Mayayana <mayayana@invalid.nospam> wrote:
> "Char Jackson" <none@none.invalid> wrote
>
> | The OPs reasons for wanting to disable WAN access include "when weird
> | things happen or when installing software" and "just to disable the WAN
> | when walking away from the computer".
> |
> | Which software, specifically, is going to reinstate the proper config?
>
> I think the idea is to not have to depend on that. I've
> seen Win10 turn on Windows Update and BITS service,
> then do an update without asking. And that's not even
> getting into issues like malware or misbehaving commercial
> software. If you just pull the wire, and don't have WiFi set
> up, then you don't have to worry about whether you know
> all possible software risks.

'pulling the/a wire' has been suggested by several respondents, but as
far as I understand the OP's - changing - requirements, he wants to be
able to toggle off/on *WAN* access on a computer, but still wants to
have *LAN* access on/to that same computer. If that's indeed the case,
there isn't a cable which can be pulled to accomdate that scenario.

It has been suggested to mess_up/restore the DNS configuration of the
(to be switched off/on) computer, but I don't know if/how that affects
LAN access and which *kind* of LAN access (i.e. only Network Shares or
also other kinds of LAN networking?).

Char Jackson <none@none.invalid> wrote:

>>> Do you have a separate hub from your Internet modem?� Is so, flip the
>>> modem's switch off.
>>
>>Wouldn't that be separate ROUTER?
>
> It could be a router that's separate from the modem, but it could also
> be a switch that's separate from the router. In 2022, it's extremely
> unlikely to be a hub.

The modem is in a different area and the router is separate from that.
I have ethernet cabling in the wall so that's how the PC is connected.
There is a big switch in the basement with all the wires connecting it.

Multiple suggested software solutions are working.
Block with Gateway
Block with DNS
Block with Windows Firewall
Block with Proxy
Block with Network Adapter

They're not one software shortcut step yet to toggle on and off.
That's what I'm working on improving.

Mark Lloyd <not.email@all.invalid> wrote:

>> I don't want to disable the local network with the software switch.
>> I want to turn on and off only the wide area network to the internet.
>
> You could disable WAN access by turning off power to your modem. of
> disconnecting the cable.

That would work if I could log into the modem.
Do they allow me to change the settings inside the modem?

Frank Slootweg <this@ddress.is.invalid> wrote:

> 'pulling the/a wire' has been suggested by several respondents, but as
> far as I understand the OP's - changing - requirements, he wants to be
> able to toggle off/on *WAN* access on a computer, but still wants to
> have *LAN* access on/to that same computer. If that's indeed the case,
> there isn't a cable which can be pulled to accomdate that scenario.

It has to be done in software and it should be as easy as possible to do.
Some of the suggested softwares work for toggling off WAN & not LAN access.

Block with Gateway
Block with DNS
Block with Windows Firewall
Block with Proxy
Block with Network Adapter

I'm now looking for scripting to reduce the number of steps to one.

On Tue, 29 Mar 2022 16:22:26 +0100, Peter
<occassionally-confused@nospam.co.uk> wrote:

>Mark Lloyd <not.email@all.invalid> wrote:
>
>>> I don't want to disable the local network with the software switch.
>>> I want to turn on and off only the wide area network to the internet.
>>
>> You could disable WAN access by turning off power to your modem. of
>> disconnecting the cable.
>
>That would work if I could log into the modem.
>Do they allow me to change the settings inside the modem?

No, if you have a standalone cable modem there are internal web pages
that you can view to check status but there's nothing significant that
you can change. More specifically, there's nothing you can change that
would disable WAN access for a single PC without affecting all other PCs
and devices on your network. Mark's suggestion, above, to kill the power
to the modem would kill all WAN access completely, while you might be
thinking you want to kill WAN access just for a single PC.

On Tue, 29 Mar 2022 16:22:28 +0100, Peter
<occassionally-confused@nospam.co.uk> wrote:

>Frank Slootweg <this@ddress.is.invalid> wrote:
>
>> 'pulling the/a wire' has been suggested by several respondents, but as
>> far as I understand the OP's - changing - requirements, he wants to be
>> able to toggle off/on *WAN* access on a computer, but still wants to
>> have *LAN* access on/to that same computer. If that's indeed the case,
>> there isn't a cable which can be pulled to accomdate that scenario.
>
>It has to be done in software and it should be as easy as possible to do.
>Some of the suggested softwares work for toggling off WAN & not LAN access.
>
>Block with Gateway
>Block with DNS
>Block with Windows Firewall
>Block with Proxy
>Block with Network Adapter
>
>I'm now looking for scripting to reduce the number of steps to one.

That exact script, a toggle, has been posted before but I didn't need it
so I didn't save it. Here's a VPN 'kill switch' script that could be
modified to do what you want, I presume. Not sure if this has been
posted already. Watch for line wrap.

@echo off

:: GetAdmin
:-------------------------------------
:: Verify permissions
>nul 2>&1 "%SYSTEMROOT%\system32\cacls.exe" "%SYSTEMROOT%\system32\config\system"

:: On Error No Admin
if '%errorlevel%' NEQ '0' (
echo Getting administrative privileges...
goto DoUAC
) else ( goto getAdmin )

:DoUAC
echo Set UAC = CreateObject^("Shell.Application"^) >
"%temp%\getadmin.vbs"
set params = %*:"=""
echo UAC.ShellExecute "cmd.exe", "/c %~s0 %params%", "", "runas", 1
>> "%temp%\getadmin.vbs"

"%temp%\getadmin.vbs"
del "%temp%\getadmin.vbs"
exit /B

:getAdmin
pushd "%CD%"
CD /D "%~dp0"
:--------------------------------------

@echo off
:: CHANGE DEFAULT GW IP BELOW
set defgw=192.168.0.1

@For /f "tokens=3" %%1 in (
'route.exe print 0.0.0.0 ^|findstr "\<0.0.0.0.*0.0.0.0\>"') Do set
defgw=%%1
cls
:start
cls
echo.
color 0C
echo LiquidVPN's Simple VPN Kill Switch, ver. 0.1 - by LiquidVPN

echo.
echo.
echo Your routers gateway is probably "%defgw%"
echo -if nothing appears or its incorrect, add it manually (Press '3')
echo.
echo USAGE:
echo.
echo -Press "1" to Enable Kill Switch (IP "%defgw%")
echo -Press "2" to Disable Kill Switch (IP "%defgw%")
echo -Press "3" to manually set default gateway if its not detected
above.
echo -Press "h" for Kill Switch Help
echo -Press "x" to exit Kill Switch.
echo.
set /p option=Your option:
if '%option%'=='1' goto :option1
if '%option%'=='2' goto :option2
if '%option%'=='3' goto :option3
if '%option%'=='x' goto :exit
if '%option%'=='h' goto :help
echo Insert 1, 2, x or h
timeout 3
goto start
:option1
route delete 0.0.0.0 %defgw%
echo Default gateway "%defgw%" removed
timeout 3
goto start
:option2
route add 0.0.0.0 mask 0.0.0.0 %defgw%
echo Defaulte gateway "%defgw%" restored
timeout 3
goto start
:option3
echo
set /p defgw=your gw IP (e.g. 192.168.0.1):
goto start
:help
cls
echo.
echo.
echo ======================
echo This simple kill switch removes your default gateway
echo and blocks traffic from reaching the internet when
echo your VPN gets disconnected.
echo.
echo Here is how you use it.
echo.
echo Step 1: Connect to LiquidVPN
echo Step 2: Enable LiquidVPN's Kill Switch (option "1")
echo.
echo Now Any internet traffic will pass through LiquidVPN only.
echo.
echo - If your VPN gets disconnected so will your internet.
echo - Disable the Kill Switch and reconnect.
echo.
echo.
echo When you disconnect from LiquidVPN follow these steps
echo to reconnect or to browse the internet normally.
echo.
echo Step 1: Close any software that may leak your real IP
echo Step 2: Disable the LiquidVPN kill switch (Option "2")
echo Step 3: Reconnect to LiquidVPN and enable the kill switch (Option
"1")
echo.
timeout /T -1
goto start
:exit
exit

On 29 Mar 2022 14:49:36 GMT, Frank Slootweg <this@ddress.is.invalid>
wrote:

