Using Ranger to prevent Internet Access

Question

Can Ranger stop users from accessing the Internet?

Symptoms

N/A

Cause

The Internet is a valuable learning resource but sometimes it is necessary to restrict access during a particular lesson or for a particular user or group of users.

Resolution

Ranger can help restrict Internet access using a number of techniques. Ranger React for example can disable Internet access to specific users or groups. Rules can also be configured to restrict users based on their location or the time of day.

The success of some of the solutions outlined depend on your network configuration and may also require third party software to be available and configured.

The Gateway

In a very simplified model; Internet access - for example web browsing - can either go directly between the computer and the Internet or computer via a web Proxy and then to the Internet.

If a computer is configured with a gateway then Ranger's ability to restrict Internet access is limited. The reason for this is Ranger works on a software level i.e. Ranger can manipulate settings, close programs etc but whilst the computer has a gateway IP then the numerous ways of accessing the Internet cannot be completely controlled.

In order for Ranger to prevent Internet access you have to remove the computers direct access to the Internet by removing the gateway and force Internet access through a web Proxy. This way only software configured to use the correct web proxy values can access the Internet. This has a number of benefit not the least controlling when a user can access the Internet but you can then also log what they are doing and implement control over Internet based applications.

Testing the Gateway

If you find that a gateway is set and you would like to try disabling the setting, then before making any system-wide changes test all your software thoroughly on a single computer making sure there are no side affects. Ranger is NOT responsible for any configuration or software errors resulting from testing and we do can NOT offer support with your network settings.

If you can remove the gateway and restrict access to the Internet via a proxy you will have greater success with all of the solutions below.

If you find that you are dependant on the gateway address and therefore cannot remove the setting then you can still implement the solutions below however you may find that they have limitations i.e. users are able to find workarounds in particular scenarios. There are alternative means of controlling Internet usage but not available through Ranger. For example connecting all your network computers to a computer acting as a router and redirect all port 80 (web traffic) through a proxy.

Instructions

How to stop a group of users

These methods could be modified to instead stop users within particular groups from accessing the Internet. For example

How to stop all users

Identify the registry keys which disable the Proxy settings and using these keys copy them into the bottom of the servernamerangerpreshell(os).rrg file in the Misc section.

This file is merged into all users who logon to a workstation matching the OS type specified in the file name. E.g. values saved in the PreshellNT.rrg file will affect NT4, 2K and XP users.

How to stop users in a particular location

Testing

After applying the control, logon as a test user within the appropriate group, location and try accessing the Internet.