Subject: Deny Access

From: Fritsch Jonathan D CONT PSNS <[email-masked]>
Date: Wed, 28 Mar 2001 15:16:13 -0800

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

  Does any one know of the command to place in the netperm-table to deny web
access to a URL?

- Jonathan

---

From: Scott McEachern <[email-masked]>
Date: Fri, 30 Mar 2001 07:45:53 -0500

>   Does any one know of the command to place in the netperm-table to deny web

     I could be wrong here, but I don't think that's a part of the FWTK's
functionality.
     However, once upon a time when I actually gave a darn where people surfed
what I did was use my internal DNS server to ``host'' the restricted domains.
The DNS would point to an internal web server with a page that said something to
the effect of ``access is restricted.''  Obviously my DNS wasn't serving to
anything other than our intranet, but this worked for me.  HTH.

--
R. Scott McEachern, Network Administrator
J&A Media Services, Inc.
300 John St., Suite 500, Thornhill, ON, CA  L3T 5W4
tel:905-881-6902  fax:905-881-6945

---

From: Scott Campbell <[email-masked]>
Date: Fri, 30 Mar 2001 09:22:12 -0800 (PST)

>   Does any one know of the command to place in the netperm-table to deny web
If you want to deny web access to 1 (or a couple) urls you can do an entry
such as:

http-gw:        permit-hosts 10.2.0.9 -dest !142.104.6.7 -dest *

This restricts your machine of 10.2.0.9 to go anywhere except that one ip.
I use this for our public internets so that they can go anywhere except
our internal staff web server.  If you want to do that for all your
machines just replace the 10.2.0.9 with your internal ip mask.  You could
also do it by name such as:

http-gw:        permit-hosts 10.2.0.9 -dest !*.hotmail.com -dest *

which again will let that machine anywhere except a url that has a domain
ending in hotmail.com.

Your line can be up to 1024 characters (if I remember correct) and if you
don't have that final "-dest *" then they won't be able to go anywhere.

If you need to deny access to say 100 urls then you have to do it outside
of fwtk (unless someone who knows more says different ;)

Scott E. Campbell
_______________________________
Computer Operations
Greater Victoria Public Library
Victoria BC CANADA

[email-masked]