How do I block all sites (except a few) on 20 different physical locations?

A lot depends on the configuration of the network at the remote sites.  The most thorough way would be to install a transparent proxy at each site. This would be a low end (possible repurposed desktop box) with 2 network cards.

You would connect the network router to one port and the rest of the network (the switch) to the other.

Then you set up simple rules (using what is called ip filtering) to only allow access to the specific web sites.

It works great for small # of permitted sites if you can do your own support & troubleshooting - perhaps with a semi-trained assistant at the remote site.

There are instructions all over the net on setting up a transparent proxy.

If you want / need a commercial (supported) solution for 20 sites, you probably want to choose a appliance type solution.

-----Burton

You may even configure the IP filtering in the router that connects these networks to the internet. That way you don't need an extra device in between

>Someone mentioned to me that I should set up a BIND server, and have all the clients point to it for DNS information.

If you are an all-Microsoft shop, why would you introduce a new server with BIND?  You can configure the DNS server on an available Windows server.

You have to configure the DHCP server at each site to give your DNS server as the only address for DNS resolution.

Then, make sure that the workstations can't change their network settings to use another DNS server.

Or, configure your firewalls to block all port 53 traffic except for your own DNS server.

Keep in mind that blocking like this can backfire.  Back in the late 90s, we played cat-and-mouse with AOL.  Over the course of a year, they acquired MapQuest and gradually replaced graphic links to only come from AOL ad servers...then from AOL.com servers.  If our blocks stayed in place, you could not see any legend info, and the navigation/zoom buttons disappeared.

This is a client that cannot afford to have me install a proxy server at every site.

The best solution would be something like OpenDNS, except OpenDNS doesn't allow you to blacklist EVERYTHING and then whitelist a few sites.  They make money off of advertising, and there need to keep many of the sites open in order to make money.

I have set up a DNS server, here in my office, for testing.  By setting the server to not forward requests, and then setting up a separate zone for each domain, I have been able to create what I want.  Now, it's a matter of making it look professional.

I would, however, like to have some sort of custom "This site is BLOCKED - get back to work" page when sites are blocked.  But, this is probably wishful thinking.

Oh, a little more about the configuration at each site.

This is a sandwich shop chain.  They have broadband at most of the sites, and dial-up at a couple of sites.  1 store connects via Verizon EDVO card.

None of the stores connect via VPN, so that isn't an option.  We used OpenDNS for a while, but that was'nt was the owner of these stores had in mind... because even with ALL categories blocked on OpenDNS, employees were STILL wasting time on the internet!

I would like to have something that is centrally located - like in my office - that I can whitelist sites when needed and have the new rule apply to ALL  stores, without having to remote into every one of them.

Probably the best answer would be to use the store-side router for this.  However, having had clients in a similar situation, this is difficult because each site gets it's service from a different provider and there's no uniform solution - in fact, some providers won't let you touch their equipment.

So you're going to have to put a device BETWEEN the IPS's router and the store's equipment.

The best bet is a consumer grade wireless router (say the old standby Linksys WRT54GL) - i.e. something that you can run one of the alternate distributions on.  This is a basic Linux box and so the white list is an ip tables/ip route shell script.

You will need to test the authorized software to make sure it can handle the double NAT.  And you will need somebody to do the installs (moving one cable and adding another).  And you will need the IP addresses of the ISP's router (or something like dyndns.org - a paid account will let you have more than one host).

Finally, and here's the sticky point, you will need to configure the ISP's router to forward port 22 (ssh) to your new box.

Once all that's in place, you can ssh into the Linksys and update the ip tables script.

-----Burton

You could setup a proxy at your place and point all their browsers to that proxy (lock it down that way). I have only ever used proxies within a trusued network, but I can't see why it wouldn't work. You would need a fixed, valid Internet address on your Internet gateway and a NAT to a proxy on the inside which you then manage. Squid is free on a Linux box.

1. If you setup a different dns on the computer they can always change the dns to a working one and have access to internet freely.
2. My 2c would go on a VPN solution using a soho router (pptp or openvpn) to a linux box that can hold a squid proxy server where you will act both a as VPN hub for your 20 conections and as a squid transparent proxy that can filter anything you like and how you like it and when you like it. Also block direct port 80 access and usual offsite proxy addresses.
3. You can also do some layer7 filtering on this vpn hub instead of using squid and with this solution you can also filter other protocols like IM, IRC, P2P traffic and whatever turns you on.

Regards,

C

IIf the list is down to only a few sites and if they do not change often I would implement a firewall to only allow port 80 and 443 to those specific ip address.  Depending if your sites are all connected through point-to-point VPNs or if they are on their own will depend if this is a good solution.  How is the network setup?  Is each site considered "inside" or "outside" your network?