Bottom line up front: An air-gapped AI workstation runs a full LLM stack on hardware with no active network connection — no Wi-Fi, no Ethernet, no Bluetooth data channel. Your prompts and outputs never touch a network. Setup takes 90 minutes the first time. Here's the exact process.

Most "private AI" setups stop at local models with network access disabled in the app. That's better than cloud AI, but it still leaves your machine connected. An OS-level network connection means firmware telemetry, background processes, accidental app calls, and attack surface. For work that genuinely can't leave a machine — classified research, active litigation materials, unreleased source code, journalist source communications — a true network break is the only defensible posture.

This guide covers the full setup: hardware selection, model downloads, OS hardening, a secure file transfer protocol for getting documents in and out, and a day-to-day workflow that doesn't create friction.

Who Actually Needs This (Be Honest With Yourself)

An air-gapped setup is significant operational overhead. Before investing the time, verify your threat model actually warrants it.

You need air-gapping if:

You handle classified or export-controlled information (ITAR, CUI, EAR)
You're a lawyer running AI analysis on privileged client communications
You're a security researcher reverse-engineering malware and can't risk beaconing
You're a journalist protecting source identity on a story with nation-state-level adversaries
You develop software under an NDA where even query patterns would reveal product direction

Standard local LLM (Ollama + network disabled) is sufficient if:

You want to keep data off cloud servers but have no active adversary
You're handling sensitive-but-not-classified business data
You work at a startup where client NDAs are the primary concern

If you're in the second category, the OpenWebUI setup guide is the right starting point. Come back here when your threat model escalates.

Hardware Requirements

The air-gapped machine doesn't need to be powerful — it needs to be adequate and physically controllable.

Minimum viable:

Any x86 laptop or desktop with 16GB RAM
100GB+ free storage (models are 4-8GB each; you'll want several)
CPU with AVX2 support (2013 or newer — nearly everything qualifies)

Recommended:

Apple Silicon Mac (M2/M3/M4) — Metal GPU acceleration for Ollama is exceptional, 32GB unified memory handles 70B models, and macOS has mature network control tools
Or any NVIDIA GPU machine with 8GB+ VRAM for CUDA acceleration on Linux

What to avoid:

Machines with cellular modems (some laptops have embedded LTE)
Hardware with proprietary firmware that phones home during POST (some enterprise Dell/HP models have this)
Shared machines where other users might reenable networking

For most setups, a refurbished M2 MacBook Air ($700-900) or a used ThinkPad with 32GB RAM ($400-500) is the right call. You don't need last year's hardware; you need hardware you control.

Phase 1: Download Everything While Connected

Do all your network operations on the designated machine before you pull the network plug. After this phase, the machine never connects again.

Pull Ollama and Your Models

Install Ollama normally while still connected:

```bash

macOS / Linux

curl -fsSL https://ollama.com/install.sh | sh

Verify

ollama --version

```

Pull every model you'll want. You won't be able to add more later without reconnecting:

```bash

General purpose — 8GB RAM minimum

ollama pull llama3.2:3b # Fast, fits anywhere

ollama pull llama3.2:latest # 3B default, good balance

Strong reasoning — 16GB RAM

ollama pull llama3.1:8b # Best 8B class

Code tasks — 8GB RAM

ollama pull qwen2.5-coder:7b

Long context — 16GB+ RAM

ollama pull mistral:7b-instruct

Embeddings (for local document search)

ollama pull nomic-embed-text

```

Models download to ~/.ollama/models. Record the exact sizes — you'll need this for your transfer manifest if you're migrating models to the air-gapped machine from a different computer.

Download OpenWebUI (Optional but Recommended)

The raw ollama run terminal works, but for document analysis, multi-turn conversations, and team use on a LAN, OpenWebUI is worth it. Download the Docker image while connected:

```bash

docker pull ghcr.io/open-webui/open-webui:v0.5.20

docker save ghcr.io/open-webui/open-webui:v0.5.20 -o openwebui-v0520.tar

```

Save this .tar to a USB drive that you'll physically transfer to the air-gapped machine.

Prepare Your Document Transfer Protocol

You'll need a repeatable process for getting documents into the air-gapped machine after you cut the network. Physical media is the only option — USB drives. The security concern is USB-based attack vectors (BadUSB, malicious firmware), so keep a dedicated set of USB drives used only for this machine.

Before transferring any sensitive documents, encrypt them on your connected machine first. Tresorit is the right tool for this step — it gives you end-to-end encrypted containers you can prepare on your internet-connected workstation, then physically move to the air-gapped machine. Even if the USB drive is intercepted or the air-gapped machine is later seized, the files are encrypted at rest with keys only you hold.

Affiliate Disclosure: This article may contain affiliate links. If you make a purchase through these links, we may earn a small commission at no extra cost to you. We only recommend products we genuinely believe in. This helps support our work and allows us to continue providing free content.

Create a dedicated Tresorit Tresor (folder) called air-gap-inbox. Files you want to process on the air-gapped machine go there first, sync to your laptop, then get physically transferred via USB. Files coming out of the air-gapped machine get physically transferred to a USB, then moved to a Tresorit folder for secure cloud sync.

This gives you an auditable, encrypted chain of custody for everything that crosses the air gap.

Phase 2: Disconnect and Harden

macOS

The most reliable way to disable networking on macOS isn't just turning off Wi-Fi — it's removing the network preference panes entirely and disabling the hardware interface.

```bash

Disable Wi-Fi adapter

networksetup -setairportpower en0 off

Disable Ethernet (if present)

networksetup -setnetworkserviceenabled Ethernet off

Disable Bluetooth (data channel — not just discovery)

defaults write /Library/Preferences/com.apple.Bluetooth.plist ControllerPowerState 0

```

For maximum assurance, go to System Settings → Network and delete every network service. Then go to System Settings → Sharing and disable everything.

