Restricting HTTP access

[danno74]

We have a client who has a 56k relay line to access billing software we license out to them. We are having problem with their network because some people over there are using the Internet. We want to restrict access to this since they do not have licenses for this, and had heard from our ISP rep that we could do something at the command prompt to shut off http access - is this possible?

 

[gbiello]

I'm not sure I understand the scenario entirely. My interpretation is that your client has a dedicated frame-line to your company, and they get out to the Internet by going via your company and you want to restrict that.

I don't know how licenses comes into play, as you don't need licenses to surf the web. Is it you want them to use the frame line to you for the application only? If, however, I described the situation correctly, the place to block their access is with an access-list on one of your routers. Can you do this? What type of routers do you have?

With Win2K, you can deny traffic on certain ports, but that would be on their computers, and I don't think they'd be to happy with you if you did that.

-gbiello

 

[danno74]

Our clients access billing software we license out to them, and with that they also have the option of accessing the internet through our network. The client that is the main subject of this has 4 licenses, and we believe that more than 4 people are accessing the Internet - they are calling and complaining about lag when it's their users that aren't supposed to be online that are eating the bandwidth. We want to limit the http access to only the 4 workstations that have licenses.

Could you tell me how to deny traffic to that port? They all have w2k over there, so that would be great. Thanks!

 

[gbiello]

Open up the NIC's Properties sheet. Double-click "Internet Protocol (TCP/IP)". Click "Advanced". Click the "Options" tab. Double-click "TCP/IP filtering". Click "Permit Only" in the TCP column. Enter the ports you wish to allow. There will be many, and you will need to find a website that has a port-listing like

http://www.good-stuff.co.uk/useful/portfull.html.

As a much more sensible alternative, I think the filtering should be done at the router. I would need to know the network layout to help, and you would have to program access-lists. If it is a Cisco, there are many helpfull posts in the PIX and Cisco routers forums at this website.

-gbiello

 

[StarTAC]

i agree, make your restrictions at the router level.. as users can get intelligent and finger your OS-level settings...

u can use extended IP access lists on a cisco router to deny traffic destined to/for a specific application type.. for instance, if any outgoing traffic matches HTTP, SMTP or Telnet, deny or accept... it's that flexible..

good luck..