Set it up with no DNS (like static to 127.0.0.1) and add the "legal" sites in the hosts file? That's pretty basic and if your user (a kid, perhaps?) is inventive they could easily go around it through a proxy, but then again they could probably do that with just about any firewall... -- poptones