Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have recently bought a computer with Windows 8 (I will call it 'W8'). I would like to keep the install on W8 'pristine' by having it for internal network use only, without access to the internet. I do not have money to buy a separate machine for a firewall to do this, but I thought about using a virtual machine on W8. This VM would have two virtual network adapters and run Linux or BSD with some firewall software. So, I would start the virtual machine, which would then grant W8 access to my home network, but no further; it would control all traffic of W8. W8 itself would somehow route all requests through that VM firewall. I basically want to know: is this even possible? How would I go about setting this up?

share|improve this question
I don't know how to set it up, so not answering, but I know for a fact that Hyper-V does support exclusive use of a network adapter for a VM so the Host OS can not access it. On a separate note, what is wrong with the built in windows firewall that you are choosing to use a separate Linux one? – Scott Chamberlain Mar 9 '13 at 0:47
I am not very familiar with Windows, but I was under the impression that this would firstly be safer because I would have another machine in the way before the rest of the network and secondly, that Linux would allow me finer-grained control of the firewall. – Micaiah Mar 9 '13 at 0:50
Unless you are doing very special stuff using things with IPTABLES the built in windows firewall that has been in place ever since Windows XP can give you very fine grained control on allowed or blocked inbound and outbound connections based on port, program, or by src/dest IP. By default all versions of windows (XP SP2 and above) allow all outgoing ports and block all incoming ports unless a exception has been made. There is a list of preset exceptions but they are easily adjustable, and often only turned on if you have the windows feature on (ex: SMB port if you have fileshares enabled) – Scott Chamberlain Mar 9 '13 at 0:53
If I wanted to set up your "pristine" rule all I would need to do is set a Deny rule for all incoming and outgoing connections who's IP is not in my local subnet. – Scott Chamberlain Mar 9 '13 at 1:00
Thank you for your comments -- that probably sounds enough, but I am still interested in the technical feasibility of this (it might be useful later on). – Micaiah Mar 9 '13 at 1:04

I hope you are doing this out of curiosity, because:

  • If you trust enough the Microsoft firewall, stay with it and spare some trouble.
  • If you do not trust the MS firewall, using it to redirect traffic to another firewall is rather pointless. A chain is as weak as the weakest of its links.

Keep in mind that a cheap ARM-based computer can cost as little as 20€.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .