Controlling Internet Access

[user127]

Hi All,

Does anyone know a low-cost solution for restricting internet access on a LAN with an ADSL internet gateway? I've put screensaver passwords on the machines and sometimes lock the mice in a cupboard if other departments are known to be working at the weekend, but would rather have password protection for accessing the internet gateway.

The hosts on the LAN are mainly Macs, with a few PCs and Unix machines.

Is there any standard practice for going about this?

Thanks for your help, you'll have to excuse me for being a bit of a novice in this area!

PixelSmith

 

[iownroot]

Depends on what you mean by low cost. If you mean $1000 or less, you have several vendors. For smaller shops I favor Sonicwall. For bigger installations I stick with Cisco Pix series mixed with some open source stuff. I know with the Sonicwall, there's a default option that forces any user going out past the lan to enter a password, this can be set to only be active at certain times also. Keep in mind there are several models of Sonicwalls, so read up on the specs and you should be able to find exactly what you need.

CISSP, MCT, MCSE2K/2K3, MCSA, CEH, Security+, Network+, CTT+, A+

 

[kaht]

You could just unplug the router.

(that's a joke)

-kaht

How much you wanna make a bet I can throw a football over them mountains?

 

[user127]

Thanks guys - I'll check out the products you mentioned. I thought there must certainly be software options available for this purpose but I'm no too familiar with this side of things.

Like the joke Kaht, it kind of tickled me in conjunction with that lamb picture you've got - probably the sort of day I've had making my brain go soft.

Thanks for ther help!

PixelSmith

 

[Stevehewitt]

Depends on your size and budget. Personally I'm a huge fan of ISA Server and even better ISA with SurfControl.
If your just after a basic yes/no to users accessing the internet then just ISA server would work fine.

Or, to do it on the cheap then you could even go as far as putting non-allowed internet users in a seperate OU in AD and set a GPO with a duff proxy IP.
(Cheap and nasty - but it would work)

Of course I have no idea how / if this would work on non-Windows PC.
(In theory, could you not change DHCP on some PC's to change their gateway to 127.0.0.1?! )

Ta,



Steve.

"They have the internet on computers now!" - Homer Simpson