>Mayayana <mayayana@invalid.nospam> wrote:
>> "Char Jackson" <none@none.invalid> wrote
>>
>> | The OPs reasons for wanting to disable WAN access include "when weird
>> | things happen or when installing software" and "just to disable the WAN
>> | when walking away from the computer".
>> |
>> | Which software, specifically, is going to reinstate the proper config?
>>
>> I think the idea is to not have to depend on that. I've
>> seen Win10 turn on Windows Update and BITS service,
>> then do an update without asking. And that's not even
>> getting into issues like malware or misbehaving commercial
>> software. If you just pull the wire, and don't have WiFi set
>> up, then you don't have to worry about whether you know
>> all possible software risks.
>
> 'pulling the/a wire' has been suggested by several respondents, but as
>far as I understand the OP's - changing - requirements, he wants to be
>able to toggle off/on *WAN* access on a computer, but still wants to
>have *LAN* access on/to that same computer. If that's indeed the case,
>there isn't a cable which can be pulled to accomdate that scenario.
>
> It has been suggested to mess_up/restore the DNS configuration of the
>(to be switched off/on) computer, but I don't know if/how that affects
>LAN access and which *kind* of LAN access (i.e. only Network Shares or
>also other kinds of LAN networking?).

DNS wouldn't be my preferred approach. DNS doesn't affect WAN
connectivity, so any WAN destinations that are IP-hardcoded or already
cached would still be reachable. That's why I like the default gateway
approach.

On Tue, 29 Mar 2022 09:53:00 +0200, "R.Wieser" <address@not.available>
wrote:

>Char,
>
>> The OPs reasons for wanting to disable WAN access include "when weird
>> things happen or when installing software" and "just to disable the WAN
>> when walking away from the computer".
>
>Yeah, that was the feeling I got too.
>
>> Which software, specifically, is going to reinstate the proper config?
>
>DHCP ?

AFAIK, you can't manually remove the default gateway if you're using
DHCP, so it's an either/or situation. I'm not sure if a script can still
make changes, though. I don't use DHCP here.

"Frank Slootweg" <this@ddress.is.invalid> wrote

| > I think the idea is to not have to depend on that. I've
| > seen Win10 turn on Windows Update and BITS service,
| > then do an update without asking. And that's not even
| > getting into issues like malware or misbehaving commercial
| > software. If you just pull the wire, and don't have WiFi set
| > up, then you don't have to worry about whether you know
| > all possible software risks.
| | 'pulling the/a wire' has been suggested by several respondents, but as
| far as I understand the OP's - changing - requirements, he wants to be
| able to toggle off/on *WAN* access on a computer, but still wants to
| have *LAN* access on/to that same computer. If that's indeed the case,
| there isn't a cable which can be pulled to accomdate that scenario.
|

Yes, but the conversation was branching. Mark Lloyd
was pointing out that a software solution might not be
entirely secure. I was just seconding that view. That's
why I pull the plug. But I don't allow any local network
functionality, so it's the same thing for me. I can't see
other computers, don't print to a networked printer, etc.
Peter apparently wants to access something like a
networked printer while breaking the Internet connection
for just that computer.

On 3/29/22 09:49, Frank Slootweg wrote:

[snip]

> 'pulling the/a wire' has been suggested by several respondents, but as
> far as I understand the OP's - changing - requirements, he wants to be
> able to toggle off/on *WAN* access on a computer, but still wants to
> have *LAN* access on/to that same computer. If that's indeed the case,
> there isn't a cable which can be pulled to accomdate that scenario.

Which is why my suggestion was "pulling the wire" at the modem rather
than at the computer. This shouldn't affect LAN access.

[snip]

--
Mark Lloyd
http://notstupid.us/

"I think I'll believe in Gosh instead of God. If you don't believe in
Gosh too, you'll be darned to heck." - - anonymous

On 3/29/22 10:22, Peter wrote:
> Mark Lloyd <not.email@all.invalid> wrote:
>
>>> I don't want to disable the local network with the software switch.
>>> I want to turn on and off only the wide area network to the internet.
>>
>> You could disable WAN access by turning off power to your modem. of
>> disconnecting the cable.
>
> That would work if I could log into the modem.
> Do they allow me to change the settings inside the modem?

I have connected to my modem, but the only thing I can change there is
to reboot it, not turn if off. However, why would you need to log in to
physically unplug it?

