How to protect a computer on a local network without domains?

Question

Computer networks

There is such a situation:

There is a router (Yota Ready) (see 1) distributing the Internet via WiFI (for a bunch of cafe visitors with laptops (see 3)) and one stationary PC (see 2) in the back - connected by wire. This PC contains all kinds of accounting information, all sorts of “frauds” - in general, no one should see it.
Everything is on the same network. Question: How to protect an accounting PC from unauthorized access, but leave it access to the Internet?
My ideas:
1. Put in place 4 router - and through it give access to the Internet.
2. Disable home network in Windows settings. Will it help?
3. Put some kind of program on the accounting PC and set it up. What?
What is the best way to do this without cost?
Thank you =)

Answer 1

The easiest way out is to install a local firewall. Comodo is great and it's free.

Answer 2

For such situations, the breakdown of the network into vlans (booches and wi-fi clients in different vlans) is just right, while everyone goes online. Most routers support creating vlans.

Answer 3

Disable file and printer sharing. In the wall of fire, close incoming connections on TCP/UDP ports 1-1024. Leave the rest in interactive mode for the first time, when all the necessary software has been studied, lock everything that has not been studied.

Answer 4

Why don't you make a separate Internet connection for the accounting computer, do Yota really run out of USB modems?
Or the cost of information and / or downtime in case of its loss / damage is lower than access to the Internet?

Answer 5

And if you disable all outgoing files, then downloading files over the network will be prohibited, and similar programs like Skype?

Answer 6

Thank you. I'll try.

Answer 7

If Windows 7 is installed, then in the network settings you can turn off a lot of things, in previous versions you don’t know, but the firewall will be more reliable