We currently have a SonicWall firewall, which does a pretty good job a blocking Social networking websites like Facebook and Bebo. The problem we are having is that sometimes we need to temporarily disable our firewall blocklist so we can update our company's page on Facebook for example. Whenever we do this, have see an avalanche of users logging on to their Facebook pages during work time. So what we need a way to block access while the firewall is down.

For the sake of argument, we have two groups of users - "management" and "standard users". "standard users" would have no access to Facebook, but "management" users would have access. Perhaps something like a host file redirect for non-management users. This could probably be enforced via group policy that would call a bat file to copy down the host file, depending if the user was management or not. I'm keen to hear any suggestions for what the best practice would be for this in a Windows/AD environment.

Yes, I know what we're doing here is trying to solve a HR problem using IT. But this is the way management wants it and we have a lot of semi-autonomous branch offices that we don't have a lot of day to day contact with, so an automated way of enforcing this would be the most preferable method.

  • 4
    So everyone knows when you've brought the firewall down and goes to check facebook? How do they know when that happens? – Josh May 6 '10 at 12:07
  • 5
    If your firewall's blocklist is either "all users" or "nothing at all" then the most obvious solution is a firewall with url filtering that was actually designed after the year 2000. – Rob Moir May 6 '10 at 12:13
  • 2
    I'm curious about the flood to facebook too. Are your users just hitting refresh on Facebook all the time to test it? You must work in an unusual place that has a Facebook page but doesn't allow users to see Facebook! – Bart Silverstrim May 6 '10 at 12:59
  • Word gets around the offices fast. Once one person finds out there is access, everybody knows. – SuperFurryToad May 6 '10 at 13:16
  • 2
    @Tom Urinating is vital and involuntary (after a certain threshold of Aquafina). FaceBook is neither. Everyone and anyone can be tempted with wasting time when they should be working so just hiring people that won't look at $socialNetwork isn't a real possibility. A technical block is necessary in most instances. In fact... why am I on ServerFault when I should be writing a build script? FAIL – Wesley May 7 '10 at 18:50

Buy a 3G USB dongle thing - put it in a safe, give it to a user when they need to update the blocked content, take it from them when they're done.

Ghetto yes, but simple.


So your company maintains a current Facebook page, yet prevents your users from accessing it? Bizarre. If your AUP discourages access to non-work (although "non-work" is debatable considering you have a FB page) sites during outage periods you could just collect the traffic logs. Provide management the list of users violating the AUP during the outages. A brief, personal, talk from HR/Management goes a long way.

Maintaining a host file for lots of users is painful. If you provide DNS for your clients you can easily blackhole anything you want. Proxies would still be an issue but I'm assuming your AUP would already address the use of them.

  • Not so bizarre. A company FB page is a totally different animal from a personal FaceBook page. Thus is the landscape of the twisty world of social networking. – Wesley May 7 '10 at 18:49
  • 1
    @Wesley Ah, thanks for that, did not know... I do not maintain a company FB page. I would have expected a company to want its employees to be fans/friends/whatever of the company page. Guess I still don't quite get Facebook. – jscott May 7 '10 at 19:16
  • A company FB page is for promoting a product/service and maintaining a good corporate image. A personal FB page is for telling people that you're thinking about marshmallow peeps and living vicariously through your sleazier friends. =) Same thing with company twitter accounts. – Wesley May 7 '10 at 20:00

Sounds like a terrible jury rig. Firewalls are designed to block certain machines, and let certain others through. Just give your managers static IPs, and allow access from those IPs, and your problem is solved. Sonicwall has a CFS exclusion list for this exact purpose.

Of course, your managers are probably also going to use Facebook, once they have free access, but that's life. You'd be better off allowing everyone and monitoring their usage. If it gets to be a problem, fire them. Blocking policies aren't much of a solution, and they tend to make people bitter.


I'm addressing this question solely on a technical level.

Perhaps you should considering building a device specific for this purpose instead of using the SonicWall feature.

Default policy of drop is generally recommended for traffic going outgoing. At the very least, 80, 443, 8080, and 8443. Then require a proxy to access the Internet.

I'd recommend SQUID and SquidGuard, which can filter access to Web sites. Configure it to require authentication, which can even be integrated with AD. A privileged group would be able to bypass the filtering. For reporting, something like MySar or SARG works.

The solution can be simple and quick or more involved depending on your requirements but this technology will solve all the problems.


My recommendation would be to look into a centralized content control system that can block access based on user\group.


Also, how is it that your users can still access the internet when the firewall is down? Doesn't the firewall provide NAT for your internal ip addresses? Is the firewall not "in line" with the router?

My topology looks like this:

Internal Network--->Firewall--->Router--->Internet

So if my firewall is down, the internet is not accessible.

  • 3
    It sounds, to me, like they shut off just the site-filtering blocklist feature to enable the Chosen Ones to access Facebook. – jscott May 6 '10 at 12:27
  • Gotcha, I should have read the question more carefully. – joeqwerty May 6 '10 at 12:45
  • We have a similar setup...we have an 8e6 web filter that monitors users attached to a Cisco firewall. It's kind of like an adjunct, so if the filter goes down, there's no indication except that users have access to ads, Google without SafeSearch on auto-settings, etc. It's not an in-line filter so much as a cisco-sends-traffic-there-for-processing-then-gets-replies-back thing. – Bart Silverstrim May 6 '10 at 12:58

In the end we used a GPO to push out a hosts file that blocked Facebook, Bebo, Myspace etc and also prevented users from modifying the hosts file.


Along the lines of @Chopper3's answer, I would suggest providing an alternate means of accessing the Internet for users that you don't want to filter.

If an aircard isn't how you want to do it, perhaps you could have a special network port that is connected tot he Internet before the firewall. This way, the authorized Facebook updaters could bring their laptops over to this port in the rare occasions that they need to update Facebook for work purposes.

Perhaps setting up a password-protected proxy that bypasses the firewall would also work. This way, the authorized Facebook updaters would not have to move from their desks; they could just alter their proxy settings.

You could even have IT enable/disable these options as needed, so even the authorized Facebook users would be unable to use it without intervention from IT.


I don't currently have access to a SonicWall, but my recollection is that you could setup users in the blocking scheme and when they got the 'this page blocked by SonicWall' you could give them an option to enter a username and password to access the page. So you give authorized FB updaters an account that allows them to access FB, and if you want to, you can enable/disable the account when the page needs to be updated.


I worked at a private school and we solved this issue for free by using OpenDNS.com. Go to the website and sign-up for an account. You'll need to specific the source network or IPs and then configure your firewall to user OpenDNS's DNS servers. From the admin interface you can block specific types of traffic like Internet proxies and specific websites like facebook.

We created a firewall rule for internal network that we allowed to these sites to user our ISP DNS servers.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.