1

I would like to block websites like Facebook, YouTube and other social sites as part of my job and would need your advice on how to manage that. There are about 120 PCs in the building. Is something like that possible?

Can it be done with the host file, or is there other way?

Graham Hill
  • 15,394
  • 37
  • 62
VEGA
  • 13
  • 4
  • Slighlty offtopic: People spent a large portion of their life at work. Restricting casual visits of sites of any type typically tries to solve the wrong problem and reduces the workplace quality of all users. A root cause analysis of why is using facebook and youtube a problem is necessary. Is it draconian law? Is somebody spending too much time on them? If yes, solve the right problem with this worker (lack of motivation, other issues). Blocking something would really put people off. – Samuel Aug 20 '14 at 13:07

2 Answers2

2

I don't think you can solve your problem at the hosts, IP firewall or DNS blacklisting levels. These methods will fail and won't scale.

If this within your financial possibilities, I'd suggest you to install a web firewall. Here are the beginning of the prerequisites to build such a web firewall.

1. Material

A PC with a pretty large amount of RAM (≥ 8 Gb), 2 100 Mbit/s Ethernet ports, a large disk (≥ 1 Tb). This PC will have to be inserted as a breaker on your Internet connection cable (hence the 2 Ethernet ports).

2. Basic software

A rock solid OS (FreeBSD, Linux…) correctly secured (most notably everything not usefull will be closed). A rock solid free software used by ISP to manage web performance and filtering: Squid

3. Real business

The configuration of this application level firewall should progress as follows:

  • standard configuration of squid as a transparent web proxy,
  • train yourself to look at the squid logs,
  • start to analyse what may cause bandwith waste, data leak…
  • make clear communication about its use and purpose,
  • turn off the phone,
  • start to filter…
Community
  • 1
dan
  • 3,033
  • 14
  • 34
1

The easiest solution would be to block dns resolution to those sites in the internal dns server†. If your pcs go through a proxy, a better solution would be to block those urls in the proxy configuration.

Note however that although your manager thinks that facebook or youtube shall never be used in the office, you will find that it will sometimes be needed: someone managing a company profile in social networks, that video relevant to the company that you should see that happens to be hosted on youtube… and you will probably be making your users angry, so block with caution.

† they could overcome it by changing their dns settings or using proxies/VPN, but would server as a soft-block, and they supposedly aren't local administrators.

Update: Yes, you could list them in the hosts file. But do you really want to add those entries on 120 PCs?

Ángel
  • 17,578
  • 3
  • 25
  • 60
  • i think he wants to block social sites for all those PC's. Here are Planet model modem where from we get internet and after there are switches. – VEGA Jul 23 '14 at 11:55
  • 1
    @OSu7x64 My point was _Why list them in the hosts file when you can block it at the internal dns server?_ – Ángel Jul 24 '14 at 18:52
  • Thanks for support. That is solved. now we are in domain users. – VEGA Nov 05 '18 at 17:58