Restricting internet in one computer lab but retaining server access

[KevWCFE]

Once again I need your zen like experience people.

 

There are 8 computer labs/rooms in the college. We have a Server 2008R2 domain controller for AD, DHCP and DNS and Untangle Lite running on another HP server doing the filtering. The Untangle boxes takes a feed from the internet router into one network card and is connected to the main network through a second network card.

 

There is an exam on Saturday morning and the students will need to save data to their home folders for later collection by the teacher and they will also need to print to the lab printer which is done through the server.

 

However, they can't have internet access.

 

Is there a way through group policy to isolate this computer lab so it doesn't have internet access but does have normal domain/network access while leaving the other labs alone? This is a part time course exam so it is the only one on in the college at that time. I know I could just unplug the router but the daytime/fulltime exams are coming up in a couple of weeks and I will have to do the same for some of them.

 

I read somewhere else that you could change the gateway that the server puts out in DHCP but this would affect all computers....or is there a way to change the DHCP settings for one set of computers? I didn't think so but then again I'm not qualified in servers, just teaching myself as I go along and certain things are needed.

 

I also read somewhere that I could use GP to put a random proxy into IE but Firefox may be on some of the PCs or Chrome so if I change the policy for IE would any other browser automatically pick up on that?

 

Any ideas or pointers would be appreciated.

 

Thanks

K

[Michael]

I would do the following -

 

Create a new GPO with duff proxy settings and create a software restriction policy to prevent IE, Chrome and FF from running. Prepare and test in advance and all should be fine.

 

Ideally all workstations in the Computer Lab in question should be under one OU, then you can link the newly created GPO to that.

[mac_shinobi]

I would do the following -

 

Create a new GPO with duff proxy settings and create a software restriction policy to prevent IE, Chrome and FF from running. Prepare and test in advance and all should be fine.

 

Ideally all workstations in the Computer Lab in question should be under one OU, then you can link the newly created GPO to that.

 

Surely there are other ones that could do with being blocked i.e. opera portable, not sure about safari or other web browsers

 

Opera, Portable Edition | PortableApps.com - Portable software for USB, portable and cloud drives

[Michael]

True, but I don't think taking in flash memory sticks into an exam would be considered 'OK'.

[sted]

give em a static ip withoput a gateway?

[Davit2005]

give em a static ip withoput a gateway?

 

If your using DHCP on 2008 R2 you could make all the machines reservations then just put a fake IP address for the Gateway. Within DHCP right click the machine and Create Reservation. Once reservation is set you can then change the options to look at a fake gateway.

[sted]

can you how? just had a quick look and i cant see how

[TomC]

we use group memebership with tmg and apply these user to this group. works for our controlled exams and doesnt change any setting on machines Edited April 18, 2012 by TomC

[Valyyn]

I'm assuming that each lab is in its own OU in active directory, but wouldn't the easiest solution be to create a group policy that sets the proxy to an IP that doesn't exist on the network? (Or 127.0.0.1).

 

That way the machines would still have access to everything on the network (you could even allow intranet pages if you wished by making them a proxy exception).

 

Edit: Actually as I write this I do realise the problem - this would only really affect IE, so if you're using firefox or anything else and they're NOT set to "Use system settings" for the proxy then they would still work...

[chazzy2501]

you could include a bat file that uses the route add command and reroute the gateway to point somewhere useless.

 

"route add gatewayip 127.0.0.1 metric 1" this would take effect until reset.

 

replace gatewayip for your gateway address.

Edited April 18, 2012 by chazzy2501

[Davit2005]

can you how? just had a quick look and i cant see how

 

In 2008 R2 DHCP msc, Right click lease in address leases > Click on add to Reservation. Then open Reservations and in left pane right click the reservation that you made and click configure options. Jus change the gateway ip address.

[KevWCFE]

I would do the following -

 

Create a new GPO with duff proxy settings and create a software restriction policy to prevent IE, Chrome and FF from running. Prepare and test in advance and all should be fine.

 

Ideally all workstations in the Computer Lab in question should be under one OU, then you can link the newly created GPO to that.

 

Thanks Michael, sorry for delay in thanking you, had a busy week and only getting a chance to implement this now. I will try your suggestion of preventing browsers from running. I know there are other browsers but those three are the only ones installed and as students can't install anything I think that should cover it.

 

I'll let you know if it works. Here I am at 4pm trying it out...typical

[KevWCFE]

Cheers Sted,

 

Its something I thought of alright but I would rather something that is turn on and offable to quote a famous turtle so I'm going to try Michael's solution. Plus at 4 pm the day before the exam a quick solution through GP is handiest for now.

 

thanks

[KevWCFE]

Thanks Davitt, that sounds like and interesting solution and not something I was aware of. I might give that a try the next time but as the GP solution from Michael is something I'm a little familiar with I'll try that for now.

 

Thanks for the suggestion and I'll let you know how it goes if I get around to trying it.

[KevWCFE]

we use group memebership with tmg and apply these user to this group. works for our controlled exams and doesnt change any setting on machines

 

Hi TomC, excuse my ignorance but what is TMG. Is it third party software or something built in to Server 2008?

 

Thanks for the info

[KevWCFE]

Thanks to all who posted. Appreciate the time ye took. I'll let ye know how it goes.

[SYNACK]

Hi TomC, excuse my ignorance but what is TMG. Is it third party software or something built in to Server 2008?

 

Thanks for the info

 

Forefront Threat Management Gateway (TMG) | Secure Web Gateway | VPN

[KevWCFE]

Thanks to all again. I forgot to let you know how it went. I implemented Michael's suggestion of stopping the browsers from running and it worked perfectly. As I mentioned above there are only three browsers installed and the students don't have access to install anything else so that worked for me.

 

I was then able to quickly turn off that group policy after the exam on the Saturday morning so all would be ready for normal classes on the Monday.

 

Quick and easy.

 

Thank you people.

[Gatt]

Forgive me as I just skim read this but a few options have been suggested but not sure if they have been added together:

 

Create AD Group and add all the PCs you want to restrict

Create a new GPO and filter it to apply to the above AD group only and make sure you enforce it so that it doesn't get overwritten by another policy

set the proxy to: 127.0.0.1 (any port)

 

(also just realised I'm a little late to the party - but this may be useful for future...)

Edited May 16, 2012 by Gatt

[cpjitservices]

This is what I set up at the local college one room for exams, all you need to do is reserve that room of PC's DHCP addresses on the server and in your filter list put a block all internet access rule on your filtering server and then that range of IPs' will not have internet access but WILL be able to access the network. I was using Squid and Dansguardian at the time and works flawlessly!

 

Aslong as all the browsers are going through the proxy - which ours where even through firefox and chrome there would be no internet access "if students tried to access the internet they would get a "this page has been blocked" or an "Access is denied" page - and it only worked for that room as that room was on a certain range of IP's.