Restricting user internet access by domain?

[drichter12]

Hello,

I am fairly new to Cisco and wanted to know if there is a way to restrict a specific internal user from accessing everything on the internet but a handful of specific domains. My goal is basically parental control of my son's new iTouch (iPod) with WiFi. I want to be able to restrict him to just his yahoo email and a few other sites (nick.com etc.) from it. My router info is as follows...

Cisco IOS Software, C2600 Software (C2600-ADVIPSERVICESK9-M), Version 12.4(16), RELEASE SOFTWARE (fc1)
Technical Support:

http://www.cisco.com/techsupport

Copyright (c) 1986-2007 by Cisco Systems, Inc.
Compiled Wed 20-Jun-07 05:48 by prod_rel_team

ROM: System Bootstrap, Version 12.2(7r) [cmong 7r], RELEASE SOFTWARE (fc1)

Rtr_2651XM uptime is 9 weeks, 3 days, 11 hours, 35 minutes
System returned to ROM by reload
System restarted at 11:08:30 Dallas Thu Oct 23 2008
System image file is "flash:c2600-advipservicesk9-mz.124-16.bin"



Thanks in advance for any suggestions.


Dale

 

[unclerico]

My first thought is what do you plan on doing when he takes his device outside of your network? I don't have one of these devices, but does your provider provide an itemized list of sites accessed??

Can you set up filters on your router?? Sure you can, but it's kind of tricky. A thought off the top of my head is to make a DHCP reservation on your DHCP server and tie it to the iTouch's MAC. Create some ACL's that permit traffic from the iTouch's IP only to your desired sites. It's tricky because you need to be on top of address changes for the sites. If your son has any technical aptitude he will be able to defeat this method by simply giving his device a static IP that is different than the one assigned via DHCP.

You could also purchase third party content filtering software.



I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[drichter12]

Well, I am able to lock his networking options down somewhat on the iTouch so he is restricted only to networks I choose and can assign him a specific ip. My hope was that I could somehow restrict him by domain names rather than the tedious task of maintaining a list of ip addresses. I may have to look around on-line for some sort of parental control portal type setup to lock him to but I'm afraid that might be more expensivve than it is worth.



Dale