Deny User group Internet Access

Hi NG,

my school has plans to migrate from Linux to Windows and I'm wondering how
to realize some things we do now with our Linux server.

Actually we have user groups for teachers, students and system
administrators.
Students have by default no permissions to access the internet, but they may
access our local webserver.
This is realized by checking the IP-Adress of the client, student PCs have
other IP Adresses than PCs that teachers use.

Is this possible to do with the RAS service in Windows Server 2003? Is there
a group policy or a thing like that gives the ability to prevent internet
access from some IP adresses?
And then, can this be controlled?

At the moment teachers can lock or unlock internet access for students with
a single mouse click, is it possible to change that setting programmically?
If it is a group policy, I know there are ways to write a program or an ASP
page to change a setting.

Thanks for any answer :-)

--
Irgendware Software Solutions GbR
http://www.irgendware.com

It is possible in win 2003 server, to deny acess to
internet, based on the ip adresses of clients.
If you set up NAT, then in you can set up "Outbound
Filters", to allow / deny permision to specific IP
address / range.
>-----Original Message-----
>Hi NG,
>
>my school has plans to migrate from Linux to Windows and
I'm wondering how
>to realize some things we do now with our Linux server.
>
>Actually we have user groups for teachers, students and
system
>administrators.
>Students have by default no permissions to access the
internet, but they may
>access our local webserver.
>This is realized by checking the IP-Adress of the
client, student PCs have
>other IP Adresses than PCs that teachers use.
>
>Is this possible to do with the RAS service in Windows
Server 2003? Is there
>a group policy or a thing like that gives the ability to
prevent internet
>access from some IP adresses?
>And then, can this be controlled?
>
>At the moment teachers can lock or unlock internet
access for students with
>a single mouse click, is it possible to change that
setting programmically?
>If it is a group policy, I know there are ways to write
a program or an ASP
>page to change a setting.
>
>Thanks for any answer :-)
>
>--
>Irgendware Software Solutions GbR
>http://www.irgendware.com
>
>
>
>.
>

Hi Sharad,

thanks, that option looks very good :-)

But when I enter an IP-Adress and a subnet mask I get an error "invalid
subnetmask", but umm that computers do exist.

I've got a local 192.168.0.x / 255.255.255.0 network

And when I enter 192.168.0.20 / 255.255.255.0 in the filter I get that
error.
Why could a subnet mask be invalid?

Mark

--
Irgendware Software Solutions GbR
http://www.irgendware.com

This is something to do with what is subnet mask.
If you convert an IP address to binary, you will get a 32
bit binary number. The subnet masks specifies, how many
first bits out of the 32 are used to identify the
network. These bits are then fixed,(not varying), the
remaining bits are variable to assign an IP address range.
If you want to specify a range of IP address, then you
must calculate a correct subnet mask for it. If you want
to specify only 1 IP address, put subnet mask
255.255.255.255.
(For below descirption someone correct me please if I am
wrong)
If you want to assign an IP range, convert the starting
IP address to 32 bit binary, write it down. Then convert
the last IP address to 32 bit binary write it below the
above. Then, in both the binary figures, from right side
see up to which bit there is variation. Suppox it is "x"
bit from the right. Then write a 32 bit binary number
having first 32 minus "x" "1"s and remaining "0"s.
Convert each set of 8 bits to decimal, and you will get
required subnet mask.

Sharad
>-----Original Message-----
>Hi Sharad,
>
>thanks, that option looks very good :-)
>
>But when I enter an IP-Adress and a subnet mask I get an
error "invalid
>subnetmask", but umm that computers do exist.
>
>I've got a local 192.168.0.x / 255.255.255.0 network
>
>And when I enter 192.168.0.20 / 255.255.255.0 in the
filter I get that
>error.
>Why could a subnet mask be invalid?
>
>Mark
>
>--
>Irgendware Software Solutions GbR
>http://www.irgendware.com
>
>
>.
>