up vote 0 down vote favorite
share [g+] share [fb]

How can I deny a specific group of my VPN users the access to a specific domain like *.facebook.com?

I have created a new AD group and added a test user into this (only this) group. I have duplicated previous NPS Network Policies and reconfigured them for this new group.
I used the properties window of each of those new network policies to restrict Day/Time they can dial-in to my RRAS server (using Constraints tab) and this setup works fine. Meaning my clients can dial into the RRAS and they can access the internet on my RRAS server; but:
I have created an IP Filter template denying both inbound and outbound access to 4 IP addresses I could gather for facebook.com and www.facebook.com and even I added the same IP Filter rules for 4.2.2.4 in and outbound!
But this IP Filter thing doesn't seem to be working...
My clients can ping 4.2.2.4 and they have access to facebook.co nad www.facebook.com...

Is there something I'm missing? Any help is highly appreciated...

PS: I've read somewhere on SF that Logging is another option and I can log the addresses they've browse; but I have no clue on how is it possible to this using RRAS+NPS...

link|improve this question
Well, NPS can NOT do such a filtering. IP filtering is what you may get at most; and it won't always work! My workaround was to move the whole bundle into a fresh VM and setup a DNS server there and set it as the first DNS on LAN card and setup a fake DNS record for facebook.com! – Achilles Jan 21 at 11:25
feedback

Know someone who can answer? Share a link to this question via email, Google+, Twitter, or Facebook.

Your Answer

 
or
required, but never shown
discard

Browse other questions tagged or ask your own question.