Blocking Internet Access on the fly

[ITguyCharlie]

Hi all,

First, some context. I'm in a university environment, under a central IT department. For the most part I have control over the School's image, Group policy, and physical hardware. Not so much when it comes to an network infrastructure and network services.

Now, for my question. I have a mobile laptop lab, which instructors borrow when their class needs the laptops. During exams the instructors ask if the internet can be disabled so ensure student integrity. I need a quick way to disable the internet access while still allowing connection to some network shares. Most people say configuring a proxy in Group policy or something like that but I rather something along the lines of a script that I can run to "turn it off" and script to "turn it back on." Because the laptops are wireless, group policy timing can be finicky and I only need to turn it off for a few hours at most.

 

Any ideas?

Thx

[RichCowell]

Definitely worth checking out Impero - I've used it for years, it'll do exactly what you're looking for and so much more...

[ITguyCharlie]

Thanks, I'll check it out. Of course I doubt my IT manager will even consider before i've exhausted every free method. Maybe my time will be better spent putting a list together of why we could use such software... meh

[MordyT]

Correct way to do this is on your firewall/ proxy. Controlled centrally, can't be undone by the user like a proxy script can be, and you most likely already have the tools needed.

[ITguyCharlie]

Hey Mordy,

Thanks for the suggestion. Is this something that could be done via Group policy? Because there is close to 50 laptops sometimes, I want the least hands on approach, but at the same time it needs to be a solution that can quickly be changed back. Usually, the instructors give me a couple days notice of needing "internet turned off", and I wish to find a solution where I can disable for the time they are proctoring their exam, and easily/quickly re-enable.

[RichCowell]

It will be something that can be done via firewall (though probably fiddly), and group proxy, and there are bound to be other free solutions... but none that I've looked at in the past have been as quick and easy as Impero...

 

I'm quite happy to rave on about the merits of Impero until the cows come home... but it does seem to be the ideal solution...

 

You can schedule blocks, by PC / Users, and create custom groups easily, adding PCs or Users individually or with wildcards, then you can block the internet or USB (because there'd be nothing stopping them bringing resources to cheat with on USB), on the fly (which is what you mentioned initially), easily with just a few clicks...

Edited April 30, 2014 by RichCowell

[Duke5A]

The quick, free, and dirty way would be to define your proxy through an auto configuration script (PAC file) through GPO. When they need Internet access to be blocked off all you have to do is edit the proxy.pac file and point them to 127.0.0.1. If this is something that happens on a schedule then use a scheduled task that fires a script to change the config file (or swap two of them around, one that works normally and one that points to loopback).

[MordyT]

Hey Mordy,

Thanks for the suggestion. Is this something that could be done via Group policy? Because there is close to 50 laptops sometimes, I want the least hands on approach, but at the same time it needs to be a solution that can quickly be changed back. Usually, the instructors give me a couple days notice of needing "internet turned off", and I wish to find a solution where I can disable for the time they are proctoring their exam, and easily/quickly re-enable.

 

That's the beauty of it is it doesn't need any GPO changes.

 

What firewall/proxy do you have?

 

(If none this can be done with either (or both) pfsense and squid - both free).

 

You would simply select either the PCs or the users and block access on the proxy. If by PC, it would affect all users on that PC, if by user it wouldn't matter what computer they would be using.

 

You could make a group with all the PCs in it and do all 50 or even 5000 in the same amount of time.

 

1. Receive request from staff to block access.

2. Login to device and in a few clicks, block access.

3. Seconds later computers are no longer browsing web

4. Profit knowing you accomplished your goal in under a minute.

Edited May 1, 2014 by MordyT