Support

K-12 Forums

Talk with other K-12 network administrators in your state.

Or see all states.

Categories

Vanilla 1.1.4 is a product of Lussumo. More Information: Documentation, Community Support.

This discussion has been inactive for longer than 30 days, and is thus closed.

Administrative: How to prevent Users to remove open dns servers

Bottom of Page

1 to 14 of 14

  1.  
  1.  permalink
    Hello, Im manager of a small network, 10 computers at the business office and 3 at the house for the children. i configured open dns servers on all of the computers to block porn and time wasting sites for my workers and also for my children.
    the problem begins when some wise guys noticed how to add the ISP provided DNS servers and just jumped over my security. also one of my sons already find out the way to do it by adding another dns server.

    also i've spoted two of my workers using web based messenger clients using the IP instead of the domain and it opens right away.

    please help me. how could i prevent users from changing DNS servers settings on windows XP and also, how to block direct IP request; like http://231.62.21.63 (e.g.)

    Thanks folks i hope you can help me out with this.
    • CommentAuthorRed Prince
    • CommentTimeMay 21st 2009
     permalink
    Only an administrator can change DNS setting. Surely you do not give your workers and your children admin privileges?
  3.  permalink
    You can also set and enforce policies regarding use of company time and equipment, but your first best step is to remove administrator privileges and set user policies on the operating system in use, as noted above.
    • CommentAuthordiacon
    • CommentTimeMay 21st 2009
     permalink
    No way to block direct IP access with OpenDNS as it is not a DNS query.
  5.  permalink
    any other provider or software that can help me?
    • CommentAuthorrotblitz
    • CommentTimeMay 21st 2009
     permalink
    Sure, there are hundreds of software and hardware solutions.
    But it's not worth to even mention them, as long as your users are admins: they can simply throw it away again then...
    No, for admin users there are not really restrictions, for good reasons. I only could think of one: unplug the cable to the internet.
    • CommentAuthordiacon
    • CommentTimeMay 21st 2009
     permalink
    For DNS overrides you could set your router to forward all traffic on port 53 to OpenDNS if your router has that functionality.

    I guess you could also get your router to forward IP address's of known offending sites to something like hellokitty.com's IP address. Again if your router supports this. You might want to look into DD-WRT firmware for routers. I haven't used it (yet), but I probably can do these things.
    • CommentAuthorrotblitz
    • CommentTimeMay 21st 2009
     permalink
    "For DNS overrides you could set your router to forward all traffic on port 53 to OpenDNS"
    This can be circumvented by admins either e.g. by simply using an IPv6 based DNS service. Most routers/firewalls do not recognize IPv6 traffic, but just pass it through.
  9.  permalink
    You might use a GPO setting OpenDNS as default. Possible in standalone machines too.
    few users know how to circumvent GPOs

    finn
    • CommentAuthorUnderDog
    • CommentTimeMay 22nd 2009 edited
     permalink
    Deny DNS traffics to other DNS servers beside OpenDNS server using a firewall rule on your router gateway. Allow only DNS traffic from your network to OpenDNS server only. Works for my company network. This will leave the user no choice, no DNS no surfing the internet.
    • CommentAuthordiacon
    • CommentTimeMay 22nd 2009
     permalink
    @rotblitz - Interesting. I've never thought of using IPv6 to circumvent security measures. How would the router send the response back to the client if it cannot perform network address translation? I need to learn much more about IPv6.
    • CommentAuthorrotblitz
    • CommentTimeMay 22nd 2009
     permalink
    @diacon
    I do not have a direct IPv6 connection yet, because my ISP would not support it. However, one can get a (free) IPv6 tunnel set up (IPv6 over IPv4), where all traffic is going through, nearly uncontrolled by most current firewalls and routers.
    http://en.wikipedia.org/wiki/Ipv6#Tunneling
    http://en.wikipedia.org/wiki/Tunnel_broker
    http://en.wikipedia.org/wiki/List_of_IPv6_tunnel_brokers#Tunnel_broker_list

    "if it cannot perform network address translation"
    With IPv6 you don't need NAT any longer. Each device has it's own unique worldwide IP address, or even better: IP address range. I got a /48 (in v6 terms) for each of my (currently three) tunnels.
    • CommentAuthordiacon
    • CommentTimeMay 22nd 2009
     permalink
    Wow. Thanks for the info rotblitz. This nullifies a lot of security. I'm going to have to test some things out. Interesting.
  14.  permalink
    Actually, if you don't use IPv6, disable it in a Windows OS, as it is engaged by default, and is also a security issue of the same type. I'd disable it in any router where the option is available as well.

1 to 14 of 14

  1.  

This discussion has been inactive for longer than 30 days, and is thus closed.