Question about restricting Internet access

[Lufkin]

My friend asked me if it was possible to set up a computer with an internet connection, but only for email use. In other words he wants to be able to send email, but he wants to cut off all internet surfing capabilities (to prevent employees from bumping around on the web all day (or after hours)). What is the best method to achieve this?

I know that you can restrict Internet access through Internet Explorer, but I wouldn't want someone to be able to install a new browser to circumvent the Internet blocking. Is there a way to shut it off at the services level and password protect it? Any suggestions would be greatly appreciated.

--edit--
Sorry, these would be windows 2000 machines

 

[Kelemvor]

I would think you could do it through the router by shutting off certain ports and things like that. Not sure how to differentiate email from Web though. Hopefully someone else that knows for sure will pop in shortly.

 

[Wizkid]

Block all ports (outgoing) except 25 (SMTP) and 110 (POP3) at the router.

 

[Lufkin]

Thanks for the responses. I apologize for not mentioning this in my original post. These will be individual computers at restaurants across east texas and louisiana. Each computer will connect with its own dial-up account (without a router). Basically the only reason for the internet access at all is to email sales numbers (in Excel) to one location. Can you shut off ports via management console(s) in windows 2k?

Also would a program like iProtectYou work?

 

[JeffMD]

yea youll need a software program on the computer to do this. A) find a fire wall that has a password lock out, B) install and setup the firewall with admin access,blocking all ports but the ones you want open. C) have all users logon with limited access, enough to run the programs, but the person wouldnt have access to do things like delete any files which could be used to disable the firewall.