Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I want to restrict access to all websites outside of a list of allowed domains. (localhost, superuser.com, stackoverflow.com, etc.) I would like this to be applied system-wide and to be browser agnostic.

How do I set this up?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

These things can be done,

  1. Setup the firewall to restrict to you domain list for outbound connections
    • this will prevent all outbound communications the restricted set
      besides the usual inbound restrictions that a firewall is usually configured for
  2. Check your router/modem for filter support
    • the same firewall trick, but at the network device rather than the machine
      this is sometimes more effective
  3. Use OpenDNS filtering capabilities
    • I could not quickly lookup a scheme to allow a set
      Though, there are ways to block specific sets
  4. If you have a set of machines in your network that needs this control,
    a proxy (like Squid) could also be setup for filtering access.
    This would be more effort (another squid running machine required in the path)
    The overhead will be amortized if you have several machines to control.

HowToGeek OpenDNS reference.

HowToForge Squid Proxy Server On Ubuntu 9.04 Server
with DansGuardian, ClamAV, And WPAD (Proxy Auto-Detection).


A host-based firewall should work.
Unfortunately, the Windows XP firewall does not support outbound filtering.

The firewall software in Windows XP was simple and rudimentary and protected incoming traffic only, blocking any inbound connections that had not been initiated by your computer - and it was turned off by default. Service Pack 2 turned it on by default and made it possible for administrators to enable it via Group Policy.

But, other firewalls will probably allow you to control outbound connections.
Typically, I have seen application based control (rather than port or domain based) in Windows based firewall tools. However, there may be other forms (here is a quick reference to some Windows free and trial firewall apps). Others may have more information on this.

If the users do not need administrative rights,
setting up that way will not allow them to change your configurations.
Any third-party application will probably also prohibit configuration changes by non admin users.

share|improve this answer
Here comes the interesting part, the computers are laptops, and are going to be used on not only my local network, but also on other public networks. The idea being that the Admin sets' the restrictions, and the user abides by those restrictions. –  Mark Tomlin Nov 3 '09 at 5:14
It would be nice is the windows firewall could be setup to do this or a 3rd party firewall that I can hide within the svchost.exe processes. Also the firewall it's self must not be editable by the plain user account, only by the admin account. But I think making it's processes apart of svchost would take care of that. –  Mark Tomlin Nov 3 '09 at 5:22
Sorry, I can't give you the up vote, but your edit is accepted as the answer. Thank you. I'll look more deeply into the subject via the links you've provided. –  Mark Tomlin Nov 3 '09 at 15:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.