diff --git a/artiq/windows/default.nix b/artiq/windows/default.nix
index b01eacc..31af053 100644
--- a/artiq/windows/default.nix
+++ b/artiq/windows/default.nix
@@ -49,7 +49,7 @@ let
       buildPhase = ''
         # +1 day from last modification of the disk image
         CLOCK=$(date -Is -d @$(expr $(stat -c %Y ${diskImage}) + 86400))
-        ${qemu.runQemu [
+        ${qemu.runQemu true [
           "-boot" "order=c"
           "-snapshot"
           "-drive" "file=${diskImage},index=0,media=disk,cache=unsafe"
diff --git a/artiq/windows/install.nix b/artiq/windows/install.nix
index 1786b45..680bb6f 100644
--- a/artiq/windows/install.nix
+++ b/artiq/windows/install.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
 
     if [ ! -f c.img ] ; then 
       ${qemu.qemu-img} create -f qcow2 c.img ${diskImageSize}
-      ${qemu.runQemu [
+      ${qemu.runQemu false [
         "-boot" "order=d"
         "-drive" "file=c.img,index=0,media=disk,cache=unsafe"
         "-drive" "file=$out/data/windows.iso,index=1,media=cdrom,cache=unsafe"
@@ -60,7 +60,7 @@ stdenv.mkDerivation {
       echo "Please perform a Windows installation."
     else
       echo "Please finalize your Windows installation (or delete c.img and restart)"
-      ${qemu.runQemu [
+      ${qemu.runQemu false [
         "-boot" "order=c"
         "-drive" "file=c.img,index=0,media=disk"
       ]} &
diff --git a/artiq/windows/qemu.nix b/artiq/windows/qemu.nix
index 9c4b395..bdd9618 100644
--- a/artiq/windows/qemu.nix
+++ b/artiq/windows/qemu.nix
@@ -10,13 +10,18 @@ with pkgs;
 let
   qemu = qemu_kvm;
   qemu-img = "${qemu}/bin/qemu-img";
-  runQemu = extraArgs:
+  runQemu = isolateNetwork: extraArgs:
     let
+      restrict =
+        if isolateNetwork
+        then "on"
+        else "off";
       args = [
         "-enable-kvm"
         "-m" qemuMem
         "-bios" "${OVMF.fd}/FV/OVMF.fd"
-        "-netdev" "user,id=n1,restrict=on,hostfwd=tcp::2022-:22" "-device" "e1000,netdev=n1"
+        "-netdev" "user,id=n1,restrict=${restrict},hostfwd=tcp::2022-:22"
+        "-device" "e1000,netdev=n1"
       ];
       argStr = builtins.concatStringsSep " " (args ++ extraArgs);
     in "qemu-system-x86_64 ${argStr}";