Block internet access with windows firewall

[easg]

is it possible to block the internet access of a pc using the windows firewall, for example block port 80, I tried using the exeptions option but it didn`t work.

[AnotherMuggle]

You cannot block ports using Windows Firewall.

There are loads of free port blocking programs available on the net.

This looks like a good one:
http://www.dirfile.com/emsa_port_blocker.htm

[Ob1]

adding exceptions to the firewall will open up or allow, the xp firewall cant block requests, or shut down port 80 like a firewall would on a router, or a 3rd party firewall.

you could edit the host file to block certain websites simply by typing in the website and then adding the ip address of 127.0.0.1

you can navigate here and opening it with notepad
C:\WINDOWS\system32\drivers\etc
heres what the host file says once open

# Copyright (c) 1993-1999 Microsoft Corp.
#
# This is a sample HOSTS file used by Microsoft TCP/IP for Windows.
#
# This file contains the mappings of IP addresses to host names. Each
# entry should be kept on an individual line. The IP address should
# be placed in the first column followed by the corresponding host name.
# The IP address and the host name should be separated by at least one
# space.
#
# Additionally, comments (such as these) may be inserted on individual
# lines or following the machine name denoted by a '#' symbol.
#
# For example:
#
# 102.54.94.97 rhino.acme.com # source server
# 38.25.63.10 x.acme.com # x client host

127.0.0.1 localhost
127.0.0.1 www.myspace.com
remember it will only block the websites that you add here manually and by adding the ip address of 127.0.0.1. so for example say you want to block www.myspace.com cause you dont want your children going to that website, open up the host file and enter this on the line right below 127.0.0.1 Localhost:


127.0.0.1 www.myspace.com

Obviously this would be a impossible to do it for every website but this is effective if you have a certain few that you want to block, or get a 3rd party firewall or router that can block port 80 if you want to block the whole web access altogether or limit it to certain times of the day. just make sure you dont give the user profiles you are trying to block access with admin rights, cause they can go in to the host file and delete all of your entry's you entered if they know how to locate it. Im not saying this is the best solution but something thats pretty easy to do if you are just wanting to block a certain few websites.

or follow what tomkear2006 mentioned.

[mairving]

You can block it by setting the proxy server in IE to 127.0.0.1 and even allowing certain sites to bypass the proxy server. Unless you use Group Policy then they will be able to remove the proxy settings. I have it restricted at work to only allow one site, our local intranet site to be visited.

[Ob1]

but that only blocks IE, what happens if your co-workers/employees download and install firefox or opera? what i mean is yes, you can set up the proxy in firefox and opera for 127.0.0.1, but there is no way to lock it down like you can with group policy on IE.

or Maybe there is some program or tweak on firefox to lock it down that i am not aware of, if so please let me know so i can implement this on a few pc's as well.

[mairving]

Originally Posted by Ob1 but that only blocks IE, what happens if your co-workers/employees download and install firefox or opera? what i mean is yes, you can set up the proxy in firefox and opera for 127.0.0.1, but there is no way to lock it down like you can with group policy on IE. or Maybe there is some program or tweak on firefox to lock it down that i am not aware of, if so please let me know so i can implement this on a few pc's as well.

How are they going to download it when they can't get to the FF site? Even if they managed to download it somehow, they can't navigate to anywhere in Explorer. They could put it on a CD but there aren't CD-ROMs in these computers. They could put it on a flash drive but the drive won't ever load. They can't even download to their desktop.

[Ob1]

i see what your saying, i was basing my thoughts on the pc having access to a cd rom drive to install it and or a flash drive, but it sounds like you have those pc's locked down. did you just disable the usb ports to prevent people from specifically using flash/thumb drives? Did you disable them manually on each machine or did you use a 3rd party tool like Securewaves SecureNT. your first sentence of how can they download it after you setup the proxy to 127.0.0.1, well that was just a brain fart, i guess i was assuming the computer already had firefox on it, since all of my pc's i use do, i just figured it was the norm now a days to have IE and FF installed on pc's, but i guess if you want to restrict internet access then that is not the case.

[mairving]

It's all done via Group Policy. There is a policy to restrict PnP. I just restrict access to all drives though and it never loads. The people on the machines can only run 2 programs along with IE which will take them to one site. It helps them make good choices about what they do.

[kev7555]

Excellent idea!!!

Sometimes simplicity is the answer...


-Kev

[easg]

I tried the port blocker, it is what I am looking for but it can`t be password protected, a user could simple stop the program and start to browsing the web, does anybody know a similar solucion but that can be password protected or simple be hided from the tray.

[Ob1]

whats wrong with doing mairving's idea of a proxy of 127.0.0.1 to block internet access?

just make sure that you put people on limited accounts so they can't change the proxy server settings of 127.0.0.1 and browse the internet again.

[easg]

the problem is that I can`t disable the cd-rom and usb ports because they are used, so if I block only IE they could install another browser.

[Ob1]

i believe you can block internet access by using this program
http://www.spectorsoft.com/products/...ows/index.html

i had a co-worker install it for a companies front pc to block intenet access on it. i think it just blocked port 80 which would disable all browers.

[mairving]

Maybe your best bet would be to buy a security appliance or use Squid as a proxy server. With Squid you can port forward ports 80 & 443 to go through Squid. Only certain IP addresses would be allowed. You can make users authenticate but that would require Ident or another program to be installed.

[macko72]

http://www.programurl.com/browsecontrol.htm

http://www.programurl.com/software/r...net-access.htm

http://www.surfpack.com/software/res...nternetaccess/