How to Control Internal Users\' Access to the Internet via Firewall

User Requirements
In this example, the user with IP address 192.168.16.2 is allowed to access only www.baidu.com during business hours (Monday to Friday, 9:00 to 18:00), and is blocked from accessing any Internet services during rest periods.
 
Configuration Steps
 
Go to Security > Address Group > Address Group Settings page to create an address group. In this example, as the group only contains a single address, you need to set both Start Address and End Address to 192.168.16.2.
 
Go to Security > Service Group > Service Group Settings page to create a service group. The following figure shows the detailed settings. Select DNS from the Service Type drop-down list, and then add baidu.com to the Service Members list, lastly click the Save button.
 
 
Go to Security > Schedule > Schedule Settings page to create a schedule. The following figure shows the detailed settings.
 
Go to Security > Firewall > ACL Settings page to create two access control rules.
 
The first rule is used to allow the user to access www.baidu.com during business hours. The following figure shows the detailed settings. Therein, the schedule, address group and service group you just created are referenced by the rule.
 
 
The second rule is used to block the user from accessing any Internet services. The following figure shows the detailed settings. Therein, the Action is Deny, the address group you just created is referenced by the rule.
 
 
Note
1.The access control rules are matched in the order in which they are listed. After a match is found, no further rules will be checked.
2.After you configure access control rules, do not forget to select the Enable Access Controlcheck box to make the rules take effect.