Web Proxy

[Soulless]

We have Windows 2000 Small Business Server. We recently installed a web filter, SurfControl.
We have setup so everyone connects to the internet using a proxy server, in this instance the web filter works great.
However if a user were to go into Internet Explorer, Tools->Internet Options ->Connections-> LAN Settings and select Automatically Detect, they can then view any pages they want.
Can I stop them being able to do this or can I route all internet access through the proxy server?

 

[mikiemov]

This area can be restricted by creating a GPO, and removing access to the connections page within IE control panel.

Mike,

 

[Soulless]

This is prob a dumb question but how would I go about doing that?

 

[mikiemov]

Take a look at

http://www.microsoft.com/windows200...ndows2000/en/server/help/sag_RRAS-Ch3_08b.htm

 

[smsg]

Well, the reason they are able to do that is because your default gateway setting actually exist. A default gateway by definition is the address of the router that allows them to reach 0.0.0.0 which is the internet. Normally this will be your firewall/internet router and if outgoing web services are allowed (http,https) then they will be able to surf the net.

If you have a flat network, that is, where there are no routers required to reach any of your internal servers, then you should point the workstations to a DUMMY (non- existent!) default gateway. This way, they cannot do anything if they disable the proxy. The surfcontrol filter however has to be pointed to the real gateway (as well as your other server like DNs, mail forwarder that need direct access to the internet). This also solves a lot of network slowdown issues when a virus like blaster or sasser hits. When you get hit by these viruses, they immediately look for the default gateway to lauch a denial of service attack against an external target host. Most network admins will set the default gateway to a firewall which also most of the time happens to be their web proxy and reverse proxy, mail filter/forwarder. Guess what happens? The firewall has to carry and filter all that outgoing traffic -- resulting in sloow

http://www if

not downright NONE internet connectivity.

SMSG