Question about network set up with Windows 10

[rdl]

I know a little, but not much about networking. Is it possible to have a Windows 10 computer on my network that can access only a NAS and nothing else, not even the internet. I'm guessing it needs to be on a separate vlan some how, but the NAS would need to be on more than one since other computers need access to it. I have a managed switch somewhere I can use. If this is doable that's all I really need to know.

To make it harder though, I'd like to dual boot Linux on this pc, but in that case it needs full access to everything.

I currently have an Edgerouter-X between the cable modem an unmanaged switch (soon to be two switches maybe). A printer connects directly to the router but everything else is or will be on the switches. I don't know if this is the best set up, but it does work. I would have no problem making changes or buying equipment.

[rdl]

After thinking about it for a while I'm leaning toward just manually switching cables around since it won't have to be done very often. This is only to install and play games on Windows 10.

[Jackster]

Without taking into consideration of security reasons for doing this... This is the most basic way to do this.

I presume the server has a static IP? Add another IP on another subnet that the router does not manage.
On the Windows PC, set the IP to a static on the same subnet as the server's second IP.

The Windows PC "wont" be able to talk to other devices on the same physical network other than the server.

EG, your main network is on 192.168.1.1-254
Set the secondary IP to 10.0.0.1-254

Server has IPs
192.168.1.200
10.0.0.200

Windows PC IP
10.0.0.100

Your router won't route on the 10. network so your Windows PC and Server will only talk to each other and any other device that uses the same IP range.


I do this for CCTV cameras on a home network. It is not foolproof or hackerproof but it works fine if you are not concerned about the security aspect of doing this.

After thinking about it for a while I'm leaning toward just manually switching cables around since it won't have to be done very often. This is only to install and play games on Windows 10.

If this is to play totally legit and defo not cracked games,,,,,,,,,, don't even plug that PC into the network while Windows is running.

[Psi]

cheap old pc with two network cards running something like https://smoothwall.org/.


Set it up as a router in the GUI and have a firewall rule to block everything except the IP to/from the NAS.

[rdl]

Okay, I'll think about it some more and maybe watch some youtube videos. The NAS and everything else uses DHCP provided by the router. The game install files are legal from GOG and stored on the NAS. I just need to install the game and then play it on Windows 10. None of them will need internet access to work and I want Windows to have access to as little as possible.

I thought maybe as needed just plug the NAS and Windows machine into a standalone switch (before booting Windows), install the game, then disconnect.

The simplest thing might be to just copy the install files to a USB SSD and plug that into the Windows machine. The only drawback there is it's time consuming, but it only has to be done once per game.

[David Hess]

There are a couple ways to do that.

I have my NAS connected to my other systems on a completely separate network which has no connection to the internet.  There is just a switch and no router, so the lack of a DHCP server means that static IP addresses are used.  This does not do quite what you are asking, but if you had a system with a dedicated link to the NAS, then that would work, and then not even a switch is required.

My network is actually more complicated.  There are two separate dedicated local secure networks with separate switches which link several systems to my NAS, plus a parallel insecure network which has internet access.  With 3 x 1 gigabit networks connecting machines, Windows SMB 3 allows parallel operation of the networks for 3 gigabit networking between machines, even for single file transfers.  I went this route because 2.5 and 5 gigabit Ethernet network interface cards are poorly supported, 10 gigabit hardware is relatively expensive, I had extra gigabit hardware available, and well supported dual port Intel network interface cards can be had for $30.

A router with separate interfaces or a router with a VLAN switch can be used to isolate systems from each other with specific exceptions and can do what you want.  I have the hardware and eventually will be doing this with my insecure network.  However know that this places considerable demands on the performance of the router to handle full speed traffic.