Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My current Windows Workplace Network need some users to have restricted access to the internet and some users to have full access to the internet.

So I used a OPENDNS as it turned out to be the most simple and yet cost effective option (as in free!) So I granted those users limited accounts and restricted groups of sites like file and video sharing, social networking, adult sites, etc in the OPENDNS control panel and point those users DNS setting to the OPENDNS.

Now I have decided to upgrade this network to Windows Server 2008 R2 environment, obviously for better management and to make use of centrallized file storage and access restrictions on the file server and I'm stuck again because I want to have some computers use the OPENDNS servers to continue the restrictions as that seems to be the easiest way to do so. But adding all computers on the network to the domain would also mean that these user would have to use the server's DNS which inturn would give them full access to the internet. Also in this latest environment some users have not to be given internet access at all (at least for the time being). Can someone help me here!

share|improve this question
up vote 1 down vote accepted

DNS really is not going to work for access control. As soon as a user finds out that it's possible to access sites (including proxy sites) by IP address, it's all over.

If you are looking for a free community web filtering platform, you might consider Untangle.

share|improve this answer
can untangle filter web traffic based on users or user groups or computers, I mean specific policies – Reuben Aug 13 '10 at 0:00
Yes. They have a free web filtering module and a paid one; the free version will let you exempt groups of IPs from web filtering (so you basically get two tiers of users, filtered and unfiltered). The paid version allows more granular control. – Skyhawk Aug 13 '10 at 0:05
How many computers are there in your environment? The free version of Untangle does include routing and QoS, so you may not need a dedicated router if money is tight. – Skyhawk Aug 13 '10 at 1:45
OK, then you heard it from me: if you set up Untangle properly on a computer with at least two NICs, one connected to your LAN and one connected to your ISP, you don't need a separate router. If you're going to use the free version, you will want to give each workstations a static IP address in your private range so that you can configure specific PCs to be exempt from web filtering. – Skyhawk Aug 13 '10 at 18:34
You're welcome! – Skyhawk Aug 15 '10 at 4:49

Yeah sure, for simple internet access control DNS can be used in a very primitive form, for people who don't know how DNS works and don't know how to get around your configuration... but for comprehensive control you need a comprehensive solution. DNS wasn't meant for the use you intend it for, and as such isn't a very robust, scalable, reliable, fool-proof solution for your needs.

My suggestion would be to look at a solution from Microsoft, or any one of the blue zillion vendors who have products that do what you need.

share|improve this answer
so what would you call these solutions? and how do i set it up? – Reuben Aug 12 '10 at 22:12

DNS isn't meant for Internet access control, you should use a firewall or a proxy server for that.

If you're going to set up a domain environment, there is a very definite need for all domain computer to use the domain DNS server(s) (usually being the domain controller(s)); "very definite need" meaning "do this, or everything will start behaving strangely and/or not working at all".

You could have your domain DNS server(s) use OpenDNS as a forwarder, instead of using your ISP's ones or looking up external names themselves; but this way, all DNS queries would come to OpenDNS from the DC(s), and it wouldn't be able to filter anything. The reverse also wouldn't work: you could have your users use OpenDNS and then have it forward queries for your internal AD domain to your domain controller(s) and resolve Internet queries itself... but Windows clients need to talk directly to domain DNS server(s), not only for name resolution, but also to register themselves in your internal DNS zone.

You should definitely look into a proxy or firewall solution; DNS just wasn't created for this.

share|improve this answer
could you suggest a few (ideally free! but yes paid solutions are okay too) and how can I allow, restrict and deny access to specific user groups that I have created in AD – Reuben Aug 12 '10 at 22:27
Microsoft's solution is ISA Server (now called Forefront Threat Management Gateway); it's a comprehensife firewall/proxy solution, and yes, it can filter access based on domain user accounts and/or group memberships. There are, of course, plenty of other proxy softwares around; if you have some Linux knowledge, you should look into Squid. – Massimo Aug 12 '10 at 22:29
do you mean something like this? – Reuben Aug 12 '10 at 22:31
I do have some linux knowledge but I would also want to go with a solution that is easy to use. – Reuben Aug 12 '10 at 22:33
Smoothwall is a very nice firewall, powerful and easy to configure, but I don't know if it can authenticate users... firewalls usually filter based on client IP address, not user accounts; Squid is a proxy, so it can authenticate users and filter access using this information, although it can be quite tricky to get it to integrate with a Windows domain. On a Windows environment, I'd recommend going with ISA/TMG. – Massimo Aug 13 '10 at 6:03

Domain machines will only use your domain's DNS servers if you haven't configured them otherwise with group policy. Group the computers in various OU's according to whatever policy you have. Then create group policy objects for each OU that explicitly sets the DNS settings. You can find them here:

Administrative Templates\Network\DNS Client

But like joeqwerty mentioned, this is not going to stop technically savvy people from getting where they need to go.

share|improve this answer
Sorry, but -1 here; using the wrong DNS server is going to make domain-joined computers work bad and/or not work at all. In the best case, they'd continuously resort to NetBIOS in order to find DCs and other computers... and in the worst case, Pain and Suffering would ensue. They need to use domain DNS server(s), and not anything else. – Massimo Aug 12 '10 at 22:21
well I did test this out on one computer which had joined the network and it did work out for it, though as you said I guess it was using NETBIOS in order to find the DC and I felt that it was not the solution to the problem in the first place – Reuben Aug 12 '10 at 22:29
@Massimo You're right that having domain machines point to a default setup of OpenDNS will cause problems with domain functionality. But running domain machines against a 3rd party DNS server is completely supported and works just fine as long as it contains the proper SRV/etc records for the domain. I'm not familiar with OpenDNS at all, but if it's possible to add your domain specific records to it, it would work just fine. – Ryan Bolger Aug 12 '10 at 23:01
In addition, this is how we run all of the AD domains in the university environment I work for. IT services runs a unix based instance of BIND for the campus that doesn't even support dynamic updates. Deparments installing AD skip the DNS services setup and just point to the campus DNS servers after sending their netlogon.dns files to the IT services for inclusion in BIND. – Ryan Bolger Aug 12 '10 at 23:06
this can definitely be done (although it can be quite tricky)... "domain DNS servers" doesn't necessarily mean "Windows domain controllers", of course. But based on the original post, I don't think the author was going to do this when he thought of using OpenDNS for its network... – Massimo Aug 13 '10 at 6:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.