Nice thing to know about your first solution. But yep I have internal DNS servers that recieves all DNS requests for all machines. In my DHCP scope, I have internal dns settings passing to clients. The reason I am seeking a solution is because we have employees bypassing our websense using different types of http/https proxies. I wonder if i could create ACL at a network level at the port to drop/block all internet traffic for that workstation. I would be a lot of work, but it would pay off at the end. Any thoughts on this?