Just had a lightbulb moment.

We may be able to use IPSEC:
  • Block all source addresses unless the destination is one of our public addresses.
  • Allow all traffic when the source address is one of out internal addresses.


This would have the effect of allowing unrestricted access when the PC is on one of our intranets. When the PC is on a foreign network only our public sites will be allowed.

Hmmm... possibilities here...