New Office Networking

Hi AO's


Our Organization has planned for a new branch

Which would be consisting of 7 PC in One Network connect among with a router

out of which 4 PC would be with the internet connection supplied though the same router

and other 3 PC would be without internet connection

now the problem is how will this 3 PC configured which would share their files and folders with the same network but without internet connection


I wanted a suggest on this very query
1) Can we setup a proxy on this PC
2) or else not to load or install the DNS setting


OR else any other ways??

Regards
KK

I'd setup an extra box to act as a proxy. Set up the network so no-one can access the outside world directly. Have the browser use the proxy. You can use authentication on the proxy to decide who can access what on the internet.

Or you can assign it through GP. I believe there's an Internet Users group that you can control that through. We actually use that in combination with a proxy around here.

In that small of an office, what about configuring the browsers' proxy to
127.0.0.1:80 (and/or any other ports like FTP/21), then the browsers won't
load anything. The 3 computers are still networked otherwise.

What specifically are you keeping them off the internet for?

Hi Broken Crow,

Quote:

---

What specifically are you keeping them off the internet for?

---

It because they got caught in using illegal websites which are banned in this country and for which the ISP penalize the organization

Well this there a ways in which we dont install the DNS onto their computer and which would work fine with a little less amount of money usage..

(and there should also be a privilege in which if the organizaion thinks of letting them use the internet may be in future)

Depending on the router you use you may be able to disable internet access for those computers from the router settings.
If not you could try installing dd-wrt on your router to give you the ability to block access to the wan based on MAC addresses (and much more).

Quote:

---

Originally Posted by omin

Depending on the router you use you may be able to disable internet access for those computers from the router settings.

---

That should work too, though I've seen those cheap $50-60 routers act
too flaky sometimes. If you've got to seriously manage a gateway, it
really pays to get yourself into something better than those inexpensive
consumer models. IMHO.

Sure does! If you have a nice router you can setup ACLs and disallow those computers from accessing the WAN

Make damn sure none of the users have local admin privileges. If they do, anything you do, setting dns or using an IP based ACL can be subverted.

Setting up your network so it doesn't route anything to the internet forces your users to use the proxy. To be able to use the proxy they're required to authenticate. That way you can really control who is able to surf the web. As for users giving their proxy credentials to someone else. Simple solution, anyone caught doing that will be fired on the spot.

Quote:

---

Originally Posted by SirDice

I'd setup an extra box to act as a proxy. Set up the network so no-one can access the outside world directly. Have the browser use the proxy. You can use authentication on the proxy to decide who can access what on the internet.

---

The OP wants a network of 7 PCs so I assume that's a peer-peer rather domain. I'm coming at this from a theoretical point of view (no actual network admin experience) and am interested to know what software you'd recommend for a proxy on a peer-peer LAN. I appreciate that the each user's PC would be configured to use the proxy for internet access and authentication at the proxy would allow or disallow internet traffic to pass.

I've heard of ISA server but isn't that for a bigger setup on a domain? I suspect that would be excessive for the OPs requirement.

ISA's expensive, at least for a 7-pc office. It runs on a hardened version of Windows server (unless something's changed with ISA 2006). So you've got to buy licenses for both the server and ISA (cha-ching!). It's a nice product if you're comfortable with Microsoft packages.

Symantec, Cisco, and Sonicwall, along with a slew of other companies manufacture standalone firewall products (with proxy features) that start out around $300-400. IPcop, pfSense, and Smoothwall are all free open-source products that also offer a proxy server as a feature. You'd need a PC to load those.

A lot of folks are real high on the free stuff, but I've seen admins load these systems on computers, that though they met minimum sys req's, they were way too slow and choked bandwidth. If you're going to go with a do-it-yourself firewall/gateway like IP cop, don't cheap out on the hardware. Get a minimum P4 and 512 mb's ram and some 1 gb nics.

Quote:

---

Originally Posted by brokencrow

IPcop, pfSense, and Smoothwall are all free open-source products that also offer a proxy server as a feature. You'd need a PC to load those.

---

That's great - I figured that ISA server would have been overkill. As I implied, my interest in this is from an amateur point of view, so I'll be investigating Smoothwall and IPcop. I've seen them discussed elsewhere in the context of a firewall. I didn't realise that they have proxy server capability.

The above comments are interesting as well as quite suggesive.

well i guess if we didnt load the DNS to those PC and take away the administrative rights from them would be a better Idea.

and when it comes to keep one more router would be a problem as it will consume space as the area of this office is small.

But there is one more part i was a little doughtfull about
if we create one of the PC out the 4 PC with internet previllege as a server then we can block port 80 for the other 3 PC and allow for the rest of the PC.
Can we do such kinda seperation?

or not?