Block Internet Access, Allow Intranet, No Proxy Server
Hello
I'm currently working with a company to change their group policy.
They have a group policy that sets a proxy server address off 0.0.0.0
The GP is then assigned to an OU and any user in that OU gets the proxy address and is therefore unable to access the Internet.
Now, we have a new Intranet system but because the vast majority of users have the above proxy set, they are unable to access the Intranet.
What is the best way of allowing access to the intranet, but still blocking Internet Access?
The company does not have a proxy server
Thanks in advance
I'm currently working with a company to change their group policy.
They have a group policy that sets a proxy server address off 0.0.0.0
The GP is then assigned to an OU and any user in that OU gets the proxy address and is therefore unable to access the Internet.
Now, we have a new Intranet system but because the vast majority of users have the above proxy set, they are unable to access the Intranet.
What is the best way of allowing access to the intranet, but still blocking Internet Access?
The company does not have a proxy server
Thanks in advance
ASKER
But wouldn't that then block Internet for every user?
For instance the GPO isn't applied to one OU, which contains managers, and they are allowed Internet access
For instance the GPO isn't applied to one OU, which contains managers, and they are allowed Internet access
If everything including the intranet web server is on the same subnet , and you don;t need to route any IP traffic to other sites, you could set all the client computers to have no default gateway ( or set it to an IP address that doesn't exist). They would still be able to communicate on the local subnet but not beyond.
Then you don't need to set up any proxy server settings.
EDIT - re your comment above: if you want the managers to have different behaviour they would need to have either different IP configuration (such as pointing to a real default gateway) or different browser behaviour ( either them or the other staff pointing to a proxy server address). Depending on how many managers there are, you may be able to set up fixed IP info for them, or maybe a DHCP scope with different options and with reserved IP addresses for these computers.
Or the managers could run a script which adds (manually) an IP route to the internet, pointing at the default gateway.
Then you don't need to set up any proxy server settings.
EDIT - re your comment above: if you want the managers to have different behaviour they would need to have either different IP configuration (such as pointing to a real default gateway) or different browser behaviour ( either them or the other staff pointing to a proxy server address). Depending on how many managers there are, you may be able to set up fixed IP info for them, or maybe a DHCP scope with different options and with reserved IP addresses for these computers.
Or the managers could run a script which adds (manually) an IP route to the internet, pointing at the default gateway.
In addition with my answer aflockhart's suggestion is correct
Further on that the best solution will be a UTM device but with a cost of course...
Further on that the best solution will be a UTM device but with a cost of course...
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
dstewartjr's suggestion is the way to do it.
ASKER
This was exactly what I needed, and so simple!
Thanks very much
Thanks very much
Fix the GP so everyone have access and from your DHCP server publish only the subnet and DNS server. Do not publish the gateway