Blocking Internet Access for a User Group with an ATP700

Jeanbaptiste

Hello everyone,

I would like to know if an ATP700 firewall is capable of blocking internet access for an Active Directory user group. Specifically, I want to remove internet access for administrator accounts.

If it is possible, how can I configure the security rule? My firewall is properly connected to LDAP and correctly recognizes the group in question, but I’m unsure about the next steps…

Thank you in advance for your help!

Ratsnackbar

Because you have Active Directory available to you, what you might want to consider is to deploy custom Windows Firewall rules using Group Policy which blocks your internal subnets from communicating with external subnets and apply it only to the administrator accounts at login.

Example of how to configure the firewall rule:

https://geekoverdose.wordpress.com/2020/06/21/windows-firewall-rule-to-block-internet-but-allow-lan/

Example of how to deploy the rule using GPO's:

https://learn.microsoft.com/en-us/windows/security/operating-system-security/network-security/windows-firewall/configure

I realize that does not answer your question in the way you'd asked it but I believe it will give you the results you want with better overall control.

Ratsnackbar

Woops, sorry forgot the last link which shows how to deploy it with GPO's. Here you go:

https://www.blumira.com/blog/windows-firewall-with-gpos

Jeanbaptiste

Hello,
Thank you for your contribution.
The Windows firewall is managed by the antivirus, but it does not allow for the implementation of group policies affecting AD users.

Zyxel_Kay

Hi @Jeanbaptiste

To do this, you’ll need to create an "ext-group-user" object for the specific group you want to restrict, and then set up a security policy to block that object.

For more detailed guidance, you can check out a related discussion here

https://community.zyxel.com/en/discussion/comment/13564#Comment_13564