How to block Website Access using PAC File (Scripting)?

I recently found myself in a Corporate Situation where the client had requested blocking access to any and all websites except his own Domain? Easy?

I am sure this would be your answer but their requirement was, this has to be done without using any Hardware/Software based Proxy or a Firewall. It cannot be controlled at the Gateway etc. i.e. no change at the Corporate Level. This was not possible for us anyways since the client was sharing the Network with 3 other clients and making specific changes to the Network would mean affecting the other clients as well. We had to come up with Host based Solutions.

One more issue that we had to deal with, was that the clients were using Corporate Proxy and hence, all the traffic was going through a single IP. Windows Firewall was not a solution .


Solution [Not perfect but it works !:)] : We used IE as our starting point and since Proxy was used, all we had to do is to redirect all the traffic for "Blocked Websites" to DIRECT since Direct access was blocked and send only valid requests to the Proxy Server. Example below :


////Use the following link in IE after placing the file under ETC folder
////file://c:/windows/system32/drivers/etc/proxy.pac

function FindProxyForURL(url, host)
    {

PROXYENTRY = "PROXY proxy.Domain.com:8080"

if (shExpMatch(host, "*.Client.com*"))
 return PROXYENTRY;

else
        return "DIRECT";

    }

This script is simple enough and will allow traffic only related to Domain.com to Proxy. All other traffic is redirected to DIRECT which failed in our environment since it was not allowed in first place.

Although, if Direct is allowed then the traffic can also be redirected to something like Deadproxy.deadlink.com:8080 or some other non-working link.

For locking down the rest of the system, use Windows Firewall and Limited Access to local System like removing Admin Account.