Windows Server 2003 AD Internet Access

[sweetac]

Hello, I am trying to lock down which users can and cannot access the Internet. I am wondering if there is a way to create a "internet" group and then assign the users who should have access to that group. This is a very small company and I have 2 NICs in the 2003 box and RRAS running. I have RIP v2 configured and currently all users are able to access the net through this box.

I am willing to make any config changes required if this is possible.

Thanks!

 

[GrimR]

Get ISA or Linux. Do you run some sort of PIX or ASA

 

[sweetac]

There is nothing else configured. I stepped into the current configuration. A Linux solution would definitely be feasable. I am guessing I would need to set up RADIUS for cross-platform authentication? Are there any docs on the net on configuring this setup?

 

[pagy]

A very good, and free, Linux solution is Smoothwall

http://www.smoothwall.org

This can be used as a proxy server and you can use dansguardian for internet content filtering.

You mention that you think you may need to use RADIUS, what requirements are you looking to fill??

Paul
MCSE


"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein

 

[sweetac]

Basically, I need Internet access restricted to particular users on the network based on their AD ID permissions. The company does not want to manage a separate database for these so a 3rd party/platform solution would require some way to determine if the user requesting access is allowed access through some sort of common user data such as RADIUS or other ldap solution.

I was hoping there was a way to control this access with Active Directory through Group Policy management but it appears that ISA Server would be required (surprise, surprise, MS puts this functionality in a separate, very expensive product instead of including it in the already-rediculously priced OS, not to mention the added cost per user!).

 

[pagy]

There is a custom mod for smoothwall that allows for authenticate against active directory called advance proxy

http://community.smoothwall.org/forum/viewtopic.php?t=25097&highlight=active+directory

There is another proxy server I've used in the past that offers authenticate against AD but I can't remember what it is called now. In fact there are probably lots of them, do a quick google for them or there is a proxy forum on tek-tips.

Paul
MCSE


"Two things are infinite: the universe and human stupidity; and I'm not sure about the the universe."
Albert Einstein

 

[GrimR]

Linux does authenticate with AD using Winbind.

 

[sweetac]

Thanks for the help everyone. I am going to repurpose one of the old file servers and install Linux and Smoothwall to try to get this up and running (since its free ) and Advanced Proxy.

Thanks again!