--
Mark Lloyd
http://notstupid.us/

"I think I'll believe in Gosh instead of God. If you don't believe in
Gosh too, you'll be darned to heck." - - anonymous

On 3/29/22 10:56, Char Jackson wrote:

[snip]

> AFAIK, you can't manually remove the default gateway if you're using
> DHCP, so it's an either/or situation. I'm not sure if a script can still
> make changes, though. I don't use DHCP here.

You could always change to static addressing, and then have control over
those things.

--
Mark Lloyd
http://notstupid.us/

"I think I'll believe in Gosh instead of God. If you don't believe in
Gosh too, you'll be darned to heck." - - anonymous

Char,

> AFAIK, you can't manually remove the default gateway if you're
> using DHCP

That wasn't the question.

Regards,
Rudy Wieser

Mayayana <mayayana@invalid.nospam> wrote:
> "Frank Slootweg" <this@ddress.is.invalid> wrote
>
> | > I think the idea is to not have to depend on that. I've
> | > seen Win10 turn on Windows Update and BITS service,
> | > then do an update without asking. And that's not even
> | > getting into issues like malware or misbehaving commercial
> | > software. If you just pull the wire, and don't have WiFi set
> | > up, then you don't have to worry about whether you know
> | > all possible software risks.
> |
> | 'pulling the/a wire' has been suggested by several respondents, but as
> | far as I understand the OP's - changing - requirements, he wants to be
> | able to toggle off/on *WAN* access on a computer, but still wants to
> | have *LAN* access on/to that same computer. If that's indeed the case,
> | there isn't a cable which can be pulled to accomdate that scenario.
> |
>
> Yes, but the conversation was branching. Mark Lloyd
> was pointing out that a software solution might not be
> entirely secure. I was just seconding that view.

Thanks for clarifying.

> That's
> why I pull the plug. But I don't allow any local network
> functionality, so it's the same thing for me. I can't see
> other computers, don't print to a networked printer, etc.

You also don't use Network Shares or any other kind of networking to
get stuff/files from one computer to another?

(I also only have a local/non-networked printer, but do occasionally
used Network Shares between our two computers. And both computers have
Network Shares which point to our NAS.)

> Peter apparently wants to access something like a
> networked printer while breaking the Internet connection
> for just that computer.

Char Jackson <none@none.invalid> wrote:

> DNS wouldn't be my preferred approach. DNS doesn't affect WAN
> connectivity, so any WAN destinations that are IP-hardcoded or already
> cached would still be reachable. That's why I like the default gateway
> approach.

Did you mean DNS or DHCP when you said DNS doesn't affect IP-hardcoded WAN
addresses?

Mark Lloyd <not.email@all.invalid> wrote:

>>>> I don't want to disable the local network with the software switch.
>>>> I want to turn on and off only the wide area network to the internet.
>>>
>>> You could disable WAN access by turning off power to your modem. of
>>> disconnecting the cable.
>>
>> That would work if I could log into the modem.
>> Do they allow me to change the settings inside the modem?
>
> I have connected to my modem, but the only thing I can change there is
> to reboot it, not turn if off. However, why would you need to log in to
> physically unplug it?

Most of the suggestions made already give me what I asked for, with the only
issue left is that they're multiple steps, not a single software on/off
toggle for the WAN on a specific PC (but not for the rest of the PCs).
Block with Gateway
Block with DNS
Block with Windows Firewall
Block with Proxy
Block with Network Adapter

Each of these suggestions makes use of a software trick to disable & then
reenable the WAN while sitting at any one PC on the LAN (wifi or wired).

A hardware switch can't do anything like that as far as anyone has said.

Since most of the suggestions worked in my tests, what I am doing now is
trying to test which works better in a script for a one step on/off toggle.

I'm currently working with https://www.sordum.org/9660/net-disabler-v1-1/
which has software switches that can be toggled on and off and back on in
multiple steps but I think I can put them into a script which a shortcut can
point to that allows for an on/off and then off/on resettable toggle switch.

