Member Avatar for ashjohnuk

my current setup :
modem/router
|
3 com switch
|\
| \
| --Server (win2k3)
various os 8 pc's all running windows

what i would like to do is to have the server to issue the ip addresses, and grant or deny webpages...
i have tried vairous attempts to do this to no avail, i am using open DNS, and it is not that user friendly, and sumwhat slow.

would i need 2 nic's in the server?
or what else could i do?

Thanks
Ash

Edited by ashjohnuk because: n/a
  • 4 Contributors
  • 6 Replies
  • 194 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by RTFMID10T

Dani AI

Generated

A concise, practical plan that ties the existing advice together and fills missing troubleshooting steps.

For decision-making: two realistic paths exist — use a gateway appliance that does URL/category filtering (simplest, harder to bypass, better performance), or build a server-based solution (more control per user, more work). Two NICs on the server are only required if the server must act as the network gateway/NAT between the LAN and the internet. If the server is only providing DHCP/DNS or acting as an explicit proxy, one NIC is sufficient.

Common DHCP/DNS and connectivity pitfalls (quick checks)

  • Verify the Windows DHCP service is running, the scope is created and activated, and the server is authorized in Active Directory if AD is present.
  • On a client run ipconfig /all to see which DHCP server supplied the lease; that immediately shows if the router is still answering.
  • If clients never get leases, confirm UDP ports 67/68 are not firewalled and there is no conflicting DHCP server. If the server is on a different subnet, the router must be configured as a DHCP relay (IP helper) for broadcasts to reach the server.
  • The “internet only works after disabling/re-enabling an interface” symptom usually means Windows has competing default routes or an interface metric issue; use route print and remove duplicate default gateways or set appropriate interface metrics.

Practical ways to give full vs limited web access

  • Proxy with authentication (per-user rules): a proxy that integrates with Windows auth (NTLM/AD) lets policies follow users. Group Policy can push proxy/PAC settings for domain clients.
  • Network separation: place groups into separate VLANs/subnets with different firewall/DNS policies for stronger enforcement.
  • DNS filtering is lightweight but easily bypassed (direct IPs, alternate DNS), so if DNS-based blocking is chosen, block outbound DNS to anything except the approved resolver at the gateway.

Example PAC snippet for automatic proxy assignment (deploy via WPAD or GPO):

function FindProxyForURL(url, host) {
  if (isInNet(host, "10.0.0.0", "255.0.0.0")) return "DIRECT";
  return "PROXY 10.0.0.10:3128; DIRECT";
}

Notes and caution

  • DNS-only controls cannot reliably block HTTPS URLs and are trivial to evade unless enforced at the gateway.
  • Windows Server 2003 / 2000 are long out of support (server 2003 support ended July 14, 2015); avoid exposing them to the Internet and consider upgrading or using a dedicated appliance for perimeter services.

This complements , and by setting practical enforcement choices, concrete diagnostics for the DHCP/dual-interface issues described by , and clear tradeoffs for DNS vs proxy vs appliance approaches.

Recommended Answers

All 6 Replies

Member Avatar for JorgeM

There are several ways to do this. The easiest way is to have a router that includes a URL filtering service. That way, you control which pages you allow/deny at the exit point of your network. However, if you prefer to do this function with a server, you would need to load proxy software or other filtering service on that server. In this example, if you run proxy services, you can use one NIC. However, you would have to block all outbound traffic on the firewall for every node except the proxy server. Then force your clients to use the proxy server for internet access.

Alternatively, you could set up the server with two NICs with RRAS enabled. Then the workstations would use the server as their default gateway. Run the proxy/filtering software in the same manner. This method does not require you to configure your clients to use a proxy server. The proxy server just intercepts the traffic on the way out.

Again, always keep things as simple as possible. i would suggest hte interner router with URL filtering capabilities. It will be much faster than a dedicated server, and much less complicated, and cost less (no Windows license required, no proxy software needed, etc...)

Member Avatar for CimmerianX

My suggestion:

Turn off DHCP and DNS on the router.

On the server, enable DHCP and DNS services.

Configure DHCP with your ip scope assigning the router ip, dns ip (make this the 2k3 server), and wins options 44 2k3ip and 46 0x8 for hybrid.

Configure the DNS with a forwarder to the open DNS servers.

Open DNS servers let you sign up to control dns lookups for free. You can cut off certain web pages by 'turning off' dns resolution for those pages. the local DNS server will cache results and help speed up dns lookups.

Member Avatar for ashjohnuk

thanks for te reply guys, I am looking to give some end users full web access, and others limited web access.
I have looked into proxy but i am totaly confused by this as i am a system builder and not a 'netty'.

would you be able to point me in the right direction?

Thanks guys

Edited by ashjohnuk because: n/a
Member Avatar for ashjohnuk

CimmerianX - i am unable to turn off DNS on the route, i have only two options,
Domain Name Server (DNS) Address
Get Automatically From ISP ()
Use These DNS Servers () [___.___.___.__] & [___.___.___.__]

Member Avatar for ashjohnuk

I have managed to get it working with windows server 2000, using my wifi to connect to router / modem on and using the LAN , this is just untill my network cards i have ordered have arrive. But the internet connection is not live even when the wifi connection is connected untill i disable the lan, then re-enable it. I dont know if there is an issue with my settings or this is just because i am using wifi.

also i know this is also another problem, i am able to set static IP addresses on the client pc's, but i am unable to set them to auto dhcp...


Thanks
chaps

Member Avatar for RTFMID10T

you can block with a dns server, but it's an all or nothing situation. create a new dns zone and just put for example: and it will forward those requests to your server. At my office i use a high end firewall and filter by IP addresses, but not a cheap solution with what you already have.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.