Need to block websites while behind proxy

[LazyD]

Hello,

I have been trying in vain on and off for a couple of weeks to block some websites (youtube, facebook, msn messenger IP's). I would normally use the hosts file but we are behind a proxy here to get to the internet so it is assumed that all blocking etc is done on the perimeter of the network, the hosts file does not get used when using proxies.

We cannot block youtube etc for ALL users, I just need to block them sites on specific pc's. As I mentioned already, using hosts does not work, using the restricted sites in IE does not work either (I'm guessing that is overridden too when "use a proxy..." is checked).

I have tried installing a number of software firewalls but have gotten no where with these either, including sygate, comodo, Outpost. I can either only get them to block everything or not the sites I need to block at all. I need to be able to configure advanced rules in them to block the sites so things like zonealarm are no good.

Preferably I would just like a simpler solutions that a software firewall, or one that will let me allow everything but only block the things I want to block. Comodo just didn't block anything at all...?

Can anyone help?

[johnwill]

Try the personnel department. You give people that violate company policy on such things a week off without pay, that usually gets their attention!

[LazyD]

Well, if you had read carefully enough you would have seen that youtube etc is not to be blocked for everyone in the whole organisation but on specific pc's only. Those pc's are used by a particular class of children in a parrticular area of the organisation.

[djaburg]

But if you're sitting behind a proxy server, why not block them there? I guess in the grand scheme of things, it sounds like you're trying to block traffic on a network that you don't necessarily have control over. Normally the proxy server or router is the place that these kinds of restrictions are placed and unless you route the traffic through yet another device, it seems like it would be tough to accomplish.

[LazyD]

But if you're sitting behind a proxy server, why not block them there?

Already said, we cannot block the sites for all users, we are trying to block them on a specific set of machines in one classroom.

Don't mean to be rude but I'd rather just get useful suggestions at this time rather than comments on how difficult it is, I'm aware of that, I've been trying to do this on and off for a couple of weeks now.

[djaburg]

Alrighty, then I'd install a simple router (like a linksys rv042) specifically in that classrom and then do the blocking on the specific machines and sites that you need, having all classroom computers go through that router. The reason for the suggestion about using the proxy server was based on experience where you COULD block certain computers from doing certain things, but if you're not the network administrator that set things up, then perhaps this is the easiest solution.

[LazyD]

Thanks for your reply.

I am part of the network administration team, however it has been agreed (by people higher than me) that no other changes will be made to the filtering at all. They have their reasons for this.

The thing is, I would like to keep the current filtering that is in place by our proxies just add blocking to certain sites as well. The filtering that exists already is appropriate apart from one or two sites that I want to block. Starting to block everything again on a new network segment doesnt really make sense.

[LazyD]

Still have this problem, anyone have any further suggestions please?

[Tekmazter]

Does your proxy not allow authentication to control web access? This is available in even freebie proxies such as Smoothwall. They can even integrate into active directory.

On a side note ... you should not try and leverage only technology here to do your job. Have your employees sign an acceptable usage policy and then have the managers police their staff. IT is not the dumping ground for all work related items that effective staff management could easily prevent. How would a manager stop someone from making personal phone calls all day? They don't come to you to block phone #'s too do they?

[LazyD]

I cannot change any settings on the proxy for 2 reasons, 1) I don't work with the proxies hence am not allowed to 2) Even if I was I wouldn't be able because it has been agreed that the websites I want to block will not be blocked on the proxies. I have been left to find a way to block the sites on the local machines.

I've tried hosts, software firewalls and spent most of today configuring ipsec policies, still not blocking. I can get to block everything with firewalls and ipsec but not individual sites.

I understand what you are saying about fair usage but the boxes in question are on pc's in a class room for students who have been excluded from regular classes, they are not employees machines, these kids don't care much for fair usage policies nor can anything be done about it when they do access inappropriate material due to their status.

[Tekmazter]

Are you vlan'd by classroom? Do you have layer 3 switching which would allow for ACL's in which you could prevent access to a particular IP?

You're in a real political mess here. If you don't have business buy in I don't see how you can successfully perform all that is required of you.

Just to recap ... you have a proxy server in-house which is used to filter web content, yet the business won't let you take advantage of its functionality to mitigate potential web threats and even possible litigation --think inappropriate videos on YouTube. Sounds like the priorities are not where they should be.

Also, the fact you're in an education type environment I seriously feel for you. This is one area where you need lots of control around IT systems and whats made available throughout the organization.

[LazyD]

The vlan it's on includes more than just the classroom, and I can't do anything on the switch those pc's are on anyway, again I'm not allowed to touch it. It's complicated, but a partnership firm is involved in most of the hardware apart from some segments (the switches and proxy involved in this case are not run by my department) however the boxes are our responsibility and they won't touch them or take on this job at all (even though it seems very difficult to make this work on the local machine alone).

[johnwill]

You're trying to drive the Indy 500 with no hands here. You need to solve the company management "head in the sand" attitude before you try to solve the technical issues.