How to redirect all requests to the internet from some internal clients to internal server?

In my opinion, blocking all their trsffic is a pretty effective notice.   I assume there is a help desk function for technical problems with the netsork, and that the affected people will use it.

Sounds like you need some policy work to announce terms of service, and some technical work to implement network access control technology.

BAlfson said:

An email to everyone telling them that they will be locked if your security device sees traffic from them that indicates they have a malware infection.

 Seems that this is the only solution. Too bad.
I was wondering if it would be possible to assign a different DNS-resolver to the affected clients to resolve all host names to the internal IP address hosting a notification page. But this is probably not possible either.

BAlfson said:

Using IPs instead of the MAC list runs the risk of DHCP assigning the banned IP to another user.  Using a DNAT destination of "Internet IPv4" assumes that the users aren't using the web proxy in Standard mode.  Using a manual firewall rule without the DNAT assumes that Transparent Web Filtering is not activated (see #2 in Rulz).

I always mark the affected clients as static in the IPv4 lease table, thus I believe blocking the wrong client shouldn't happen. We're afaik not using the web proxy. Thanks though for the tip about the rules, I'll double-check about the Transparent Web Filtering Issue.

DouglasFoster said:

In my opinion, blocking all their trsffic is a pretty effective notice.   I assume there is a help desk function for technical problems with the netsork, and that the affected people will use it.

Sounds like you need some policy work to announce terms of service, and some technical work to implement network access control technology.

Unfortunately your assumption is wrong. I recently had a person who set up their computer before asking me for help. As I mentioned before it's not a company network or the like, but a bunch of people living together in a community. Thus it won't work to set up policies or to technically control network access. I fear I'll have to go with information emails and hope that not too many people with false positives will ask me for help...

"I always mark the affected clients as static in the IPv4 lease table"

Be aware that static assignments are not the same as reservations in Microsoft DHCP.  In the UTM, you must make static assignments outside of the dynamic range, otherwise you risk having two devices assigned the same IP.

Cheers - Bob

BAlfson said:

Be aware that static assignments are not the same as reservations in Microsoft DHCP.  In the UTM, you must make static assignments outside of the dynamic range, otherwise you risk having two devices assigned the same IP.

Thanks for the hint. I assumed, that if I mark them as static in the IPv4 lease table, a corresponding rule is added to the DHCP server of the UTM to prevent a double assignment. If these two functions of the UTM are not coupled to each other, I'd consider this a feature request. :)

Simon

BAlfson said:

Be aware that static assignments are not the same as reservations in Microsoft DHCP.  In the UTM, you must make static assignments outside of the dynamic range, otherwise you risk having two devices assigned the same IP.

Thanks for the hint. I assumed, that if I mark them as static in the IPv4 lease table, a corresponding rule is added to the DHCP server of the UTM to prevent a double assignment. If these two functions of the UTM are not coupled to each other, I'd consider this a feature request. :)

Simon