The best I can come up with is to use the DNSforwader and put in all the 
domains you can think of, using wildcards.  (msn.com microsoft.com 
google.com yahoo.com cnn.com)  Put an IP outside the firewall. (even if it 
can't be reached.  Just trying to go outside will trigger CP.