Re: Blocking users from using web proxies
- From: Joe <joe@xxxxxxxxxxxxxx>
- Date: Sat, 24 Oct 2009 14:02:26 +0100
yaro137 wrote:
You may be surprised but I run Squid as a proxy.It acts mostly as a
file proxy but as it has much more features than just that I thought
I'll give it a try. There is another box that acts as a firewall. It's
a Draytek product. Even after updating the firmware I couldn't make
the filter rules to work properly. It's a pretty ancient piece of
equipment though. I managed to get squid to deal with at least some
anonymous proxies by keyword filter rules. GPOs were set to force
users to use Squid. They probably wont work for other than IE web
browser. I would have to figure out how to force users to use only IE
but that would be nasty. I don't use it much myself. Maybe some
software use policies with hashing rules.... Too troublesome. Thanks
yaro
Depending on which Draytek box it is, you may be able to deny all outgoing port 80 traffic to everything but the Squid device. My Vigor 2800 certainly should be able to do it, but I have never actually tried using the filters, which seem over-complicated to configure. I do egress filtering and transparent proxying on a separate box in series with the Vigor.
About the only way to be certain is to run the Squid box 2-NIC i.e. as a firewall. That way, you enforce proxy use even if someone brings in a laptop or runs a live CD operating system on their workstation. You're saving a bit of money over using a dedicated firewall box (which probably runs Squid, among other things), but probably not time.
As has been mentioned, this is really a management issue. If the management wishes to set rules on Internet use of work computers, and they'd probably have to be insane not to, these days, they also have to have the will to enforce them. But even then, a set of Squid or firewall logs or equivalent may be required for evidence of misuse. All workstations can be configured to keep firewall logs by policy, but with little detail other than time, destination IP address and protocol/port.
--
Joe
.
- Follow-Ups:
- Re: Blocking users from using web proxies
- From: yaro137
- Re: Blocking users from using web proxies
- References:
- Blocking users from using web proxies
- From: yaro137
- Re: Blocking users from using web proxies
- From: Leythos
- Re: Blocking users from using web proxies
- From: yaro137
- Blocking users from using web proxies
- Prev by Date: Re: EventID 529 after changing Admin password
- Next by Date: Re: Sharepoint Timer service not working
- Previous by thread: Re: Blocking users from using web proxies
- Next by thread: Re: Blocking users from using web proxies
- Index(es):
Relevant Pages
|
