Restricting internet access

[HyperDad]

I'm currently helping a friend setup 8 PC's running Windows XP Pro for his business. He wants only 3 of the PC's to be able to browse the Internet. He wants all of them to be able to receive windows updates and Anti virus updates.


The network will consist of a dlink switch plugged into a linksys befsr 41 router the router will be plugged into a cable modem when the project is complete.

Any suggestion on how to accomplish this?

HyperDad

 

[OmegaAvenger]

http://www.homenethelp.com/web/howto/family-access-control.asp if you want to keep the BEFSR41.

you really should switch to something like untangle or smoothwall, they have more robust access controls.

 

[`danny]

Untangle would be very useful as a firewall and a filtering system if you would go that route in the future. If you want to be able to keep all of the operating systems up to date setting up a Windows Update Server (WSUS) would work quite well. As for keeping the antivirus up to date, you could go with NOD32 and setup a remote administration server that would ensure that all of your nodes stays up to date.

 

[Captain Colonoscopy]

to restrict the internet traffic is going to be difficult if you give users admin rights on the desktops. if they only use limited accounts you could set static IPs and leave out the default gatewat. this would allow network connectivity for file sharing, etc.

you could also put in a real firewall with a proxy that just blocks internet acces entirely for certain computers. then punch holes open to allow those computers access to windows update or setup a wsus server.for the virus updates you are going to either need to open up the update sites in the proxy or buy a real av suite that hs remote administration and an update server. NOD32 is highly recommended.

Have you thought abouut a server at all? 8 nodes is a bit big for a workgroup. a few more nodes and you pass the limit for workgroups with windows.

 

[HyperDad]

Thanks all for the info...


Captain said
Have you thought about a server at all? 8 nodes is a bit big for a workgroup. a few more nodes and you pass the limit for workgroups with windows.

I have discussed it with Him and for now he just wants to stick with a workgroup.

I know very little about hardware firewalls. Would one be a good solution?

I think he would be open to purchasing a hardware solution.

thanks again

Hyperdad

 

[YeOldeStonecat]

Removing the gateway would cut out getting Windows Updates, and antivirus updates.

Granted once a week or so, some "staff" could go around, change things..catch up on updates and antivirus...but it becomes cumbersome....

Once quick way to accomplish this...some of the linux firewall/router distros out there have a feature called a "Captive Portal". PCs behind it, when they launch a web browser or something to connect to the internet...immediately the browser goes to an internal website...where you need to enter a user/pass to get to the internet.

For business networks...just about all the antivirus brands out there have a managed business version...where you have a master antivirus server on your LAN..that downloads the updates and makes them available on the local network. Clients are set to download those updates across your network from that server, instead of from the internet. So you can have workstations without internet access, that still get updates.

Microsoft updates, there is a product called WSUS, similar to the above managed antivirus....you have a main box that downloads all the updates from Microsoft, and with one quick registry change on the rest of the workstations...they recieve their Microsoft updates (Windows/Office/other MS products) from this box.