Surf Control

You can put bad addresses for the web sites in your DNS server or individual computer host files. Now THAT's really really simple. Example host file entry:

127.0.0.1 mail.yahoo.com

Another solution that is slightly more complicated is to implement a web proxy server and put your restrictions into that software. You would have to be sure that all web traffic could only pass your firewall from the web proxy server. As I say that solution is orders of magnitude more complex than just giving bad addresses for forbidden sites, but the web proxy/firewall solution is probably the second easiest solution.

I create a hosts.deny and black list hotmail.com, mail.yahoo.com, etc.

I also agree with the proxy. I think this is a far better long term solution and will serve you better.

Here is a proxy server solution, if you have an old spare PC available:

A couple of years ago I installed RedHat 9 with Squid - see http://www.squid-cache.org - on an old PC as a web proxy server for 120 users at 3 sites connected by a VPN WAN. Squid comes as standard with the Fedora Core 4 server.

It is possible to allow or deny browser access by IP address or user authentication. Several user authentication methods are available, e.g. LDAP, SMB and MSNT. In other words, Squid can co-exist with your Windows servers.

Squid has flexible configuration options. You can deny access to sites like Hotmail from all users and you have full control over the filetypes users are allowed to download.

In addition to denying access to certain websites, you can also grant access to a list of selected work related websites to a group of your users, based on their needs, or rather what the management wants them to spend their time productively on.