Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a problem about prevent user to access internet (like watching on local LAN

Currently I have a Windows Server 2008 R2 installed, and I already make a change to not allow user access to internet via the default gateway on router, however, I want to setting up the DNS server to redirect all requests to a single IP in my Local LAN, for example: if user try NS lookup that DNS server for "" or "", it will return the IP

How can I set up a Windows DNS to point ALL requests to itself?

share|improve this question
The problem I want to show a custom web page to indicated user is not allow to access internet, so I am thinking to create a local IIS website on windows server 2008 R2, then redirect all the request to this IIS... so that's why I consider to see if I can make something on the windows DNS to response for all the domain name request... – ek1 Nov 2 '11 at 16:47

Open the DNS managment. Set up a new Forward Lookup Zone for and set a Host A record to Also ensure all clients use the server as the DNS.

share|improve this answer
Create an IIS instance. Set DNS to resolve banned sites to the instance IP ( in your example). Then set a group policy that 1- sets the DNS to your server, and 2- prevents them from changing the DNS. This will ensure your clients hit the IIS site, where you put up a page saying tut tut, that site is banned. – Naozumi Nov 3 '11 at 13:26

You can create a root zone (.) on the server which will effectively disable all DNS resolution for external names. Note that this will disable ALL DNS resolution for ALL external names.

share|improve this answer

I don't know that you can. As far as I know I do not believe you can create a . type record in Windows DNS to have it redirect all requests to one IP address. If you're confident that you'll NEVER need internet access on that network section, you can delete the Root Hints from DNS, which will cause all requests to DNS that are not internal to fail, but I'm not sure you can, in Windows DNS, cause all DNS requests to resolve to one IP address.

If you're trying to restrict web access from users, there are other ways. I would suggest setting a group policy proxying all web traffic not to an approved whitelist to, which will just blackhole all that traffic. I've done it before for clients - it's not that difficult, especially if the whitelist is small (i.e. one SharePoint server).

share|improve this answer

You can do it by removing all root hints in destination dns server and create your own root zone with fqdn "." (dot). This will cause resolution query to stop at the first step.


Anything you do in the DNS is bypassable though...

When user changes primary dns server in tcp/ip configuration, your dns server will not be in effect. When user tries to connect by ip address, your dns server will not be in effect again. For example create a primary zone for in your dns server and add an A record whichever ip you want. Clear dns client caches. And try to browse for and see your dns server will be hit and resolves your configured ip address, and then try to browse ""

I would prefer configuring a firewall. ISA or TMG maybe.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.