Windows Forum

Ask something
Discussion Locked

restricting internet access

0 helpful
8 replies

by leonb

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I would like to deny internet usage to selected users in an NT 4 domain by using group policies.

The default user and default computer policies do not have an option for this.

There is no proxy or ISA server being used.

How do I enable thispolicy

8 replies

by vh_s

I don't think you could.

What I could think of, is to disable the gateway and DNS server for those users. This couldn't be done through policy. It is whether you use DHCP and passing this information through, or otherwise setting it manually.

In case a manual setting, and those users have their own computers, then disable DNS and gateway. Then could you prevent it.

Otherwise, install proxy server. Keep it small and simple as you don't require complex system as you described.

My recommendation is then to install proxy server. It is the easiest way.

vh_s

by systhine from tampabay.rr.com

A proxy server is probably not the best solution in this case, seeing as it is difficult to configure clients this way. But, it seems that a lot of people have trouble understanding this sort of technology.
First, NT security policies do not affectInternet access no matter how your network is configured.
This all really depends on how your network is configured.
Are you using an NT box as your network gateway?
or Is your network gateway some sort of hardware router?
Assuming all your clients have their own Internet IP addresses, if your gateway is a NT server, I would suggest installing a firewall on the server to block packets being forwarded across the installed network cards and blocking access by IP address. Here you could also install a proxy server to better manage traffic, but this reduces some types of network access in a way that may be unacceptable.
If your gateway is a hardware router, utilize it's firewalling/forwarding features to block client access to the Internet. Here, you can also completely block all Internet access except for your proxy server (if you choose to use one) and use it to allow Internet access to your clients.

DHCP will only offhandedly affect Internet access. If you choose to use a firewall to prevent client access, your clients must have a static address in order to allow/disallow individual access rights, as you'll need to specify which IP addresses are allowed Internet access at your gateway and which are not.

Either choice, proxy or not, will require some sort of firewall at the gateway to prevent direct internet access from the clients.

Phew. I hope I helped someone.

by systhine from tampabay.rr.com

Another choice would be NAT (www.sygate.com), this can be used with non-routable IP addresses and networks with a server as a gateway.
Also, DHCP servers can be configured with address reservations by MAC address, which is a method of applying static IP addresses with DHCP.
Also, disallowing DNS access to a client does not inhibit Internet access in itself.

This discussion is closed to new replies.