Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I want to block all internet access from a computer except for allowed applications and domains.

E.g. BLOCK ALL Except security.stackexchange.com/... Except skype.exe

How can I do this? -It needs to be a software solution on the computer -The security needs to be password protected (requirement of windows admin right to change anything would be sufficient password protection)

Please try to give a detailed answer as I don't know anything about ports and some other expressions that I came across when googleing this. The computer currently has Windows firewall installed but I can install another more customizable firewall if that is needed.

share|improve this question
3  
I'm very skeptical that you can implement any effective whitelisting without at least a basic knowledge of ports and protocols. Successful whitelisting (permitting access only by specific programs to specific domains) relies on moderately complex implementation. If someone wants to bypass your implementation, their success will depend on whether they know the network better than you do. –  Mark C. Wallace Dec 26 '12 at 11:54

2 Answers 2

My pick would be for you to get a desktop firewall. There's certainly different brands out there, and if you are a novice user, you may want to read reviews on usability before buying and take a serious look at screen shots.

What you describe is called "whitelisting" - meaning that you set up 1 rule on a firewall that says "block everything" (deny all any/any where "deny" = don't let anything through, all = all types of traffic, any/any - any source, any destination). Then you set up the "white list" - meaning the list of good destinations that you want to allow.

Quite honestly, from a practical perspective, whitelisting is the strongest, but most time consuming approach to this type of security problem. If you are coming from the experience of not knowing the following words:

  • IP Address
  • Port
  • Protocol - plus if SSL, HTTP, FTP, HTTPS, DNS Request, and ping - are all new words to you
  • DNS address

Then you are dealing in this area at a severe disadvantage. Now would be a good time to brush up on these concepts - an intro network security course would cover them, as should a book on the basics of network security. The art of figuring out how to permit what you want to permit is definitely a craft that gets learned over time. Big networks have teams of people that figure this stuff out, and sometimes these folks decide NOT to white list, because it is simply too expensive and limiting for the average user community.

If you're coming at this as cold as it sounds, figure that you will spend 20-40 hours figuring out enough to get your basic setup done, and then 3 months of frustration as you find out from experience what you need to tune to give yourselve the internet access you need without reconfiguring your network and setting it wide open. It's easy to think that internet sites like Skype, Facebook, Google, and others use just 1 simple destination (www.google.com), but in reality, most of the super-big sites scrape together content from all over the place, so that while allowing www.facebook.com will give you a a webpage, it's likely that large areas of the page will show red X's and other error messages because the traffic to certain connecting sites is still denied. This is helpful when you want to block things like game-sites, but difficult if you are new to boundary protections (a subset of security expertise including but not limited to desktop firewalls).

Another way to approach this problem would be to survey desktop firewall products and see what rulesets are delivered by default and how they are updated. This should work much like an anti-virus - that you can bank on the collective knowledge of a company or group and pay a maintenance fee to maintain the ability to download updates as the group adds expertise to the blocking rules that are used by your product. That will save you the many hours of work required to figure all this out yourself, and will get you basically decent, but not state of the art, security rules to protect a home system or other fairly standard environment.

Another possibility is that some types of devices in this range offer a "learning mode" - you can ask the device to watch your traffic for some time, and it will collect information about where you go and what you do. You can review the information and make choices from there and have the device block anything that doesn't fit your standard pattern. I'm seeing enough Google tidbits out there to believe that this is a potential feature. That saves you the money of a subscription fee, but may increase the price of the product. It may also continue to require tweaking, as learning modes are not perfect. It's a balance of you knowing enough about the traffic on your system to made educated choices, and the product being smart enough to help you streamline your decision making. If you and the tool fail to communicate, you will encounter time-consuming frustration...

share|improve this answer

This is very simple- use a firewall with a deny all rule, and then add specific allow rules for the domains and ports you want to allow.

For example, for website access all you want to allow are ports 80 and 443 for that website, as normal website access is on those ports.

As Mark commented, you will need to learn about ports and how connections are made. If you do not yet understand these basic terms, you will not be able to rely on your controls.

share|improve this answer
1  
If further whitelisting of specific websites is needed, you could route traffic through a proxy that does the filtering. –  Terry Chia Dec 26 '12 at 13:20
    
What Terry Chia said. Because just filtering based on IP addresses is a bad idea as website IP addresses can change and some websites have several of them. –  Matrix Dec 26 '12 at 14:20
    
Most good firewalls will let you block on domain name, ip or combination. –  Rory Alsop Dec 26 '12 at 16:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.