Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
We have discussed why Linux on the desktop is a bad fit for many serious users. Now it is time to get concrete. This is about how you can build a private, stable environment on Windows 11 Pro that reduces telemetry, isolates your important work, and resists the worst impulses of modern internet-connected operating systems.
This article is intentionally educational. If you care about your time, your creativity, and your data,
and if you are done with Linux-style chaos, this guide will help you implement a safer setup instead of wasting time online.
The goal is simple: one or two machines, a clean local area network (LAN), an air-gapped work machine, and browsers that do not sing like canaries by default. No marketing, just clear steps using affordable hardware.
1. The core idea: Separate your online life from your real work
Modern operating systems and browsers are noisy by default. They track you, they ring doorbells in the background, and they call home constantly. Trying to “fix” all of that on a single always-online machine is exhausting. Linux’s usual answer, which is to “just tweak everything yourself,” has already proven itself unreliable for those who actually have work to do.
A better approach is to divide and control:
- One device for online life: Use this for email, browsing, social media, and streaming.
- One device for real work: This is for documents, code, creative projects, and financials.
Ideally, this machine is air-gapped or heavily isolated.
You do not need two expensive machines to achieve this. A used desktop and a capable laptop are enough. What matters is how they connect, or specifically how they do not connect, to the outside world.
2. Basic hardware: Wired stability over wireless convenience
For a clean and reliable home setup, you should prioritize wired connections. You will need your
internet router from your ISP, a cheap Gigabit Ethernet switch if you have more devices than the router supports, and standard CAT5e or CAT6 cables.
Wired Ethernet is vastly preferable to Wi-Fi for several reasons:
- Stability: You avoid random disconnections and latency spikes, which is critical when running
large IDEs, 3D tools, or local AI models like ComfyUI. - Control: A cable is either plugged in or it is not. You do not have to trust software switches
that can fail or be bypassed by background processes. - Risk Reduction: It offers slightly better resistance to casual eavesdropping than home Wi-Fi,
though your real protection comes from isolation and habits.
The idea is to make the network physically obvious. If a machine must be offline for serious work, you simply pull the cable. You are not trusting a toggle in a settings menu.
3. Air-gapping explained for the non-expert
An air-gapped machine is physically disconnected from the internet and any external network it does not strictly need to access. In practice:
- Wi-Fi remains disabled.
- The Ethernet cable is not connected to your router or modem unless absolutely required.
- Data transfer happens via USB drives, local files, or controlled offline syncs.
For many professional workflows, constant online access is unnecessary. You can code locally in editors like Zed or VS Code, run local AI models through Ollama, or work in Blender and FreeCAD entirely offline.
When you need to pull information from the internet, use your “online” machine. Download the files
there, scan them if needed, and then move them via USB to the air-gapped machine. Air-gapping is not paranoia: it is basic risk control. You decide what enters your environment and when.
4. Setting up a simple, controlled LAN
Even if one machine is mostly air-gapped, it is useful to understand how to set up a small local network (LAN) so devices can talk locally without giving the internet free rein.
A typical simple setup involves your ISP modem providing a local network range and DHCP to automatically hand out IP addresses. If you want more control, you can use a managed switch for traffic segmentation, but for most people, an unmanaged switch is sufficient as the router handles the rest. A wired LAN with one primarily offline machine already puts you far ahead of those who plug everything into Wi-Fi and hope for the best.
5. Static IP addresses versus DHCP
By default, home networks use DHCP, where the router assigns a random IP address to each device. This is fine for casual use, but if you want control over which machines can talk to each other, you should use static IPs.
DHCP is convenient, but risky if you are trying to lock down rules. Addresses can change, and you
lose clarity regarding who is who on the network.
Static IPs allow you to choose a fixed address for important devices (e.g., .50 for your work PC,
.60 for your backup drive). This makes it easier to identify devices in logs and apply precise firewall
rules.
Practical approach:
Pick a small range that DHCP will not touch, such as 192.168.1.50 through .100. Assign static IPs to your main devices in that range and leave the rest for transient devices like phones via DHCP.
On Windows 11, you can set this by going to Settings $\rightarrow$ Network & Internet $\rightarrow$ Ethernet $\rightarrow$ IP assignment $\rightarrow$ Edit. Choose “Manual” and enter your IPv4 address, subnet mask (usually 255.255.255.0), and gateway (your router’s IP).
6. DNS and routing: Containing the traffic
Two concepts are vital for privacy: DNS and routing.
DNS translates human-readable names into IP addresses. By default, your ISP logs every single lookup you make.
Routing decides where traffic goes: to another local device, to the internet, or nowhere.
To reduce logging, configure your machines to use privacy-focused public DNS (such as 1.1.1.1 or
9.9.9.9) instead of ISP defaults. If you are truly air-gapping a machine, you do not need external DNS at all. Local tools and files do not require domain lookups. Every device that reaches the internet via uncontrolled DNS is quietly broadcasting more about you than you think.
7. Browsers: Avoiding the “Canary” effect
Modern browsers are tracking machines with superpowers. Out of the box, they identify your device via fingerprinting, track you across sites using third-party scripts, and send telemetry back to their
vendors. They sing like canaries.
If your online machine is already noisy, do not compound the problem with a browser that offers zero resistance.
Recommendations:
- Firefox: Open-source and backed by a nonprofit. It has strong anti-fingerprinting options and
Enhanced Tracking Protection. You should further harden it with uBlock Origin and strict tracking settings. - Brave: Chromium-based and blocks many trackers and ads by default. It is faster out of the box than vanilla Chrome for those who dislike clutter.
At a minimum, use strong blocker tools, avoid logging into every service with the same identity, and
never use your “serious work” machine’s browser to surf random sites.
8. How this ties back to Linux
For years, Linux advocates have told users: “Just use your own DNS,” or “Configure your router.” They claim you can control everything because it is open source.
That sounds powerful until you realize you are expected to do all of this while simultaneously fighting kernel regressions and repairing broken desktop environments after “safe” updates. Linux sells freedom, but it demands your time as payment.
On a properly configured, debloated Windows 11 Pro machine, air-gapped where it counts and paired with hardened browsers, you get reliability at the OS level and predictable behavior over the years. You do not have to recompile your kernel to be safe. You do not need ten different distributions to find one that does not lie to you about stability.
9. Action Checklist
- Separate your roles: Use two machines or clearly divided roles for online noise versus serious work.
- Air-gap your primary work machine and connect it only when necessary via wired Ethernet.
- Prefer cheap switches and CAT6 cables over flaky Wi-Fi for critical devices.
- Assign static IPs to key machines to maintain network clarity.
- Avoid default ISP DNS: use privacy-focused options or no external DNS while offline.
- Harden your browser: Use Firefox with uBlock Origin or Brave with strong shields.
- Encrypt sensitive files using 7-Zip and store them on external drives you control physically.