Restrict Internet Access, But Allow Intranet Access

[JEngles]

I need to setup a computer to only allow local network access.

I was wondering if Petri's way is the best -->

http://www.petri.co.il/block_internet_but_allow_intranet_with_ipsec.htm

or perhaps is it better to block it at the firewall?

 

[vacunita]

If its a single computer I would say just set the IP configuration manually, and change the default gateway parameter to something non existent.

That's all it would take to disable internet access, however the local network would still be available, and assuming the dns's are pointing to the correct server it should access it with no problems.



----------------------------------
Phil AKA Vacunita
----------------------------------
Ignorance is not necessarily Bliss, case in point:
Unknown has caused an Unknown Error on Unknown and must be shutdown to prevent damage to Unknown.

Behind the Web, Tips and Tricks for Web Development.

http://behindtheweb.blogspot.com/

 

[BadBigBen]

I would depend on how the network is set up...

if there is a Proxy server between the PC's and the Internet, then block it at the Proxy server...

if there is just a router, then block it at the router...

reason why you should not block at the user's PC, is simple, in that a user could circumvent the blocking, e.g. using a Linux Live CD or changing the gateway etc...

just some thoughts...


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[DrB0b]

Using BBB's idea is the best if possible in your scenario although you could do as vacunita said and do a gpedit to disable changing the IP configuration locally or server side if running through a domain. Still vulnerable to a Live CD tho if you think your staff is smart enough to do so.

"Silence is golden, duct tape is silver...

 

[JEngles]

Thanks fellow IT'ers. I agree with what your saying that router would be the best way. Couple this with USB\CD\Floppy access is restricted, should do it.