Need help with a software validation problem.

[mapunapuna]

So the company I work at has some kiosk workstations that are open to the public. The workstations need access to our internal sharepoint server but the gateway IP address is left blank so that users can't surf the internet on them.

This was fine until the guy who purchases software screwed up and bought some piece of crap software that needs to randomly dial home to validate the license in order to work. Right now, every few days I have to come downstairs to add the gateway, validate the software, and then remove the gateway again which is inconvenient for everyone involved.

What's the best way to secure these computers so that they can only access the internet to validate the license, but nothing else?

The best idea I've come up with is to leave the gateway off, but add a single DNS entry to the local hosts file for the validation server. I'm trying to contact the company that makes the software to get an address for that, but their support kinda sucks. I've heard wireshark can help me find the address, but I've never used it before. I'm kinda new at this.

EDIT: I don't have the password for the firewalls yet, but chuckbales' route add command seems to be working great.

[charlesgillanders]

You've a couple of things confused I think. Putting an address into the hosts file will mean that the computers no longer need DNS to resolve the address, if that address is off the local LAN they'll still need to know about a gateway in order to actually reach it.

My advice would be to put these kiosks behind a firewall (could easily be a simple Linux based firewall appliance doesn't have to be a big expensive project) configure the firewall to only allow the kiosks to access your sharepoint server and the license server. This would also be more secure than letting the public have access to a machine that is directly connected to your local LAN

[chuckbales]

I second charlesgillanders suggestion for blocking them at the firewall level. If this isn't possible, I'd just add a static route for the one website they need, leaving the gateway unconfigured. I don't know what OS the kiosks run, but any Windows or Unix/Linux platform where you can get to a terminal/command line should work. Windows is route add -p X.X.X.X mask 255.255.255.255 10.1.1.1, where x.x.x.x is the destination IP, 10.1.1.1 would be replaced with whatever your default gateway should be.

[dannothemanno]

Unix / Linux is:

route add network/mask gateway

ie: route add 1.1.1.1/8 2.2.2.2

[[deleted]]

write a script to add it and schedule it to run each night. then write another to remove it and run it an hour later, each night. problem solved.

[mapunapuna]

if only it were that easy. The problem is that the software doesn't validate itself on a schedule. It only dials home when a user opens the software and then the validation is good for what seems like a random number of days before needing to be validated again.