Member Avatar for mokkema

Ok, heres my setup. I've got to restrict a computer in the office that I work at to only perticular sites...but I really can't think of a program that does that. So could someone recommend to me a prog that does that the best please? Thanks:cheesy:

  • 3 Contributors
  • 3 Replies
  • 128 Views
  • 9 Hours Discussion Span
  • Latest Post Latest Post by caperjack

Dani AI

Generated

A few practical, reliable options beyond the quick client tweaks mentioned by are better for an office environment because they are harder for an end user to bypass. The shortfall in the thread is guidance on solutions that scale and survive a user with local admin rights. The approaches below assume the goal is a locked-down, maintainable allowlist rather than ad hoc blocking.

One robust route is a gateway/proxy allowlist. Deploy a small firewall/router appliance or VM (examples: pfSense) and add an HTTP(S) proxy package (examples: Squid + URL ACL plugin). Configure the proxy to allow only the required hostnames, then block direct outbound web traffic at the firewall so all web requests must pass through the proxy. This gives domain-level control and central logging; see pfSense documentation and the Squid wiki.

For smaller setups, DNS-level filtering is quicker. Host a local Pi-hole or use a managed DNS filtering service (OpenDNS/Cisco Umbrella) and implement a whitelist-only policy. Point clients to that DNS via DHCP. DNS methods are simple to deploy but can need extra work for sites hosted on CDNs or for services that use many subdomains; see and OpenDNS.

Cautions and maintenance notes: HTTPS makes deep content filtering harder without SSL interception and certificate deployment, so enforce proxying and block direct port 443 to prevent bypass. Whitelists require upkeep (APIs, CDNs, embedded frames). Prevent local circumvention by removing admin rights on the locked machine or using a kiosk/assigned-access configuration. For auditing, enable logging on the gateway so changes and attempts are visible. These measures are more work up front but far more dependable than per-machine tweaks.

Recommended Answers

All 3 Replies

Member Avatar for antioed

I can't think of any program to do that either. If you could come up with a list of sites that you don't want the user to visit then you could put it in the restricted sites or modify the user's host file to ensure there's no resolution on the domain name. What I would do, if you just don't want a user blowing up their computer, is set the Internet zone to "High" security and then put the safe sites that the user actually needs to use in their Trusted Sites zone...this should keep most of the nasty junk out.

Member Avatar for mokkema

good idea............why didn't I think of that? *goes to try it*

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.