Physical option: remove the Wi-Fi card (easy on older MacBooks, difficult on newer unified designs). For a dedicated air-gapped machine, this is worth doing.

Verify nothing is reachable:

```bash

ping -c 1 8.8.8.8 # Should fail immediately

curl --max-time 3 https://apple.com # Should time out

```

Linux (Ubuntu / Debian)

```bash

Disable all network interfaces

sudo ip link set wlan0 down

sudo ip link set eth0 down

Disable NetworkManager from managing interfaces

sudo systemctl stop NetworkManager

sudo systemctl disable NetworkManager

Block all outbound traffic as a belt-and-suspenders measure

sudo ufw enable

sudo ufw default deny outgoing

sudo ufw default deny incoming

```

Verify:

```bash

ip addr show # All interfaces should show DOWN or no IP

ss -tunap # No established connections

```

Disable Automatic System Updates

On both platforms, automatic updates will try to reach the network and may succeed if you ever accidentally reconnect. Disable them at the OS level.

macOS: System Settings → General → Software Update → Automatic Updates → disable all toggles.

Linux:

```bash

sudo systemctl disable apt-daily.timer

sudo systemctl disable apt-daily-upgrade.timer

sudo systemctl disable unattended-upgrades

```

Phase 3: Set Up the Local AI Stack Offline

With the network cut, start Ollama and verify it works entirely from local cache:

```bash

ollama serve & # Start the Ollama daemon

Test a model — this should work instantly, no download attempt

ollama run llama3.2 "Summarize: privacy is the foundation of autonomy."

```

If you chose to use OpenWebUI, load the saved Docker image:

```bash

On the air-gapped machine, from USB drive

docker load -i /path/to/usb/openwebui-v0520.tar

Start it

docker run -d \

--name open-webui \

-p 3000:8080 \

-v open-webui-data:/app/backend/data \

-e OLLAMA_BASE_URL=http://host.docker.internal:11434 \

-e ENABLE_SIGNUP=false \

--add-host=host.docker.internal:host-gateway \

ghcr.io/open-webui/open-webui:v0.5.20

```

Access OpenWebUI at http://localhost:3000 — fully functional, entirely offline.

Day-to-Day Workflow

Getting documents in:

Receive documents on your connected workstation via Proton Drive or email
Move them into your Tresorit air-gap-inbox folder
Copy to USB drive
Transfer physically to air-gapped machine
Decrypt and process

Sending outputs out:

Save AI outputs to a designated air-gap-outbox folder on the machine
Copy to USB drive
Transfer physically to connected workstation
Move to Tresorit for encrypted cloud backup or delivery

Document analysis workflow:

```bash

Upload document to OpenWebUI via the file icon in chat

Or from terminal using Ollama directly:

cat sensitive-contract.txt | ollama run llama3.1:8b \

"Extract all indemnification clauses and summarize the liability cap"

```

For batch processing, a simple shell loop works:

```bash

for f in ~/air-gap-inbox/*.txt; do

echo "=== Processing: $f ===" >> outputs/batch-summary.txt

cat "$f" | ollama run llama3.1:8b \

"Summarize the key obligations and any unusual terms" \

>> outputs/batch-summary.txt

echo "" >> outputs/batch-summary.txt

done

```

Comparing the Options: When Is Each Right?

|---|---|---|---|---|

For most privacy-conscious tech workers, a standard Ollama setup with network access disabled is the right call. If you want web-connected research without sending your queries to Google or OpenAI, Perplexity Pro offers relatively transparent data practices and a session-level no-history mode — useful for the connected machine in your workflow where you're doing background research that doesn't touch the sensitive material.

Common Failure Modes

The machine accidentally reconnects. This happens when someone installs a system update, a VPN reconnects, or macOS reconnects to a "known" network. Mitigate by physically removing network hardware if the threat model justifies it — on older ThinkPads, the Wi-Fi card is a single Phillips screw.

Models become outdated. Local models don't self-update, which is a privacy feature. But if you want newer model weights, you'll need a planned "connect, update, disconnect" cycle with a documented procedure. Never rush this — rushed reconnections are how air gaps get breached accidentally.

USB attack surface. BadUSB attacks can compromise a machine via malicious USB firmware. Mitigate by using USB drives from a known-good supply chain (purchased directly, never second-hand) and keeping them dedicated to this workflow. Consider a USB condom (data-blocking adapter) for any untrusted device.

Forgetting to decrypt outputs before transfer. Build the encrypt/decrypt steps into a written checklist. One forgotten decryption step and you've sent an unintelligible file to a client.

Is This Overkill for You?

Probably yes. An air-gapped setup is a significant commitment — the operational friction is real, model updates require planning, and the hardware cost is non-trivial.

But for the specific cases where it's warranted — active litigation, classified research, source protection, ITAR-controlled development — the alternative is trusting your LLM provider's data handling promises. Those promises are legally non-binding in most jurisdictions, subject to change without notice, and irrelevant once a subpoena arrives.

For sensitive work where you need full certainty, air-gapping isn't paranoia. It's due diligence.

Set up your air-gapped stack once. Your data stays yours permanently.

If you found this guide useful, subscribe below for weekly coverage of local AI tools, privacy research, and operational security practices — no tracking pixels, no cloud sync required.

Private AI Weekly

Local AI setups, operational security, and privacy research — delivered without tracking pixels.

Last updated: 2026-05-23