Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I keep seeing references to something called Squid, but I take it that's only for Linux. Rather than needlessly pay $1,000+ bucks for a content filtering subscription on our firewall, I'm seeking an alternate method (and if it's free, all the better!). Any ideas?

share|improve this question
What stops you from using the (free) Squid on a (free) virtual machine with a (free) Linux? – mailq Aug 11 '11 at 22:17
What stops you from using the (free) Squid on Windows? – Evan Anderson Aug 11 '11 at 22:45
up vote 2 down vote accepted

I'm a little embarrassed to admit that I've done this before, but the "cheapest" way I've found to do this (assuming the user can't install or otherwise use third-party web browser software) is to use Group Policy to configure Internet Explorer to use a bogus HTTP / HTTPS proxy server (i.e. an IP / port that doesn't answer-- preferably one that actually rejects the TCP connection attempt). I put "permitted" web sites into the proxy bypass list.

It's a very "cheap" way to do what you're looking for and utterly easy to bypass if the user can install or use third-party browser software.

One "righter" way to do this would be to force outbound HTTP / HTTPS through a proxy server that allows for per-user ACLs. Squid with NTLM authentication can do this with no software licensing cost and can provide a fairly nice transparent authentication experience for domain-joined Windows machines accessing web sites through it. You can run Squid on Windows if you're adverse to running it on Linux. Squid on Windows with Active Directory-based authentication is fairly easy to setup.

share|improve this answer

OpenDNS Enterprise is one solution you might consider.

share|improve this answer

How many computers? If a small number, use Windows DHCP Server to reserve their IPs from a range that has firewall rules allowing port 80/443 access only to the whitelist.

share|improve this answer
How would I configure this whitelist? That's what I'm trying to figure out. – Bigbio2002 Aug 11 '11 at 22:43
what firewall/version? – Paul Aug 11 '11 at 22:45
The built-in Windows firewall. We also have a Sonicwall device we could configure. – Bigbio2002 Aug 12 '11 at 15:44

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.