Teachers laptops on wireless network

[bishopsgarthstockton]

Hope this is the right are to put this post

 

Just set-up a mobile classroom in the school and now the teachers has discovered that they can also connect to the network and surf the net.

 

If i allow them too

 

The problem I have is if they logon on to the local laptop account they will be able to bypass the proxy. Yes I could set the proxy settings but if they need to use the Internet at home they will not be able to access the net.

 

Is the a way i can stop them from bypassing the proxy while at school and have freedom to use the net with out the proxy setting intervening.

 

Cheers

 

Kev

 

hope that made sense

[beast_gts]

Do you use DHCP? If so set the Gateway to your proxy sever.

[Geoff]

Also set your border firewall to disallow traffic out on port 80. (You might need exceptions for some software updates to function, eg, Windows update).

[bishopsgarthstockton]

beast_gts

 

do you mean set the gateway on the laptop?

[bishopsgarthstockton]

this is something that is new to me

 

If i block port 80 then when the staff take the laptops home they wont be able to access the net....

 

sorry im not too hot on networking...any guidence would be appreciated

[Geoff]

No, block it on your firewall at your networks border (or better yet use a transparent proxy).

[beast_gts]

Do you use DHCP?

 

What is your Internet connection, Proxy server and firewall? (You're Stockton LEA so I could guess...)

[bishopsgarthstockton]

yep we use DHCP. Just installed the new easy net cache pilot proxy server a month ago.

 

we dont have control on what ports we can block and uinblock on the firewall.....can i block the port 80 on the dhcp side of things....

[beast_gts]

There is an option on the DHCP server to set the gateway address (under Windows its called something like "003 Router"). I'm guessing at the minute its set to the IP address of your LES. If you change it to the address of your CachePilot it will force ALL computers using DHCP thru your CachePilot.

 

If you want to firewall them give Easynet a ring and they will do it for you (they should have left you a firewall ruleset change form at some point in the distant past).

[bishopsgarthstockton]

excellent....found it....

 

and if i need to get straight through to a site i need to access for work use i can set the gateway on my machine to the LES.

 

learn somthing new everyday!

 

just passed the MS 70-270 exam and started studying the 70-290 exam material, im sure i will come across it soon

 

This forum is great....one of the ladson the CCNA course sugested it...

 

think i will give it ago when the kids have gone home.

 

cheers

[beast_gts]

and if i need to get straight through to a site i need to access for work use i can set the gateway on my machine to the LES.

 

Yep. Static IP for you, DHCP for everyone else.

 

PM me if you need help.

[bishopsgarthstockton]

beast gts

 

the 003 router is already pointing at the cachepilot ip address...so why am i still able to get out on to the net with ne restrictions?

[beast_gts]

Has it just changed? (or was it always like that?)

[bishopsgarthstockton]

hi,

 

yeh its always been like that....havent made any changes

[beast_gts]

How is the Cachepilot configured (does it use LDAP, does it allow anon access, etc.) ?

[bishopsgarthstockton]

it dosent allow anon access. from what i understand about ldap, no it dosent use ldap

[djm968]

Use a GPO to force them through the proxy, logging on using a domain account at school. At home they can logo n using the local Laptop account.

[bishopsgarthstockton]

djm968

 

thats what i would have done but they can access the net at the school through the laptops local account with out any restrictions.

[djm968]

AFAIK most schools do not allow staff to log on to laptops using a local account. This opens up all sorts of cans containing wriggly little things without legs.

 

Back in the day (god that makes me sound old) when I was a NM, I always locked the laptops down.

 

At the end of the day, it comes down to priorities, if the main priority is that they cannot bypass the proxy, then I would lock them down.

 

This will probably then open up the other “up till now quiet” can of wriggly creatures and upset them all because the can no longer download and install the latest P2P file sharing thingy… sorry I mean free educational interactive whiteboard resource from the internet.

 

Basically it becomes a PR exercise, prepare responses well, compromising security, confidential data, accountability etc etc, because the sh*& will hit the fan.

[GrumbleDook]

Phase 1 ... lock out Net Access except anything that goes through your cache ... this will mean that whatever you use as a firewall needs to have Port 80 blocked to incoming / outgoing for all IPs apart from those that you specify (the cache obviously ... and your machine of course!!!)

 

That way if anyone tries to use anything except the cache they get a polite 'cannot access server'.

 

Even if they log on locally they cannot go anywhere.

 

As for logging on locally ... we do it here with very few issues ... we even make them local admins. It is done with a health warning ... if they cock it up then it gets fixed when we have time ... it is rare that we have people coming to us with problems ... what we do get is people coming to us *before* they try something out to either let us know what they are going to do or to check that there is not a problem.

 

It has left us with most teachers feeling more confident about using their laptops. It doesn't work for everyone ... but it does for us.

[plexer]

I am in the process of looking at giving staff a specific local power user log on only to be used to install hardware and software such as their home printers on their laptops.

 

Ben

[Dom_]

Install firefox (or a different browser) and set the proxy settings in there. Then rename the shortcut 'School Internet'.

 

They'll still be able to get unfiltered through IE, but they'll have signed an AUP anyway, so you've done your part