Cisco router : Blocking HTTP/HTTPS port on specific clients

[chaube97]

My router is Cisco 2911 and there are some PCs that i wish them to be completely shut off from accessing any website.

Is it possible to block traffic for HTTP/HTTPS ports on specific clients ( Specific Mac addresses )

PS. I attempted to do this on my firewall, but the limitations of my network infrastructure made it impossible.

Thank you

[MHM Cisco World]

ip access-list standard 10
 permit host x.x.x.x 
 Deny any any
ip http access-class 10

[Richard Burts]

We do not know much about your environment and that makes it difficult to give good advice. In general we can say that blocking certain clients from websites requires layer 3 logic. So blocking by mac address won't work. If these clients have static IP addresses you could use an extended access list to block web site access. But if they learn addresses dynamically extended acl is not an option. Could you create a new vlan/new subnet and put these clients into the new subnet? If so you can configure an acl on that router interface to block web sites.

[Georg Pauwen]

Hello,

you want to block (anything) as close to the source as possible. If you have Windows clients, you can configure an outbound rule in Windows Defender that blocks port 80 and port 443, effectively prohibiting access to the Internet for these clients...

The link below shows how to block a program, simply select 'Port' and block 80 and 443...

https://wethegeek.com/block-internet-access-for-a-program-in-windows-10/

[paul driver]

Hello

---

@chaube97 wrote:

My router is Cisco 2911 and there are some PCs that i wish them to be completely shut off from accessing any website.

---

You have numerous options however this can depend on your topology, so can you elaborate a little please?

• Do you mean to deny access to both intranet & internet web access?
• Are your performing any Network Translation?
• You mention a FW where is this within your network pertaining to your hosts?
• Can you post s simple topology diagram

[Leo Laohoo]

Can you please elaborate further?  Why MAC address only? 
Are you trying to block certain users from accessing the internet?  If this is the objective then blocking MAC addresses is of no use because a user can move to different machines.  
If the objective of this exercise is to block certain users from accessing the internet then this can easily be done with MS AD.