How would I isolate one networked PC to LAN only?

Question

I would like to have one of my PCs available to the rest of my home network for file sharing and VNC access, but I want to block any Internet traffic going to and from the PC.

In other words, I want all local PCs I have connected to the router functioning as any normal LAN would, but when it comes to the Internet I want one particular PC to be "safe" from the Internet. My guess is that this is some sort of port blocking or some other router function, but I'm not quite sure.

Solution 1

Using your router should keep any packets from reaching the computer. As long as you don't have a DMZ setup or any port forwarding rules to the computer you should be protected from incoming traffic.

For outgoing traffic you can setup your non-internet connected PC to have a static IP address on your network. In your static IP configuration leave the default gateway field blank. This will keep this computer from sending its internet-bound traffic to the router and any attempt should return with an no route to host error, however, the machine should still be abel to talk to the other computers on the LAN.

Note: This is not a completely secure implementation. There is no firewall keeping outgoing packets from reaching the internet, so in theory a specially crafted packet could still get to the internet from this machine, but for most purposes this should work.

Solution 2

This is a bit pointless. If any of the machines on the network have the ability to receive connections then you should assume that they all can, since it is possible to surreptitiously set up a forwarder on the machine that can be accessed from the Internet.

Having said that, Internet access control is a function of the router. On my router it's under Access Restrictions | Internet Access, but it varies.

Comments

[clinton]

Maybe I should be more detailed: the single PC I want to isolate from the Internet is for media playing - I don't need the Internet features of the media PC, thus I want it to only have LAN and not Internet access. I only want LAN access so I can use VNC and file sharing so I can transfer files back/forth, and remotely control it without actually having to be at the machine.

[clinton]

I expanded on my question above, thanks for the suggestion but it's not exactly what I'm trying to do =)