Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So this may be impossible but I've been asked to try and find something about it. So far nothing I have found is possible.

I need to restrict specific machines or user accounts from regular Internet access but let them have access to the intranet portion of our network. I do not have Active Directory control, nor does anyone at my local workplace (corporate control in a different state). I have tried going through IPsec and doing this per local machine, but that system seems to have been removed from the images that are installed on these machines so that is out.

So far the only other option I can think of is assigning the machines a specific ip address and removing their gateway access. This would probably work but the machines need to be able to receive updates that are being pushed to them through ePO and LanDesk.

I would really like to do this on the user level because then if I need to do tech work to the machine and need internet access I can get to it but a "special" user could login and not be able to get into anything.

share|improve this question

migrated from Feb 17 '10 at 17:06

This question came from our site for computer enthusiasts and power users.

This is more like a Server Fault question. – ChrisF Feb 17 '10 at 15:50
Well I would agree but they seem more interested in doing something on the local machine as opposed to on the servers that we don't have access to. – MoSiAc Feb 17 '10 at 16:46
up vote 3 down vote accepted

I found out how I'm going to do it. Created a special noaccess.rat file for content advisor for internet explorer. Added the addresses that they need access to and nothing else. Problem solved.

share|improve this answer
Curses.. I was trying to type that before you answered. You could also look at rules on the external router/firewall. – Skaughty Feb 17 '10 at 16:06
Well we're thinking that would be the most secure but everything here is outsourced so we would have to call the guys to come set that up. We are looking into that though. Kinda wondering if content advisor allows wildcards. We've also tried setting PROXY to NO in internet explorer, which usually keeps users out for about a day. – MoSiAc Feb 17 '10 at 16:45

External firewall / router is probably the most secure. You could set up a walled garden / captive portal (much like the ones that you get when you log into a wifi hotspot) which permits access to your update services but nothing else unless a superuser password is entered.

share|improve this answer
This would be the way we would like to go, but again we don't have that kind of control here sadly. Just asked to complete a task local machine side. – MoSiAc Feb 17 '10 at 18:15

This is definitely something that is better done on the network.

You could use a cheap router hacked to use something like

You could connect this between your company network and the computers you want to isolate.

You should be able to use the router's admin page to allow access to your LAN and certain whitelisted networks (for your updates) but restrict all others.

The benefit of doing it at network level is you block the entire networks, not just DNS or port 80 / 443 (web/ssl) as some solutions to this problem do. Both can be easily circumvented by knowledgable users, but it is much harder for users to bypass a captive portal. Not impossible, but then nothing is!

The DD-WRT forums should be able to help you do this.

There may be commercial solutions that achieve the same. Any Layer 7 style firewall technically has the ability to be able to do this - as they can inspect tcp/ip packets and modify / block them in real time according to specified rules. Whether this is functionality is exposed at user level in a particular product is something to discuss with the manufacturer.

However if you are not allowed to do this to your network due to company policy then you could:

(i) look into software designed to prevent children from accessing the internet without patent supervision; or

(ii) look at whether a software firewall would enable to you whitelist / blacklist certain networks. You could whitelist your internal network and specific networks you wish to connect to, and blacklist everything else.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.