Blocking Web Sites in ISA Server

Step 5: Import Blacklist into Bad-Sites
Download the script named ImportBlacklist.vbs by clicking the 94079.zip link. Unzip the downloaded file and copy the two files it contains to your ISA Server's hard drive. (I'll explain the other file, ScheduledUpdate.bat, in a moment.)

The ImportBlacklist.vbs script imports a text file of domain names into a domain name set on ISA Server 2004 or 2006, either the Standard or Enterprise edition. Copy the porn\domains blacklist file to the folder on your ISA Server system that contains the ImportBlacklist.vbs script, then run the following command in a CMD shell (type the command all on one line) to fill your Bad-Sites list:

cscript.exe ImportBlacklist.vbs
 Bad-Sites domains 

To import domains from multiple files, merge them all together into one large file. For example, to append one file (domains1) to the end of another file (domains2), use the Type command as follows:

type domains1 >> domains2 

Alternatively, you could create multiple BadSites sets, one for each file to be imported, and add all these Bad-Sites sets to the destination in the Site_Blocker rule.

By default, the script deletes the contents of the domain name set first, then imports from the text file, so it's better to do your list management in the text file than in the domain name set itself. When the script finishes, refresh your ISA Server Management console to see the new contents of the Bad-Sites list (or close and reopen the console, which is often faster).

That's it! Now, when a user requests a file from a blocked domain, the user will get an error page instead. As long as the HTTP request is routed through ISA Server, this domain blocking works even when the user's browser isn't configured as a Web proxy client. (But it's better to configure all browsers as proxy clients.) And the performance penalty of ongoing domain blocking is relatively small because it's not regular expression pattern matching, it's just simple string comparisons against the user's requested URL. Very slick.

Step 6: Schedule Updates
Manually downloading blacklist updates and importing them into ISA Server is easy enough, but it can be tedious. Fortunately, it can be scripted. A scheduled batch script that uses a free Windows version of wget.exe (http://www.gnu.org/software/wget) can download the latest version of your favorite blacklist every week or night, then run gunzip.exe, tar.exe, and ImportBlacklist.vbs to update your ISA Server system hands-free.

Listing 1 shows a simple batch script named ScheduledUpdate.bat that performs these tasks. The script downloads a small demo blacklist from URLBlacklist.com and imports its porn list into an ISA Server domain name set named Bad-Sites using the ImportBlacklist.vbs script. In real life, you'll need to edit this script to download the full blacklist for which you've paid and to perform error-checking, logging, and/or administrator notification. Use the Scheduled Tasks applet in Control Panel to schedule the script.

Updating your blacklist is important because new bad sites are found every week. Scheduling this work is important because of the time it takes to import very large lists. On a server with a single 2.2GHz Pentium 4 CPU, for example, it takes less than 10 minutes to import 100,000 domains from a blacklist file, but that same machine requires three hours to import 500,000 domains. And during the import process, the CPU will be pegged at 100 percent. So, schedule the blacklist updates for off-peak hours, and run the ImportBlacklist.vbs script with the \belownormal option (as the last line of Listing 1 shows) to use a lower multitasking priority. Other ISA Server processes will have an easier time getting CPU cycles.

Note that you'll have to allow ISA Server HTTP access to the Internet for the batch script to run. Following the procedure in Step 3, create a rule that gives ISA Server access only to the blacklist download site. Set the source network to Local Host and the destination URL to the location of the blacklist to be downloaded.

Importing blacklists for domain blocking is just one example of ISA Server's scriptability. You can find lots of other scripts at sites such as http://www.isatools.org, http://www.isaserver.bm, and http://www.isascripts.org (my site), and Microsoft has an ISA Server software development kit (SDK) if you want to write your own. Using blacklists and scripts as we've done here won't be as scalable or full-featured as using a commercial content filter, but if you're on a budget, it might be good enough.

SOLUTION STEPS:

1. Use ISA Server.
2. Create a domain name set.
3. Create a blocking rule.
4. Download a blacklist.
5. Import blacklist into Bad-Sites domain name set.
6. Schedule updates.