user adding gateway ip to access internet 1

[JacobTechy]

I have a user who is adding our gateway ip to his networking connection and thus having the ability to access the internet which is not allowed. How can I block the user from adding the gateway. How can I remove the gateway from his computer. I have tried delete in dos but does not work.

 

[pansophic]

You fail to identify the OS, but it appears to be a Windows OS since you mention DOS. I believe that even if you use the DOS "route /delete" command in DOS, if the Gateway is configured in the GUI, it will re-appear after a reboot.

The obvious answer is to remove administrator privileges from this user's account (it should be removed from everyone's account). I believe that this can be handled through a group policy setting if you are Windows XP on an Active Directory Domain.

But it sounds as if you are a small network, without much in the way of centralized control. If that is the case, I would be more likely to do something like defining a different route on the gateway for that subnet, so that packets from the Internet to this user's machine cannot be routed correctly.

Or I might choose to do MAC address filtering, and only allow the MAC addresses that I wished to have access to the Internet to get through.

A lot depends on what equipment you have at hand, how big the network is (what has to be done to reconfigure) and how much you are willing to invest in filtering technology.


pansophic

 

[pgaliardo]

What type of device is the default gateway? I'm sure there are some kind of access lists you can configure to deny his IP address access to the outside world. That way, even if he changes his default gateway, he still can't get to the Internet.

 

[JacobTechy]

The OS is Windows 2000. The device we use is a pix515E. What I am going to do is change the lan settings on the browsers internet options to point to our web server so he can at least access our intranet then block him from editing the lan settings.

 

[bcastner]

http://www.pcmag.com/article2/0,1759,1386896,00.asp

 

[JacobTechy]

wow extacly what I needed. Thanks! Is there a way to do this over a login script?

1. set to false proxy server and enter allowing domain
2. prevent user from changing this IE setting