Block internet but not Email?

[Siginet]

I have been asked to block the internet on certain user accounts on one of the networks I maintain. But they should still be able to use their email. What would be the best routes to do this? Is there a good 3rd party utility for network admins to use to perform things like this?

Thanks

[jondercik]

Depends where the mail server is. If it is on the same network as them, just remove the default gateway from the machine.

[iCEhOT]

Think u could probably do that with group policy for the users on ur AD. Though i think what they actually meant rather than internet, is internet explorer so the web - Run gpedit.msc then goto Windows Settings -> Security Settings -> Software Restriction Policies

[Albuquerque]

If you're using IE as your default browser, we did this thru Group Policy...

Create a "false proxy" in the internet settings. If you need your clients to access internal websites but not external ones, then enter your domain name into the exception list (do not use proxy for these addresses)

Doesn't work if your client installs a 3rd party browser though. Depending on the email system you use, you could likely block port 80 by way of a software firewall.

[chilifrei64]

here is the article I used for one of my clients

http://www.petri.co.il/block_web_browsing_with_ipsec.htm

you can apply it using group policies.. just follow the link near the bottom and it will show you how to apply it with GP