Usage: <command>
Commands:
/E : Enable Internet
/D : Disable Internet
/T : Target Action ( 1=Drive, 2=DNS, 3=Proxy, 4=Firewall )
/Q : Queries the Internet Blocked Status

Examples:
NetDisabler_x64.exe /E
NetDisabler_x64.exe /D
NetDisabler_x64.exe /Q
NetDisabler_x64.exe /D /T 1
NetDisabler_x64.exe /D /T 12
NetDisabler_x64.exe /D /T 13
NetDisabler_x64.exe /D /T 1234

Mark Lloyd <not.email@all.invalid> wrote:
> On 3/29/22 09:49, Frank Slootweg wrote:
>
> [snip]
>
> > 'pulling the/a wire' has been suggested by several respondents, but as
> > far as I understand the OP's - changing - requirements, he wants to be
> > able to toggle off/on *WAN* access on a computer, but still wants to
> > have *LAN* access on/to that same computer. If that's indeed the case,
> > there isn't a cable which can be pulled to accomdate that scenario.
>
> Which is why my suggestion was "pulling the wire" at the modem rather
> than at the computer. This shouldn't affect LAN access.

But AFAIK he does not want to disable WAN access for the other
computers. I.e. everything should stay as it is, only no WAN access for
one computer.

OTOH, as I said, his requirements seem to be/keep changing, so ...

> [snip]

Mayayana <mayayana@invalid.nospam> wrote:

> Yes, but the conversation was branching. Mark Lloyd
> was pointing out that a software solution might not be
> entirely secure.

Security isn't my concern but it's something to think about.
I already have working solutions based on all the advice.
The question is how to trim them down to a single click.

> I was just seconding that view. That's
> why I pull the plug. But I don't allow any local network
> functionality, so it's the same thing for me.

The switch has to work only on one computer as I have a family.
The switch can work on EACH computer but only one at a time.

> I can't see
> other computers, don't print to a networked printer, etc.
> Peter apparently wants to access something like a
> networked printer while breaking the Internet connection
> for just that computer.

I'm just trying to disconnect the computer from the Internet.
You need that when you install things and when you walk away from the PC.

And you need that when you see a program do something funny like bring up a
web browser on its own where I want to slam that down with a single click.

It's also helpful when torrenting to maintain only the torrent connection.
If the torrent connections falls away, you want the WAN to stop working.

These are common desires so there's nothing special or specific about mine.
You probably have all those possibilities already prevented but I don't.

Not yet anyway.

Frank Slootweg <this@ddress.is.invalid> wrote:

> But AFAIK he does not want to disable WAN access for the other
> computers. I.e. everything should stay as it is, only no WAN access for
> one computer.

This isn't as strange a need as you're implying it is since I would think
anyone would want to disconnect from the Internet on only one computer when
they install software on that one computer and yet still be able to have the
whole house use the Internet & any network shares and networked printers.

I didn't count how many of the suggested solutions worked so getting it to
work wasn't the problem. Getting it to be as simple as a single click is.

It's knowledge of the windows tricks that I need to get past the UAC prompt
and to run from the command line admin tasks and then the if-the-elses of
if it's already on, then turn it off, but if it's off, then turn it on.

What's slowing me down is so many of the solutions worked that I'm not sure
yet which solution has the best chance of being distilled to a single click.
Block with Gateway
Block with DNS
Block with Windows Firewall
Block with Proxy
Block with Network Adapter

They all work.
Which do you think has the best chance of being distilled to a single click?

"Frank Slootweg" <this@ddress.is.invalid> wrote

|
| You also don't use Network Shares or any other kind of networking to
| get stuff/files from one computer to another?
| No. I don't consider it safe. On an intranet that's firewalled
it makes more sense, but why share security risks on all my
computers? I don't generally need to share files. When I do
I just use a USB stick.

On 3/28/22 18:04, Mark Lloyd wrote:
> On 3/26/22 15:03, T wrote:
>> On 3/26/22 12:33, Peter wrote:
>>> The problem is that software command shuts off the LAN and the WAN.
>>> I only want to shut off the WAN with the software switch. Not the LAN.
>>
>> Do you have a separate hub from your Internet modem?  Is so, flip the
>> modem's switch off.
>
> Wouldn't that be separate ROUTER? Routers usually have hubs (and WiFi
> access points) in the same package, but that wouldn't affect being able
> to turn the modem off.
>
> If you can't turn off the modem can you switch the internet connection
> to it. I know there are switches for RG6/RG59 cables.
>
DSL modems usually (watch the weasel word) have the
three (modem, router, hub) combined. Cable and
fiber usually are separate.

