Networks

Ask something
Discussion Locked

Lock Down Internet Access

0 helpful
12 replies

by Member 22879628

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I administer a small network, Single SBS 2003 Server and 10 workstations. The network gets internet access through a broadband connection hooked into the server through a second NIC. Pretty basic setup. The domain security locks down everything except the internet connection. If I plug a laptop or PC running most any operating system into one of the network ports, I cannot access domain resources, but I can get right onto the internet without authentication of any type. I'd like to lock that down...is there anyway in SBS 2003 to require domain authentication or some other password protection before allowing access to the internet connection?

12 replies

by cg it

ISA server which comes with the premium edition of SBS 2003 or you can opt for something like a Sonicwall TZ 170 firewall/symantec 320/360 firewall or a proxy server.

by Member 22879628

Poster rated this answer.
I should have mentioned I have SBS 2003 Standard...I'm looking for a solution within that OS, without purchasing something else.

by bfilmfan

IPSEc is your answer. It is part of the Win2K3 opearating system TCP/IP stack.

Using IPSec you can easily filter who can and cannot reach the Internet. There is a small cost to the server for processign overhead.

IPSEC overview:

http://www.windowsecurity.com/articles/Windows_Server_2003_IPSec_Part1.html

http://www.windowsecurity.com/articles/Windows_Server_2003_IPSec_Part2.html

And a ton of other IPSec articles:

http://www.securitydocs.com/Operating_System/Microsoft/Windows_2003

by Member 22879628

It might be there...I read for a couple hours and didn't see. I am an amateur, hence why I am seeking the assistance. If you can point me a little closer to the specifics of the how-to, I?d be glad to give you the points.

by collignond

One option is to use a proxy server.
One that I know of that works well is squid, originally written for linux, there is a windows version. The installation that I saw was on a linux box pulling authentication info from a NDS database. I have played with it a little and it seems to be configurable for ust about any setup you could need.

by Member 22879628

It might be there...I read for a couple hours and didn't see. I am an amateur, hence why I am seeking the assistance. If you can point me a little closer to the specifics of the how-to, I?d be glad to give you the points.

by sardukkan

I know that this is a old post and this solution is not for sites with users with a little bit of Savey... You do each station you want to disable Inet access on and change. Open
Inet explorer / tools / inet option / connections / Check "Use a proxy server" enter a loop back ip 127.0.0.1 and click ok. The PC will not be able to access the internet and it won't affect the local LAN

by Member 22879628

Actually, I am quite the amateur, so any creative solution is welcome. I am still looking for an answer. My problem is not the workstations on my network, I am not trying to stop access by those stations. It is the person that brings an unknown laptop onto the campus and just plugs in and uses the internet. SBS2003 secures all other network resources by authentication, but the internet access is wide open. I generally keep most rooms physically secure that have network ports. However, it is an open campus and I must have ports is some areas that just cannot be physically secured. So I need something that stops anyone not authenticated from using the internet. Several of the suggestions offered probably have merit, such IPSEC, but so far it has been beyond my comprehension to know how to make that work. Thanks for your input...I will remember the tip if I ever do need to stop one of my workstations.

by wrighte

The answer may lie in configuring your modem rather than the SBS Server. On some you can limit access to specific MAC address (the discrete number/letter code used to identify the NIC). Worth a shot...

This discussion is closed to new replies.