[Work Problem] Website Whitelist at router level?

[crielly]

Hi AT

I have a work problem that I am hoping you fine folks can help me solve.
Background:
I work at an electronics retailer, at one of the smaller branches. The company I work for does not take data security or network infrastructure at all seriously. I am not an IT pro, I am a stock guy who is just trying to solve an issue nobody else really cares about...so bear with me.

Essentially, at my store, everything is lumped together on one big ad-hoc network of supreme shitty configuration-ness. We have staff "workstations", a server in the back room, and a couple of other miscellaneous purpose PCs for other tasks. On this same network, we have our service centre and all the computers that we service on the same network (including ones we do virus removal on...sigh. Only reason I bring my ultrabook in and use it on this network is because it is the only Linux based machine, so I figure I have a reasonable chance of avoiding the computer STDs)

I can't really do anything about the above mentioned clusterfrak as I am not really empowered to make my employer give a damn about security or ethical handling of customers' valuable hardware and data...but I have a potentially fixable problem with our display model computers. We have a bunch of laptops and a few desktops out that customers can use, and those are connected to our network so that they have internet access. The problem is that the purpose for that is so that they can browse our website - in practice, we get treated like an internet cafe. People come in and download stuff, access social networks, even try to use P2P. I'd like to put a stop to that, since it is introducing a very random factor into the data that travels over our network.

It gets better though: if I were setting this up from the get go, I'd just use an activedirectory domain and set up group policy restrictions for this stuff - but our setup is nowhere near that sophisticated. Since we still need access to outside websites on our workstations, I can't just block everything but our commercial website. I can't edit host files on the display models because we sell them and our sales guys can easily forget to undo such a modification.

I THINK I have a solution:
1) Set up static IPs on the workstations that I don't want filtered
2) set up white list for all computers on the lan that don't fall inside the IP range used for step 1
3) Profit?

Assuming for a minute that none of you know an easier way - our router is a Linksys WRT54g - poking around in the settings, I figured out how to blacklist specific sites, but there is no function to block everything and then add exceptions. There is, however, shell access. Is this possible to do?

Thanks in advance for your help!

 

[VirtualLarry]

Do they take credit cards electronically? That sounds like an IT disaster waiting to happen, and potentially a PCI compliance issue too.

 

[GobBluth]

Seems like you should be able to use local policy to increase your internet security then add trusted sites. Again, would have to be undone if the machine was sold. What you're describing keeps me up at night (network security professional here...). Businesses that blatantly disregard security are asking for it. You seem to know a thing or two (or have good google skills) considering you said you work in stock. That said, take it up your chain and tell them how stupid it is to offer customers unrestricted internet access inside your business.

Hopefully a boss somewhere up the chain will realize the error of their ways and pay something to sure things up around there. Good on you for having the due-diligence to think about these things.

Anyhoo, yeah. gpedit.msc --> Admin Templates --> Windows Comp --> Internet Exp --> Internet Control Panel --> Security Page --> Go nuts!!

 

[Lithium381]

If you can get between the network and the internet you could put a free Linux based firewall in there called "Untangled" that has URL filtering, P2P filtering, antivirus and andtispam, ad blockers and other such things. . . for free! They have paid services too, but their free solution is pretty good for the price! THere is even a generic captive portal where you can make users agree to terms, etc. . . .

 

[crielly]

Do they take credit cards electronically? That sounds like an IT disaster waiting to happen, and potentially a PCI compliance issue too.

Yes and yes it is. Drives me nuts, but nobody cares and for the moment at least I need the work! ><

 

[crielly]

@Lithium - I wish I could get between the internet and all the machines using it like that - exactly what I'd do if I were designing the setup from the ground up. I'd love to install a linux box with samba and set it up as a domain controller so we could simply impose these restrictions remotely and remove the problem entirely. Sadly, any meddling with the existing setup is "politically" dicey.

@Gob - I think that is what I will have to do. Technically we are supposed to perform a factory reset on any display/demo unit we sell, though not for this reason - so perhaps I should just modify the local policy settings as you described and ensure that said policy is actually enforced. Problem of course is that it takes time and retail customers are not exactly renowned for their patience, even up here in the great polite north.

Trust me, I am in no way a network/data security professional - but this stuff bothers me a lot. It isn't only the liability aspect of it - we should treat our customers with enough respect to make sure we aren't exposing them and their data to theft/destruction by virus/whatever else comes in through our network (the wireless is, by the way, WPA secured with 9 digit easily dictionary-attack-breakable password and the SSID is broadcast). My father is CTO at a software company that specializes in remote asset management and he has worked on various advanced networking platforms/projects, and I grew up with my own PC on an NT domain...so while I am no expert, I know a shitty setup when I see it ><

</vent>
Thanks for the help guys