be 192.168.0.? or e.g. 10.?.?.?

  • Do you use your own internal only DNS.

    There may or may not be a DNS server.

share|improve this question
    
why not connect the switch to the router? that way all the PCs have connection to the internet. Or do you want to prevent them from having internet access? –  Keltari Feb 5 '13 at 14:58
1  
@Keltari The PCs are industrial workstations used to control factory machinery, so for security reason, they should not have Internet access. –  Joshua Lim Feb 5 '13 at 15:03
1  
Just a note on security. If the PC which is connected to the Internet gets a virus or worm then it can spread that from the windows PC to the factory control machinery. (Assuming they run something which can be infected). So the best security would be to not connect anything on the LAN to the Internet. Use physical separation (aka two PCs). –  Hennes Feb 5 '13 at 15:52

3 Answers 3

up vote 2 down vote accepted

Can I install an additional network card on that specific PC, attach a Ethernet cable from it to a broadband router, and thus have Internet access on that machine?

Yes, this would work.

The new NIC would be used as default, reaching any and all destinations,
except those where you explicitly set a route to use the other network card.

Depending on your OS this might be the simple default, or you may need to set a few routes. For those please see this post on subnetting (and routes).

If you connect things like this

enter image description here

and use different network ranges then you can tell the windows PC that all traffic for the 'green network' needs to go out via the green wire and everything else via the red wire.

To be able to reach all locations on the internet the 'green network' should not use any network ranges which are already in use on the internet. If you have your own public IP range then you can use that. If not select a range from RFC1918

(Briefly, that is from 10.0.0.0/8, 192.168.0.0/16 or 172.16.0.0/16)

Personally I am a fan of the 172.16.x.x. addresses since most people seem to avoid then. Thus avoiding potential future conflicts is several networks get merged.

Assuming this is the case and you selected 172.16.67.x/24 for the factory PCs and 192.168.74.x/24 for the windows PCs second NIC then:

All factory PCs check if the network is for themselves, if so loopback.
If not and the destination is the local LAN, send via the network card.
(No default route needed)

The windows PC checks if the network is for themselves, if so loopback.
If not and it is for the 171.16.67.x/24 range, send via the green wire.
If not and it is for the 192.168.74.x range, send via the red wire.
In all other cases send via the red wire (default route).

share|improve this answer
    
Thanks,I've edited the original question with my replies to your questions. By "The new NIC would be used as default,", do you mean Windows will by default use "Local Area Connection 2" to access any destination? What if I still need to access the other PCs on my LAN, e.g. 192.168.1.? and also allow other LAN PCs to access my PC? –  Joshua Lim Feb 5 '13 at 15:14
    
You can only have one default route in use. For all other NICs you will need to explicitly specify which traffic should be sent their way. You have two options: 1) Set routes for every network on the internet and let the rest go to the NIC connected to the LAN (Rather inpractical), or set the default to the NIC which leads to the internet and set all traffic to you LAN (192.168.1.0/24) to the LAN connected NIC. –  Hennes Feb 5 '13 at 15:18
    
Your serverfault link needs editing. –  Karan Feb 6 '13 at 18:07
    
@Hennes Thank for the details. I've been doing some Googling and it is mentioned that I may need to set the Default Gateway for the NIC connected to the ADSL router in order to access Internet access. But what if my local LAN NIC also has a Default Gateway? Wouldn't that be a conflict? –  Joshua Lim Feb 7 '13 at 6:38
    
Yes, that is why there can be only one active default gateway. And that one is not set for a specific NIC but for the entire computer. –  Hennes Feb 7 '13 at 16:40

Yes, simply adding another network card (wired or wireless) and connecting it to the broadband router should do the trick. Note that the networks should have separate IP addresses (e.g. the office LAN could be 192.168.1.x while the router LAN could be 192.168.2.x). Beyond that, you should not need any configuration.

It sounds like you want to avoid connecting the office LAN to the internet, so make sure you don't accidentally create a bridge on the PC which is connected to both networks. If you don't mind connecting the office LAN to the internet, disable DHCP on the router, give it a static IP from the office LAN IP range, connect it to the LAN and set the default gateway to the IP of the router.

share|improve this answer

Based on your reply to my comment to your question, you may still want to connect the switch to the broadband router. Most modern broadband routers have the ability to allow or disallow internet access to machines connected to it. Check your router's manual, or with your ISP, to learn if and how to do so. The advantage to this method is that it is an easy physical setup. - no additional ethernet cards. It also allows you to give machines internet access as necessary without any other equipment. This method allows all the machines to be on the same LAN and have one device handing out DHCP addresses (the IP addresses). You can add as many devices to the switch and/or broadband modem as needed and allow/disallow access to the internet. This is the most scalable and flexible option.

share|improve this answer
    
It certainly is the most easy way and it will work without extra hardware. Recommended if security is not very important. (Vice versa, if it is, get an extra PC to connect to the internet and keep things completely separate). –  Hennes Feb 5 '13 at 16:15
    
If you dont trust the routers built in security, then what do you trust? –  Keltari Feb 5 '13 at 16:17
    
I trust a hardware firewall (with someone who read the security mailing list of that firewall appliance). Ditto with a minimal PC running nothing but the firewall software (possibly OpenBSD based) with similar maintenance. I do not trust anything which does not get security fixes and most modems and similar consumer tools never seem to get any upgrades. (Disclaimer: no experience with corporate targeted DSL modems. Maybe those do get upgrades. Still, someone needs to apply those updates). –  Hennes Feb 5 '13 at 16:24

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.