• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 700
  • Last Modified:

How to white-list internal only web access? Block external web surfing and filter pages.

We have a few machines running Win XP SP3 and Win 7 that we'd like to limit web surfing on.  
How can we best implement this?


Block Web:    We want to block all other external web-surfing.
Access Internal:   We need to make internally served pages available they are all on one domain.
GPO:     We'd like to apply any solution by policy applied to a single OU.
4 Solutions
Set the proxy server to, bypass proxy for local adresses, add the local network to bypass the proxy server.
ServDeskKnowsAuthor Commented:
GoatCreek: I can't use the local proxy.  

That's what we've been doing, but a Citrix client application isn't able to cope with that proxy setting.  I'm looking for an alternative to that exact setup.
Can you utilise something like PAC files or WPAD browser settings.

A PAC file or WPAD.dat like below can be used to direct and/or restrict Web browsing

function FindProxyForURL(url, host) {

// If URL has no dots in domain name, send direct.
      if (isPlainHostName(host))
            return "DIRECT";

// If URL matches, send direct.
      if (shExpMatch(url,"*domain123.com/folder/*") ||
            return "DIRECT";

// If hostname matches, send direct.
      if (dnsDomainIs(host, "vpn.domain.com") ||
            dnsDomainIs(host, "abcdomain.com"))
            return "DIRECT";

// If hostname resolves to internal IP, send direct.
      var resolved_ip = dnsResolve(host);
      if (isInNet(resolved_ip, "", "") ||
            isInNet(resolved_ip, "",  "") ||
          isInNet(resolved_ip, "", "") ||
          isInNet(resolved_ip, "", ""))
            return "DIRECT";

// DEFAULT RULE: All other traffic, use below proxies, in fail-over order.

Get expert help—faster!

Need expert help—fast? Use the Help Bell for personalized assistance getting answers to your important questions.

You can set the proxy settings also by AD policy
It is no where near as complex and it is being made here.

You just set the Firewall/Proxy to just not allow certain machines to the Internet.  That's it,...Done.

Internal browsing does not go through the proxy in the first pace,..so that is irrelevant.  The whole point of a LAT (Local Address Table) on a firewall/proxy is to define the interior LAN so that the Firewall/Proxy already ignores request sent to any such destination,...so there is nothing "extra" that you have to do there.
ServDeskKnowsAuthor Commented:
Proxy works, but I was trying to avoid it.

Extra points to PAC files and a nod to Firewall configuration.
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now