Is it possible to isolate a computer on a network such that it can be accessed remotely by contractors, but not have access to any of the other machines on the network in any way? I understand it would always have access to the gateway at the least, but can it be isolated from other machines? I know I can secure the gateway sufficiently.

Could this be done with a software only solution? Would I need a physical firewall device? Could it be accomplished via subnets?

I'm trying to avoid a second ISP connection. I know that is a viable, but clunky, option. Thanks very much for any help you can provide.

  • You could set up a guest VLAN for the PC, and use ACLs in your routers to prevent that VLAN from accessing anything in your network. You would need to have rules on your firewall in order to let someone from the outside get to that VLAN.
    – Ron Maupin
    Commented Oct 20, 2016 at 15:11
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 15, 2017 at 4:56

2 Answers 2


One common way is to put that PC on its own VLAN. Then you can apply access lists on the VLAN interface to control what resources the computer can access. A firewall is not necessary.

  • The firewall protecting the network will still need rules to let the outside contractor get into that VLAN.
    – Ron Maupin
    Commented Oct 20, 2016 at 16:59

Absolutely. Simply assign the workstation's switchport to the outside VLAN. It will need a public IP address.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.