and these online proxies are many, you cannot block all of theme

hhhhhh, but still there is a way to access facebook even with all of these precaution and setting, online proxy browser, this way you cannot do anything

and if they don't know my proxy setting they will contact me so that i will know who try to bypass the company policies and then i will make for them a good report with the manager hhhhhh

by doing this portable browser cannot access the web unless they enter proxy setting (of the proxy), so they will be obliged to pass through the proxy, otherwise they cannot access the web

yes you are right, thank you very much for your help and willingness to share your knowledge

yes, now i understand your wise sentence, proxy by itself cannot do the job except with the collaboration of the firewall rules

yes, i will open all ports except 80 and 443 for all destination, and for those 2 ports i should forward them only to the proxy IP

i just test it right now, but it has affected other ports like outlook, now i cannot sent and receive mails,

aahh i see what you mean Mr Scott, i should block all traffic except for outbound traffic going to my proxy server

firewall rules can block traffic based on IPs, not URLs

pfSense is firewall and proxy,
so what will be the role of the firewall in this scenario, he will block what exactly ???

the problem is proxy server can easily bypassed by portable application like firefox, this is the problem

@scottalanmiller sorry Sir, what do you mean by : it can be bypassed simply by using IP addresses ????

if i block those website by using IP subnet, this may not be efficient because IP subnets used by those website are changing and big in number

me also, i use pfSense as proxy server, the problem is : recently i discover that on of the users access Facebook by using Firefox Portable Application, because firefox don't use proxy setting of the system, so i'm looking of some way to block those websites in the system level,

hi everybody

actually i want to know the efficiency of using host file to block some website like facebook and youtube, is it a reliable method or not, i mean that : does users can bypass this host file or not, knowing that we are in a windows domain (limited users cannot edit their host file)

thank you very much

do you have FTP destination??? if so just setup an FTP service on your windows server, and give to your printer the ip address, just leave username and password empty, for me i have sharp printer and FTP server, i created some ftp destination, and the scanned document are sent without any issue to my ftp server

yes of course we have to be careful, i don't mean by having multiple GPO to have so many of them to the extent that having a slow login, but having a reasonable number of them and not having only one, for example 6 principle GPO that contain the main policies, and rename each GPO with a name that combine the roles of this GPO, like :
"set proxy setting and prevent users from changing it"
these are 2 policies but do the same purpose, so you know what this policy do

@technobabble also make sure that you create GPO for each policy, i mean don't set all your policies in a single GPO, each policy in a separate GPO, so if you want to remove a specific policy you will not have to remove all policies that reside in the same GPO, rather you will remove GPO that have only one policy,

it is a better practice to create OU for computers and OU for users, this separation will help you in dealing with computer and user configuration, then create and link group policy to your OUs, you will get a nice AD structure