How to Air-Gap a Computer Safely

Air-gapping a computer means separating it from networks and other communication paths so it cannot connect to the internet or a local network. It can reduce remote access risks, but it does not make a computer impossible to compromise: removable media, shared peripherals, and physical access can still carry threats. Before starting, decide whether you need a temporary offline setup or a machine that will remain isolated, and arrange a safe way to transfer any necessary files.

What You’ll Need

• Physical access to the computer and its network connections.
• A way to disable or remove every network interface, such as unplugging Ethernet and disabling Wi-Fi and Bluetooth.
• If transferring files is necessary, a dedicated removable drive and a separate, trusted computer for checking it.
• Administrator access to change network settings, if you plan to disable network adapters in the operating system.
• A written list of the functions and files the offline computer must support.

Step-by-Step

1. Define what must stay offline. Identify whether the goal is to prevent internet access only or to prevent connections to all other devices. A computer disconnected from the internet but still attached to a home or office LAN is not fully air-gapped. Include wireless links, tethering, shared storage, and connected peripherals in your assessment.
2. Prepare before disconnecting. While the computer is still connected, install operating-system and application updates from trusted sources, if appropriate. Download required installers and documentation from official sources, then verify available digital signatures or published checksums. Do not plan on downloading updates later from the isolated machine. Back up essential data and note any software that needs online activation or periodic licensing checks.
3. Disconnect wired networking. Shut down the computer, then unplug its Ethernet cable. Disconnect any USB Ethernet adapter, docking station, or other accessory that provides a network connection. If the computer is connected to a router, switch, modem, or wall jack through another cable, remove that connection too. Keep the cable physically away from the computer to avoid accidental reconnection.
4. Disable wireless connections. Turn off Wi-Fi and Bluetooth using the operating system’s settings or hardware controls. On Windows, open Settings and look under Network & internet for Wi-Fi controls; Bluetooth is usually under Bluetooth & devices. On macOS, use Control Center or System Settings to turn off Wi-Fi and Bluetooth. Menu names can vary by version. Airplane mode can help, but check Wi-Fi and Bluetooth separately because some devices allow them to be turned back on while airplane mode remains active.
5. Remove other network-capable interfaces. Check for cellular modems, SIM or eSIM connectivity, USB mobile broadband devices, and tethering through a phone. Disconnect or disable them. If the computer has multiple network adapters, inspect each one rather than assuming that turning off Wi-Fi removed every route. For a high-assurance setup, have a qualified technician assess less obvious interfaces and firmware-managed features.
6. Disable adapters in the operating system if appropriate. As an additional precaution, disable network adapters in the computer’s network settings or device-management tools. This is not a substitute for unplugging cables and switching off radios: an administrator or software change may re-enable an adapter. Avoid changing firmware settings unless you understand how to restore them and have access to the relevant recovery information.
7. Restart and verify isolation. Restart the computer with network cables still unplugged and wireless features off. Confirm that no network connection is shown and that Wi-Fi, Bluetooth, cellular, and tethering are disabled. Check that no virtual machine, dock, or secondary adapter has an active connection. Do not treat a failed internet test alone as proof of isolation; a LAN connection can remain active even without internet access.
8. Set rules for file transfers. If the computer needs files, use a dedicated removable drive rather than connecting it directly to a networked computer. Scan the drive on a separate, trusted, updated computer before use, and transfer only the specific files required. Safely eject it, then scan it on the offline machine with its installed security tools when available. A scan reduces risk but cannot guarantee that a file is safe.
9. Keep the isolation in place. Label the computer and its cables, store transfer drives separately, and limit who can connect devices. Document any permitted transfer process. If you reconnect the computer for maintenance, treat it as no longer air-gapped until you disconnect it again and repeat the checks.

Common Mistakes

• Unplugging Ethernet but leaving Wi-Fi on. A wired disconnection does nothing to stop a wireless connection. Check every radio and adapter.
• Confusing “no internet” with “air-gapped.” A computer may have no internet access yet still communicate with devices on its local network.
• Relying only on software settings. Settings can be changed or reset. Physical disconnection is more dependable for wired links, while wireless controls need regular verification.
• Using a shared USB drive casually. Removable media can carry malicious files between connected and isolated systems. Avoid using the same drive for routine transfers and unrelated personal files.
• Forgetting hidden connections. Docks, cellular modems, phone tethering, virtual network adapters, and remote-management features may provide paths you did not intend.
• Assuming the computer is safe because it is offline. Air-gapping limits network exposure; it does not remove existing malware, protect against physical tampering, or prevent unsafe files from being opened.

Tips

• Use the least connected setup that still meets the computer’s purpose. Unplug unused peripherals and disable features you do not need.
• Keep a dated checklist of cables, radios, adapters, and verification steps. Repeat it after system updates, repairs, or hardware changes.
• For sensitive work, control physical access and keep the computer in a secure location. The air gap is only one part of a broader security plan.
• Maintain offline backups and test that you can restore them. Keep backup media disconnected when not in use.
• Plan for updates and time-dependent software before isolation. Some applications may stop working when they cannot reach activation or synchronization services.

Troubleshooting

The computer still shows a network connection: Unplug Ethernet and inspect the dock, adapters, and wall connections. Turn off Wi-Fi, Bluetooth, and cellular connections separately. Check for USB network devices and phone tethering. If a connection remains, identify the active adapter in the system’s network settings before changing more settings.

Wi-Fi comes back after a restart: Turn it off again and check whether a hardware switch, keyboard shortcut, management policy, or startup utility is enabling it. If you cannot keep it disabled, remove or physically disable the wireless hardware only with suitable technical support; do not open a computer if doing so could damage it or affect a warranty.

A required app will not start offline: It may need online activation, a license check, synchronized data, or a service hosted elsewhere. Check the software’s official offline-use instructions before disconnecting. Do not assume that changing the computer’s date or bypassing an activation system is an appropriate fix.

A transferred file is blocked or behaves unexpectedly: Do not disable security controls just to open it. Remove the drive, verify the file’s source and integrity, and scan it on a trusted system. If the file is not essential or cannot be verified, do not transfer it.

You need to reconnect for maintenance: Record what will be connected and why, then connect only to a trusted network for the required task. Disconnect again afterward, turn off radios, restart if useful, and repeat the isolation checks. If the machine handled suspicious files while connected, assess it before returning it to sensitive offline use.

Frequently Asked Questions

Does turning off Wi-Fi make a computer air-gapped?
No. Ethernet, cellular, Bluetooth-based networking, tethering, docks, or other interfaces may still connect it. Disable or remove all communication paths relevant to your setup.

Can an air-gapped computer use a USB drive?
Yes, but a USB drive creates a transfer path. Use dedicated media, verify its source, scan it on a separate trusted computer, and transfer only necessary files.

Is airplane mode enough?
Not necessarily. Some devices allow individual radios to be switched back on, and airplane mode does not unplug Ethernet or disable every external network adapter. Verify each connection separately.

Can malware reach an offline computer?
Yes. Existing infections, infected removable media, or physical access can still pose risks. Isolation reduces certain remote threats but is not a guarantee of safety.

How can I update an air-gapped computer?
Obtain updates from a trusted source using another computer, verify signatures or checksums when available, and transfer them with controlled removable media. Follow the operating system or software maker’s instructions.

Is a computer on a local network air-gapped if the router has no internet?
No. It can still communicate with other devices on that local network. To air-gap it, disconnect it from the network itself, not just from the internet.

Related

• Prevent Your Windows 11 Background From Changing
• Trim Video with Photos on Windows 10
• Bluetooth Remove Failed in Windows: How to Fix It