0

In one company I have two user groups. One group is allowed to go to website (example facebook.com) and another is not. Can I do something with Windows Server 2008 R2 DNS server to achieve this?

In the network, there are two DNS servers. DNS server in Server 2008 R2 and in MikroTik device. Mikrotik device used for public purpose.

2
  • doing it in dns is not the way to do it. You are better off using a proper firewall with internal VLANs
    – Mike
    Sep 25, 2014 at 11:20
  • Can I acieve it with Windwos Firewall? I have 2 VLANS. One for company and one for public use. Problem is that I have to split company workers who can and who can not access osme web
    – gedO
    Sep 25, 2014 at 11:27

2 Answers 2

1

Restricting access to certain websites is better done by forcing the use of a HTTP proxy server and using different white/black-list for the different user groups.

Among other things that allows you to display a proper error message explaining that access is blocked, rather than a generic network error.

1
  • I don't have resources for proxy, now I think about host fiel deployment using AD
    – gedO
    Sep 25, 2014 at 12:26
0

If you want a bullet proof solution, DNS blocking is not the way to go (as stated by the others).

If a pure DNS based solution is still what you are looking for, take a look at the DNS RPZ specification. Unfortunately, AFAIK it is not supported with Microsoft servers.

3
  • Can I block access to website via HOST file?
    – gedO
    Sep 25, 2014 at 12:10
  • You could, but you would have to to that on each and every client machine and prevent them from editing it afterwards. And they would still be able to use a proxy to perform DNS resolution and circumvent that.
    – NaeiKinDus
    Sep 25, 2014 at 12:18
  • I can deploy that file using GPO
    – gedO
    Sep 25, 2014 at 12:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .