Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is the question I have that hopefully is not too general of a question.

I have a network with approximately 25 PC's, 3 servers and 25 IP cameras. I have a firewall already on the network and it works fine for what I need, but my client is asking me if there is a way to put a Proxy server on the network to monitor where his employees are going when they surf the Internet. He is not wanting to block them (at least not thru the Proxy server), but he wants to make sure that they arent going to sites that would compromise the networked PCs. I have looked at TMG and it is a little more than what I want. I hesitate adding another firewall to the system because of the security cameras that are presently on the network (IP Cameras). I just want to put a policy in AD that would make certain Users (or Computers) use a Proxy server.
Any suggestions on a good proxy server are welcome.

Thank you

I like the option of using either the firewalls subscription or the service provider. They are in a Domain environment and presently use the server's IP as their DNS provider... but if the Proxy server outside their environment can be used that would be great. I like to use OPENDns for some of my clients and they offer some good filtering.

I am just trying to keep it as simple as possible.

I did read that using a single NIC install of TMG would disable the firewall portion of the TMG Server. That still might be an option.

Thanks guys!!

share|improve this question
can you expand on why TMG is more than what you want? most proxies are similar in functionality. – Jim B Jun 16 '12 at 16:21
You want to run it on the windows machine? Take Linux (squid+squidanalyzer) – GioMac Jun 16 '12 at 19:01

Almost any site can be flipped and be converted to a threat that may compromise a visitor. Ad sites are particularly appealing targets, and any site hosting an embedded infected ad would be a threat. It's unlikely that someone can casually review a list of sites and make an accurate determination if they are threats or truly safe. They may be able to spot some threats, but there is more to it than that.

Content filtering is one of those areas that requires in-depth knowledge, expertise, and frequent attention and administrative effort to do properly.

Many firewalls have an integrated content-filtering subscription. You may want to check if that is an option for your firewall appliance that you can leverage. If not, it may be more practical to switch to a firewall that has this capability.

If the firewall subscription is not an option, you may want to utilize a service provider. You can specify a group policy for the proxy server used by a web browser, which is actually hosted externally, and they can perform this for you. Symantec and Websense are a couple of content filtering providers that come to mind, but there are plenty of others.

share|improve this answer

I think you will find that deciding what's malicious will take more time that you can imagine. It'll become unworkable unless there is something to classify it all.

Maybe the easiest approach is to use something like OpenDNS.

Depending on where you are, it may be sufficiently fast. I've even used it from NZ but it was a little bit slower than my local ISP. If you're in USA I would think it's pretty quick.

The way this works is you replace your ISP's DNS servers with the OpenDNS ones. You set up an opendns account and decide what you want your employees to be able to browse. The DNS server from opendns will decide whether or not to give out the correct IP for the site, or a page that tells them they can't view that material because it doesn't meet the company policy.

On it's own it doesn't prevent people from browsing my ip address or overriding the dns servers with their own locally. However, you can put firewall rules in place to ensure that only the opendns servers will be used for DNS and block everything else.

It's a nice solution in that it requires no hardware for you to configure. You set the policy and that's it. I'm sure there are some holes in it and it may not block everything you don't want but it's likely to get most. I think you should be able to get a free trial going which requires very little setup and no capital outlay.

share|improve this answer
That was an excellent solution. I will do just that. Thanks Matt!!! – Jon M Menefee Jun 18 '12 at 19:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.