Absolutely not lol

Are you starting fresh with XP or using an old crusty install. If you start fresh you should be fine. Just don’t browse the internet on it, or run sketchy ass software on it. And turn it off when you’re done. Behind NAT the only way for your device to get infected is for something else on the network infect it.

Also FYI it’s probably not going to work with your WiFi. You’re probably going to need to be hard wired. Most built in network cards from windows XP era machines don’t understand WPA2, and WPA3 is allegedly backwards compatible, but it REALLY hates older devices that barely speak WPA 2.

I have an old router that I installed DD-WRT on that I use for my old devices. I have the WiFi power dropped down to the bare minimum, and it barely leaves the room. Then I have an open WiFi network with MAC address filtering, that automatically turns off after a few hours of no devices. I can turn it on with the WPS button. That gets me a relatively not entirely insecure wireless network that I can use on devices all the way back on my iBook G3 or earlier.

Just remember, you are the biggest threat to your network.

Any particular reason it needs to be XP?

Last time I checked there was over 40 open exploits that are fairly easy to trigger. (Mostly related to web browsing or gpu acceleration)

I'd imagine something like Debian or Alpine would run on it?

Unless it's built into something and can't be changed, what possible benefit could there be to connecting an old, unsupported OS to the internet!?

The XP device is a major security risk because its got known security vulnerabilities that are not patched and actively targetted. Its targetted because hackefs know there are bad businesses and users still running xp.

The issue is less your firewall and instead your whole network. If XP has internet access and is on your home network, it gives hackers and malware a route through to your other devices.

If you want to connect XP to the internet then there are two realistic options.

One is give the XP machine its own isolated network alongside your home network - a VLAN (virtual local area network) - i.e. a second physical network if your router supports it. One easy way of doing that is to see if your router has a Guest Wifi set up, and if so ensure that is configured to be entirely separate from your main network. But this is still risky because if you dont know what youre doing you could accidentally leave your network exposed. Also if you already use the guest network - for guests for example - then you'll put those devices at risk, and should make a whole dedocated vlan instead.

The other option is get a second router, create a wifi with that (or ethernet connection ideally) and connect that router to the internet via an always on VPN (virtual private network). The second router and network would completely physically isolates the XP machine from your home network, even though it needs to connect through your first router to reach fhe internet. The VPN is key there, but if you dont want to use a VPN you could also isolate the second in a VLAN on your main router. This is similar to option one but would allow a totally separate dedicated wifi connection without losing your guest wifi or compromising your home wifi.

The XP machine itself will always be vulnerable whatever you do. Obviously configure a firewall and antivirus on it, and be safe in how you use it, to minimize the risk.

Whatever you do, do not connect rhe XP machine directly to your home network if you're giving it access out onto the internet.

Edit: I may have misubderstood the question. If the device is not being allowed internet access at all, its safe to be on your network as long as you are careful what you load onto it. Malware on the XP device would still have access to your network. But yes if its contained behind your firewall and locked in, its not a problem in itself. I'd question why it needs to be on the network at all if you're not giving it internet access though.

You probably wouldn't even be able to visit websites/have them work correctly, because the browser is so outdated.

I would avoid giving it internet access. You could probably get away with network access, but id still mainly restrict it to a disconnected network and just download anything you need for it from a modern machine. (Probably a shared nas for transfer.) If you've got a good router (ie not a isp or home router) you could give it access to specific items on a whitelisting basis.

No.

Could you just put Linux on the old machine instead? I suspect that would be safer.

I'd say no. I have a separate router with no internet access for my XP LAN gaming.

well realistically its not dangerous unless you have some very open/unrestricted network setup

Only if it's an air gapped network with no internet access.

Install Linux Mint.

Lighter than it ought to be.

Runs on potato.

If you can, I’d just block connections from this WinXP box to the Internet completely, then it should be fine.

I don’t know the reputation of this host, whether it’s a C2 slave/bot or other malware.