restrict internet access to certain sites

Ish · 25 Oct 2009 at 01:23

Hi

We need to restrict internet access for certain users to websites that we specify only regardless of which pc they log on to.

We are using SBS 2003.

How can we do this for a sensible cost? We have about 12 pc's in total.

Thanks

Sone · 25 Oct 2009 at 06:26

SBS 2003 contains ISA? (is it 2000 or 2004?)

iaind · 25 Oct 2009 at 08:21

Premium has ISA, standard doesnt.

If not, OpenDNS - free

dave-lew99 · 25 Oct 2009 at 11:03

iaind said:
If not, OpenDNS - free

Just make sure you configure your firewall to only allow DNS connections to go to OpenDNS or your users will just reconfigure the DNS servers.

iaind · 25 Oct 2009 at 12:33

Not if your PCs are configured even close to properly - they should be using the SBS server for DNS in order to function properly and even log on. Normal user accounts wont have access to change IP settings anyway

dave-lew99 · 25 Oct 2009 at 14:40

True enough, but i've seen more than one place where people just did what they wanted and there wasn't anything in there which really stopped them - like manully turning off the proxy setup (or just using firefox).

iaind · 25 Oct 2009 at 18:10

Well if they change the DNS settings they wont be able to log into the domain, so it wouldnt last long

Ish · 25 Oct 2009 at 21:48

If using openDNS how will it allow user 1 to access a certain list of sites, user 2 another list, user 3 any site etc?

DustyMiller · 26 Oct 2009 at 12:48

it cant - simple.

You need a proper proxy server to do granular access like you need.

You could always try Squid for Windows:

http://squid.acmeconsulting.it/

J.B · 26 Oct 2009 at 12:56

What firewall solution do you use? Ours deals with our content management as well.

Street · 26 Oct 2009 at 13:06

You can block websites using group policy.. Might be the easiest and cheapest way, although probably not the best!

#Chri5# · 26 Oct 2009 at 13:10

Certainly worth considering doing it at gateway level on a firewall/UTM appliance. SonicWall's Content Filter with the SSO (Single Sign On) Agent lets you have filtering based on username.

The new version of GFI Webmonitor no longer needs MS ISA (operates as a proxy server) : http://www.gfi.com/webmon