voital wrote:How can I restrict the internet access by proxy only.
Don't grant users the right to use NAT service (if you don't need it for other purposes).
P.S. For the users to be able to use NAT access to Internet they need to have correct settings of DNS and default gateway. Just don't set them up.