Strategy to protect a machine on my network?

[wolfereeno]

I've got an older windows 10 machine that I always worry is a little flakey and might be comrpomised.  It's got a virus scanner and I've rebuilt it a few times. But it is a music making machine and has a lot of shareware plug ins.   

The rest of the machines on my network are all Mac.  And I've been switching gradually to using them.   In the mean time, is there a good way using Orbi to limit access to it to/from the internet?  Kind of contain it?

[CrimpOn]

By default, Orbi does not accept incoming connection unless Port Forwarding is set up.

Sp, it is categorically impossible for anyone outside the Orbi LAN to connect to a computer ON the LAN without being "invited."

Please understand, that once a computer inside the LAN opens a connection to the internet, then IT has opened a pathway through the Orbi firewall to "somewhere".  If this "music machine" is connected to internet music resources through those shareware plugins, then a compromised plugin can certainly compromise the computer.  But, that's always the case.

If this is a Windows 7 computer (?), you can also make certain that the Windows Firewall is activated and rejecting connection attempts.  Those plugins remain, of course.  Another step is to ensure that these music plugins are not running under an "Administrator" account.  My Windows login is not an Administrator.  That means that every time I want to "do things", such as install a program, I have to type in the administrator password.  (After five years, I have gotten pretty speedy at typing it.)

[wolfereeno]

Thanks for the reply!

It's a windows 10 machine and I think the windows firewall is on.  I will change the account to no longer be an admin account.  That's a good idea.

What's the best way to turn off internet access unless I'm using it?   I'd use airplane mode but I want to be able to connect to the machine inside the network.