I have a router and switch in my institute. The switch is connected 15 PCs in a lab. With little effort, how can i block social sites, video buffering and
torrentz.eu downloading? Please suggest a sound method.
the most simple way to do that is proxy server with black list include all sits you try to block , but to be onest with you in such environment any small solution could be hacked by the users. may you need to invest little bit in some sort of small business firewall. regardless product recognition i just try fortigate 60C in such environment and it is working properly.
You can sometimes block ports to block various protocols such as port 80 and 443 to block web access, however this won't work if the programs you are trying to block are designed to try other ports. You can also try blocking source address ranges, but this will fail if the target has hundreds to thousands of servers like Google, or uses a general purpose distributed cloud computing service like Amazon Web Services.
Some programs like BitTorrent will be nearly impossible to block using simple port blocking. Also it is very common for people to use web proxies to get around basic port-based firewalling. The more dedicated geeks will set up their home computer to relay a private data stream to them from inside your network. You have little to no hope of blocking this with simple port or address based rules.
If you want to be serious about it, you need to do deep packet inspection, which takes a look at the data packets, and tries to figure out what they are for. This is not simply an HTTP proxy, as it can inspect and block any protocol on any port, and it is able to analyze and block encrypted HTTPS.
Many companies now make filtering appliances that can do this, acting either as your primary router or inserted between an existing router and your users operating in what's called transparent mode filtering, where it has no IP address and silently accesses all VLANs passing through it. A third ethernet port is used for device management in transparent mode.
It snoops every connection attempt, tries to figure out what it is for, and will either silently block unwanted data or send people a warning rather than the content they were trying to access. Logging of each client's activity and category-based content blocking may also be supported.
Currently I'm using an iBoss Pro in transparent mode, but there many companies with other similar filtering appliances. Previously we used an M86 / TrustWave R3000 with no issues.
Most routers these days support web filtering. If your router supports that you can setup rules to filter certain websites.
You can also Open DNS which can filter sites based on content categories and you don't have to manually add the list of websites that you want to block.
There are several other methods like modifying the hosts file on the machines (can be easily bypassed), but Open DNS would be a better solution.