Policy to block internet access, yet allow LAN access ? 1

[pvanos]

Can I block internet access using a GPO, yet still allowing the workstations in the OU to access their homedirectories and other shared resources via LAN ?
What settings do I need to create/modify ?

 

[markdmac]

Do you have a proxy or firewall?

 

[mcse924]

I'm not sure how to do that exactly. HOWEVER, you will always prefer to control Internet access via a firewall or router, which would require that you know how to do that, or speak to the people (usually the "networking guys&quotwho can do that for you.

It's just seems like a best practice to control Internet access in this manner. Good Luck.

Carpe diem, procrastination is the thief of time...

 

[pvanos]

Now THAT would have been nice... No, just a router with NAT. No proxy nor firewall :-(

 

[markdmac]

OK, this will be sneaky but should work. Create two policies. One for people who will get Internet and one for people only allowed intranet.

Since you DON'T have a firewall or proxy, we are going to fake out the system. Make up a phony proxy name and configure it to be pushed down to all of your intranet only users. If they try to go out on the net, they will get an error because the proxy can't be contacted. Make sure you lock them out of changing the proxy settings.

For your Internet allowed people, I would lock them out of the Internet Options settigns too even though you are not configuring those settings for them. Lock down anything else specific to Internet users in this policy.

 

[AJ1982]

If you got a router pop over to the routers forum with more info.

Ta

AJ

===

Fatman Superstar (Andrew James)

CCNA,
(CCNA Cisco Academy Instructor Trained)