Disable Internet access on a Windows PC

by Jason "Hiner MCSE, CCNA" | Dec 16, 2004 8:00:00 AM

Tags: Microsoft Windows, TCP/IP, Network technology, NETWORKING, Servers, Jason Hiner MCSE, CCNA, Windows PC, PC, Go-to, server

Takeaway: Learn several options for disabling Internet access on a single system while still allowing other systems on the same network to access the Internet.

Problem

TechRepublic member gryandmary used the Technical Q&A to pose the following question: "Can I target a client PC and disable Internet surfing, through a Windows 2000 Server with DSL connectivity, while still maintaining communication with the server? We are using Microsoft Windows XP Pro on the client."

Solution

Here was the response from TechRepublic member zaferus: "There are two ways you can disable Web browsing from a Windows system:

1. Go to Internet Options in the Control Panel. Go to the Connections tab and click LAN settings. Uncheck "Automatically detect settings" and then check "Use proxy server" and put settings in for a proxy server that doesn't exist. This will time out the Web browser each time a user tries to pull up an Internet site. Unfortunately, a savvy user could go into the settings and fix this.
2. Alternatively, you can set the Internet router to deny all port 80 traffic to the WAN from the IP address of the client PC you want to block. This is something that the user is less likely to figure out, and it will effectively block that one PC from Web access, while still allowing all over LAN users full access to the Internet."

TechRepublic member brian added another option:

"Go to:

• TCP/IP Properties
• Advanced
• Options
• TCP/IP filtering Properties
• Select Enable TCP/IP filtering (All adapters)
• Select Permit Only for all three selections (TCP, UDP, IP)
• Add only the allowed ports that are needed (leaving out port 80 for Web browser traffic)
• Click OK multiple times to close out the windows

These settings could also be set in a Group Policy GPO so that the user can't change them. You would make a special group just for this user."

---

Note

The text of discussion posts from TechRepublic members has been slightly edited for spelling, punctuation, and clarity.

---

Print/View all Posts Comments on this article

two extremes are all you needapotheon  | 12/16/04

I guess this would be outdated, but...pr0teus  | 12/16/04

re: small companiesapotheon  | 12/16/04

Not for long....AcesKaraoke  | 12/21/04

Right!apotheon  | 12/21/04

No firewall?awfernald@...  | 12/17/04

NO FIREWALL?!?lwebb@...  | 01/20/05

WHO SAID THERE IS NO FIREWALL?The Bobinator  | 01/20/05

it's a perfectly legitimate concern to address hereapotheon  | 01/20/05

Enough alreadyThe Bobinator  | 01/20/05

firewall discussionapotheon  | 01/20/05

Small Biz Firewallred_wolf@...  | 12/23/04

no kiddingapotheon  | 12/23/04

Old SchoolSlimTim  | 12/29/04

Access to Server?CSR-TECH  | 01/04/05

Unfortunatelyandypiesse@...  | 06/21/06

MS Content Advisor - No Access optionmulder@...  | 01/20/05

Limit Browser Access by Useridrlmink  | 03/02/05

But what Firewall Hardware works with dialup?robgin@...  | 01/20/05

er . . .apotheon  | 01/20/05

Can you say "Linksys"?"Mysterious  | 01/20/05

actually . . .apotheon  | 01/20/05

Many optionsWDMilner  | 04/19/05

NAT router as dial-up protection - 3com C510rlgoers@...  | 06/28/06

More Informationrlgoers@...  | 06/28/06

Use Squid!lumpyhed@...  | 12/16/04

to clarifyapotheon  | 12/16/04

Why not keep it simple...LearnByDoing  | 12/22/04

Simple is funrdlueth@...  | 12/24/04

Try GPEDIT.MSC...ghughes@...  | 12/26/04

Absolutelydafe2  | 12/28/04

No IE does not mean no Internetred_wolf@...  | 01/04/05

So Many Roadsjetpower  | 01/20/05

I like this guy's post the most!bcgreaves@...  | 01/20/05

block port 80admin@...  | 05/29/07

How do you stop an user from browsing through Outlook?jamfoo  | 12/27/04

email == Internetapotheon  | 12/27/04

Alternative to Outlookbaz_shaw  | 01/27/05

calendarapotheon  | 01/28/05

Account restrictionsdafe2  | 12/28/04

How do you do that?jodyman  | 01/21/05

how about?probinso@...  | 01/20/05

what about windows updatesdearmoree@...  | 01/20/05

Enable Updates but No Internet ExplorerAnthonyMCSE  | 01/20/05

It's trickylwebb@...  | 01/20/05

Answer is...lwebb@...  | 01/20/05

interesting conundrumapotheon  | 01/20/05

Updates without IE? Maybe...jrslyrics  | 01/20/05

ISA Server anyone?spam@...  | 01/20/05

SUS does itIseekthegrail  | 01/26/05

Yeah, well that's all fine and dandy...lwebb@...  | 01/20/05

interestingapotheon  | 01/20/05

Group Policy & SP2dafe2  | 01/20/05

Why not a simple route statement?rstanaford@...  | 07/10/06

Very similarghughes@...  | 07/13/06

Solution for networks living in stone ageccc032582@...  | 03/22/07