Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I manage a network of about 60 windows computers. There is a ton of wasted time during the day because of facebook access. I want to limit employee access to to < 30 mins per day.

I know how to block it completely using our firewall. I probably could write a proxy that all access goes through and I measure the time, but is there any easy way to limit access to facebook for my whole company to 30 mins per day?

I understand measuring 30 minutes on a stateless protocol is hard, but I'm really just asking if there is a tool that I can use that accomplished my goal of limiting access to facebook to a reassonable amount of time.

Note: I have a cisco ASA firewall

share|improve this question

migrated from May 16 '12 at 7:15

This question came from our site for computer enthusiasts and power users.

I'd suggest you re-think this policy. The staff that don't abuse the privilege of unrestricted internet access will resent those who ruined it, and the staff who did abuse it will resent you for removing that privilege. It's a recipe for some rough office politics. I would suggest, rather, that you penalise the offending staff members. – Polynomial May 15 '12 at 19:59
It only penalizes the people who use if for longer than 30 mins which happen to be the offenders – justausr May 15 '12 at 20:00
What kind of router do you have? – wizlog May 15 '12 at 20:00
However, if you do feel that everyone is taking liberties, just block Facebook during work hours (excluding lunchtime!) – Polynomial May 15 '12 at 20:02
You are trying to solve a people problem through technical means. That is not a good sign. If you are in a position within the company where you feel you can dictate what the workers can and can not do during work, simply stating this clearly should work. If it doesn't, blocking access like this will be seen as agitating, and I very much doubt you'll see any efficiency increase. It is the opposite of trust to enforce a policy like this. Even worse is some pseudo-policy of "only 30 minutes per day", where measuring "minutes" is difficult to impossible to do fairly. – Daniel Andersson May 16 '12 at 5:47

You could do this with a proxy server (squid for example can set up time ranges on ACLs), but that's potentially a big change if you're not currently using one and don't want to set one up for just that purpose.

Me personally I'd base this stuff on performance. If someone is perceived to be wasting time on FB, make it a performance issue. Technical solutions are a way for HR to avoid the unpleasantness of actually talking to the person so they understand that they can't keep doing this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.