Networks

Ask something
Discussion Locked

block surfing

0 helpful
11 replies

by prabal

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I have an already designed network with NT 4.0 server, ethernet LAN, win2000, win98. Some PCs have static ips and some have DHCP enabled. I want to block the users from using the internet in all the pcs. Any suggestions? Thanks in advance.

11 replies

by curlergirl

What are you using for Internet access and firewall - router or proxy server? Broadband or dialup? No one can answer your question without knowing how you are accessing the Internet and what, if any, possible means of control you have (i.e., firewall, router, or other type of software).

by mshavrov

There are several ways how to do that.

1. Physical design:
Have 2 separate networks (hubs/switches) - one, who should have access to Internet (for example, mail server, web server, CIO :-)). Another switch - users, who don't have to have access to Internet. But in this scenario you should have 2 NIC cards on servers, which have to be in both groups. Only thing you should do on these servers - disable "IP Forwarding" in TCP/IP settings. Make separate network addresses scheme and your users will never go to Internet. If you will decide later, that you need to give some users "controlled" access to Internet, you may install Proxy server (any kind), which will be your gateway between "Internet" and "no-Internet" networks.

2. Addresses Filtering:
If you have flat network, you may do following: filter IP addresses on your Internet router to allow/disallow certain IP addresses to go to Internet. If you want to allow only servers to go to Internet, it's pretty easy, since they have static IP addresses. You may just create "deny all" and "permit specific" rules (as it was mentioned in Answer #1, it depends on your hardware).

3. Create different IP addresses ranges in your network. It will be "similar" to solution #1 - for example, you have static IP addresses 17.16.0.0 for your servers and for your Internet Router, and you have 10.0.0.0 network for your users. Sure, you should configure 2 IP addresses on your servers to make them working in both networks. But this solutionwill not protect you from users who will change IP address manually to 172.16.0.0 network to get access to Internet.

So, good luck.

by papa io

You can also configure a proxyserver. For example Microsoft ISA, Webmarshal or Surfcontrol.
This way you can block or allow any site you like.

by cdurfee

In the internet options under Lan Settings, check use a Proxy server and create a generic IP address, then hide the IE Icons.

This discussion is closed to new replies.