"Peter" <occassionally-confused@nospam.co.uk> wrote

|
| > I was just seconding that view. That's
| > why I pull the plug. But I don't allow any local network
| > functionality, so it's the same thing for me.
| | The switch has to work only on one computer as I have a family.
| The switch can work on EACH computer but only one at a time.
|

| > I can't see
| > other computers, don't print to a networked printer, etc.
| > Peter apparently wants to access something like a
| > networked printer while breaking the Internet connection
| > for just that computer.
| | I'm just trying to disconnect the computer from the Internet.
| You need that when you install things and when you walk away from the PC.
|

We also have two users here, on multiple computers.
When I'm not online I pull the plug, because I feel the same
way you do about controlling things. That doesn't stop
other computers going online. They're all using wired
connections to the router. So I'm assuming you want
to be able to share files with other computers in your
house, or use a networked printer. Otherwise there's
no reason not to just use a hardware switch next to
your computer.

In other words, if you physically unplug the cable from
one computer, that doesn't affect the other computers
with their own connection to the router. It just means
that you can't exchange files with those computers.

Char Jackson <none@none.invalid> wrote:

>>I'm now looking for scripting to reduce the number of steps to one.
>
> That exact script, a toggle, has been posted before but I didn't need it
> so I didn't save it. Here's a VPN 'kill switch' script that could be
> modified to do what you want, I presume. Not sure if this has been
> posted already. Watch for line wrap.

That script is one of the many batch methods I'm trying to distill into a
single step where one-click stumblers are UAC control and admin elevation.
Example
%comspec% /c %windir%\system32\route.exe delete 0.0.0.0 192.168.1.1
ELSE
%comspec% /c %windir%\system32\route.exe add 0.0.0.0 mask 0.0.0.0 192.168.1.1
https://stackoverflow.com/questions/52090451/batch-script-file-get-default-gateway-and-ping-ip-address
https://stackoverflow.com/questions/22367173/get-default-gateway-from-batch-file

The other methods are the "Net Disabler" command line toggles.
Example:
NetDisabler_x64.exe /Disable /Type 2
ELSE
NetDisabler_x64.exe /Enable /Type 2
https://www.accuratereviews.com/how-to-temporarily-disable-your-internet-connection/

And the "wmic" powershell toggles.
Example:
wmic NICCOnfig where IPEnabled="True" get DefaultIPGateway
https://gist.github.com/gusg21/d5c81c70cc0935be006b21673fadcf7d

Which do you think stands the greatest chance of being distilled into a
single if-on-then-turn-off but if-off-then-turn-on network on/off switch?

Mayayana <mayayana@invalid.nospam> wrote:

> In other words, if you physically unplug the cable from
> one computer, that doesn't affect the other computers
> with their own connection to the router. It just means
> that you can't exchange files with those computers.

The goal is a one click intelligent software on/off network switch.
If there's a WAN on that PC, it disables it. If not, it enables it.

All the solutions I'm testing will already do that toggle.
But without the intelligence of the if-then-else knowledge.

An example is the "Net Disabler" tool wasbit had suggested.
https://www.accuratereviews.com/how-to-temporarily-disable-your-internet-connection/

Another example is the "Kill Switch" tool Char Jackson had suggested.
https://www.raymond.cc/blog/download/did/3746/

Another example are "NETSH" & "WMIC" tools that someone else had suggested.
https://www.action1.com/how-to-enable-disable-or-restart-network-adapter/

All work.
All require manual intervention.

There are too many solutions right now.
I need to focus on improving the intelligence of just one of them.

Which do you think has the best chance of distilling into a single click
network on/off toggle? (If the network is on, turn it off, and vice versa.)

"Peter" <occassionally-confused@nospam.co.uk> wrote

| Which do you think has the best chance of distilling into a single click
| network on/off toggle? (If the network is on, turn it off, and vice
versa.)

I don't know. It sounds like Char is the expert on this.
As I said, I've never enabled local networking, so WAN and
LAN are the same to me: Internet. So I just pull the plug.