How to completely block a PC in LAN from Internet access ?

Toggle sidebar Toggle sidebar
E

ElenaXX

Commendable
Dec 21, 2016
10
0
1,510
Hi all,
I know this is apparently a trivial question but in practice (and in particular for a networking moron or almost so) it can be a real headache...

I want to COMPLETELY isolate one or more PCs in my LAN from Internet access. I mean, they must be allowed to access and be accessed by other PCs or resources in the LAN, but they must be completely forbidden to "go outside" or to receive any packets from outside - as though there were not any internet connetion at all from their viewpoint. I don't just want to block some ports or protocols, but ANY Internet activity.
The PC(s) I want to block have a fixed IP of course (no DHCP).
My router is a professional one, a brand new BinTec Elmeg which can be configured extensively but I'm not a networking engineer and I only have some bare knowledge of Internet protocols.
Which is, in your opinion, the easiest solution to achieve that without going mad ?
My router has not any "easy" (read: quick, shortcut) options to achieve this goal as my previous router (an Atlantis Land) had instead.
The manual is for super experts only of course and carries no examples.
In your opinion, should I first try to configure the Firewall to achieve this goal ? Or is it better to try somewhere else, maybe with the NAT ?
Oh, if possible, I would like a way to achieve that by just specifying the IP address of the machine(s) blocked rather than their MAC address (if possible, otherwise it's ok even the MAC address).
I trust in your help (or even just some useful hints) for such a simple problem but which for me is very hard !!
Also, I'd like to do this "the best way", i.e by properly configuring my router, and not the "poor man's solution" eg. by giving the blocked PCs a fake gateway address (which in addition can be changed by an expert user !!)
Please, before I shall pay for a network expert to come here and help me... ! !! :(
 
Solution
anotherdrew
Like Bill said, trying to block your teenager is challenging, but it sounds like these computers are all under your control, so that is not an issue.

I will assume we are talking about a server (file, media, whatever).
First, set the server's IP to a static address or use a MAC binding in your DHCP. (sounds like you did this)
Second, add a LAN->WAN firewall rule that DROPs all packets from your SOURCE IP (using your server's IP as the source).

That should do it.

** EDIT ** Remember that firewall rules are processed in order, so you want this rule to be before any rules that will allow such traffic.
Sort by date Sort by votes
B

bill001g

Titan
Aug 9, 2012
28,366
2,766
125,640
If your router have a firewall then that is the simple way.

Problem you have is your so called expert users will easily bypass you. They will simply change the ip address which is why you block via mac. But they can change the mac address easily also. As you mention the simple way is to just leave the gateway blank. Any user that can change that can change the ip and mac.

There is no simple way to do this especially with consumer grade equipment. The way it is done in a commercial installation is with 802.1x where each user must log in and they get access based on their what group their userid has access to.

 
Upvote 0 Downvote
anotherdrew

anotherdrew

Admirable
Dec 27, 2017
2,007
110
7,790
Like Bill said, trying to block your teenager is challenging, but it sounds like these computers are all under your control, so that is not an issue.

I will assume we are talking about a server (file, media, whatever).
First, set the server's IP to a static address or use a MAC binding in your DHCP. (sounds like you did this)
Second, add a LAN->WAN firewall rule that DROPs all packets from your SOURCE IP (using your server's IP as the source).

That should do it.

** EDIT ** Remember that firewall rules are processed in order, so you want this rule to be before any rules that will allow such traffic.
 
Upvote 0 Downvote
Solution
E

ElenaXX

Commendable
Dec 21, 2016
10
0
1,510
Thank you folks... sorry for my late reply but I did not receive any email notification (even if I enabled it ?! No it definitely did NOT end up in any spam folder...)

I also suspect setting properly my router's firewall would be the most rational option... Oh sorry for having explained poorly... yeah I said "an expert user could change the gateway", but I did not mean that my purpose is actually to forbid users ot "teenagers" or even worst geeks LOL to access the web... :) I just said that to underline that setting a wrong gateway is really a poor solution IMHO. My goal actually is to forbid any SOFTWARE to access the Internet, included Windows itself. I'm talking of two workstations (one specialized for graphics and one for music), which must simply be completely blocked any internet access for various security reasons.

As I said, all machines in my network have a static IP already.
Fact is, as I said I'm not very skilled with properly configuring a Firewall (and my router, being professional, can be configured very extensively and requires some networking knowledges I haven't gained yet).

So a good start would be to add a LAN->WAN firewall rule, as the first rule, that drops all packets containing as SOURCE IP that of the blocked machines, you say... OK, I will try to figure out how to accomplish that... great :) Seems quite simple... in theory :D I will try to do it. Thanks by now :)

 
Upvote 0 Downvote
Ralston18

Ralston18

Titan
Moderator
Oct 11, 2014
35,033
3,356
146,290
Check the following link:

https://fossbytes.com/block-program-from-accessing-internet-windows/

Seems to further the possibilities as described and discussed in the preceding posts.

Plus you may also be able to establish additional restrictions via Group Policy.

 
Upvote 0 Downvote
The Paladin

The Paladin

Polypheme
Ambassador
Oct 5, 2016
9,663
60
67,340
www.texastandyrestorations.org
Are you in charge of your internet ? should you not ask your IT staff for this details ?

ways to do this

directly at computer
1. goto computer, goto firewall, and uncheck the web browser from being allowed to access internet, under exception rules
2. set an admin password and change user to normal user this will prevent any other browser from being installed and user will have to request you to install software (any) on the computer and therefore locking your firewall rule down without recourse from user.

from server;
set a proxy server that has rules for which IP range is allowed to access the internet, set boot script to enforce web browser to use it or be denied internet service" this will let everyone else use internet but that Ip address will be locked out of internet access

from the router
Access settings with your router. Inside there, you can find the device and add the device to the MAC Address blocking list. This will block all access to the internet. They can connect, but it won't let them use it at all

 
Upvote 0 Downvote
E

ElenaXX

Commendable
Dec 21, 2016
10
0
1,510
Thank u all... it seems that by setting my router's firewall was the way to go. Just I had some troubles initially because I'm not a networking expert, but eventually I could made it do the job :)
There are surely other options in my router, like configuring the access filter, but I still have troubles understanding how it works. Now it's ok though :)
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom