Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm network admin in educational institute , We are coming with a strategy to monitor/block unauthorized Network access such as (news/social network/entertainment...etc) from students. till now we used professional firewall service to achieve the same. On the other hand now we've decided to try some home-grown strategy to figure out the issue, so We're thinking of binding ip address and mac address of a particular station and based on that giving various access level for vagarious users (authority).

What could be advantages/disadvantages of above mentioned strategy, considering that we have around 5k different machines and we're using sub-netting to allocate ip's.

share|improve this question
You could do this by changing your DNS settings to use OpenDNS'. Once configured, you can categorically block access to certain sites. – happy_soil Sep 23 '13 at 12:53
@happy_soil we're interested in home grown solution,paid/professional service is not a option right now – user256650 Sep 23 '13 at 13:30
if you are subnetting, you will either have to host your solution on each subnet, or you will be unable to use MACs for identifying end user workstations. the MAC will be obscured by the routers connecting the subnets. – Frank Thomas Sep 23 '13 at 15:12

You could force everyone to connect through a VPN with user authentication if they are to access the internet. OpenVPN can be run on pretty-much every platform and you can set it up so that users have to log in with a username/password. You could then dynamically set up filters based on the user who has logged in.

For instance, you could have a daemon monitor the OpenVPN logs, and whenever someone connects, it would modify the filters for their IP address (also shown in the logs).

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .