Re: How do I keep my server off the net?
 

Than simply block all UDP traffic for the server port - in and out. And have a look at the HL readme.txt, there are some other ports involved too which you might need to block.

Or even better:
Block everything and allow only those ports you really require:
DNS: UDP 53
WWW: TCP 80 and TCP 443
SMTP: TCP 25
POP3: TCP 110
IMAP: TCP 143

Re: How do I keep my server off the net?
 

is there something i could put in the target line to keep server from downloading security module?
is there anything i can add to target to get steam not to check for updates?
2 problems Im having with STEAM - unplugged...

Re: How do I keep my server off the net?
 

You need to download the security module each time for VAC to work. Unless you want to run without it then you uncheck VAC on the start server window if you use the gui mode. Or just change secure "1" to secure "0" in liblist.
As for stopping it from checking for updates, as far as I know it won't unless you have -autoupdate added to the target line.

Re: How do I keep my server off the net?
 

These two parameters to hlds.exe should do what you want.
+sv_lan 1 -nomaster

Re: How do I keep my server off the net?
 

and "-secure 0" ;)