Windows Forum

Ask something
Discussion Locked

Blocking internet usage by group policy

0 helpful
8 replies

by niel harper

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have a client that accesses the internet through a SonicWall SOHO firewall which connects to an ADSL router. The management wants to block internet usage by IP address or MAC address which the SonicWall cannot do. Can anyone tell me how I can block individual internet usage by using a Windows 2000 group policy.

8 replies

by nickh

I have been in a similar situation - I couldn't block via IP or MAC, and I couldn't purchase new software. What I did was put all of the users that I didn't want to have access to the Internet (in your case, computers) into the same OU. Under IE settings in the group policy, I pointed the users to a proxy server that didn't exist on my network. This effectivly prevents internet access. It's not an ideal solution, but if you're in a hurry, it works well.

by rabbit_runner

Here is another suggestion. I do not know the size of your network, but either you will be using Static IP addresses or using DHCP.

If you use static IP addresses, then visit each computer you do not want to access the internet. Remove the Default Gateway from the IP configuration. This will keep them from accessing the internet.

If you are using DHCP, then create two scopes. Configure one Scope normally, but the other scope, use reserved IP addresses for the MAC addreses of the computers you do not want to access the internet. Then in the DHCP properties, remove the gateway / router setting. Or put in an incorrect value so that the computer is not able to access the internet.

Hope this may help.

by rabbit_runner

Here is still another suggestion. if you create a group policy, (I have not tried this but it may work) Open the Group Policy,
Open User Configuration / Windows settings / Internet Explorer Interface. Then on the right hand window, find the 'Proxy Settings' Here you can point Internet Explorer to a non-existant proxy server.

Caution on this, I do not know but if IE attempts to connect via the Proxy, it will eventually time-out. Will it then default to the 'default gateway'? I do not know. But these are some things you can try.

Also note, that GPO's will only work on Windows 2000 workstations. If you have NT4, or Win9x, then the GPO will not work.

Best of luck

by sharon

We are also running a sonicwall. The way we accomplished internet access control is to set up a rule that denies http. we set this rule to apply to a certain amount of ips. (for example xx.xx.xx.01-xx.xx.xx.100) and we then set everyone who needsinternet access to static ips outside the blocked range. hope this helps.

This discussion is closed to new replies.