Web filtering

Block adult content, gambling, social networks and filter bypass for the devices on a network, with forced safe search.

Web filtering blocks categories of websites and apps for the devices on one network, by DNS: gate42 answers 0.0.0.0 for the names on the category lists, so a blocked site cannot be reached. Malicious sites are blocked on every network anyway (protection).

Set it up

1. Go to Services › Web filtering and click +.
2. Network: the network to filter, such as LAN. gate42 filters the devices by their address on that network. (The WAN is never filtered.)
3. Policy:

1. Stop DNS bypass (ticked): keep it ticked, or devices can get around the filter (below).
2. Force safe search (ticked): Google, Bing and DuckDuckGo show only safe results, and YouTube runs in its moderate Restricted Mode, even if a user switches it off.
3. Always allow: domains this network may always reach, even when a list blocks them, such as linkedin.com for a marketing team. A domain also allows its subdomains.
4. Save, then Apply. The first Apply downloads the lists and can take a minute or two.

Add an entry for each network that needs filtering; each network can have its own policy. The lists are updated every day.

What a user sees

A blocked site shows as "This site can't be reached". There is no "blocked by policy" page: a browser cannot show one for an HTTPS site unless the firewall decrypts the traffic, which gate42 does not do.

Stop DNS bypass

Without it, a device could ask another DNS server and get around the filter. With it ticked, gate42:

• answers DNS queries the network's devices send to any other server itself (with the filter);
• refuses DNS over TLS (port 853);
• refuses HTTPS to the public DNS-over-HTTPS servers (about 1,700 addresses, updated daily), and the Office and Strict lists block their names too.

Check it

From a device on the filtered network:

nslookup facebook.com        # Office and Strict: 0.0.0.0
nslookup example.com         # a real address
nslookup www.google.com      # with safe search: Google's SafeSearch address, 216.239.38.120

Memory

Office and Strict use large lists (about 600,000 names): give gate42 4 GB of memory for them. On a firewall with less than 3.5 GB, gate42 uses a smaller gambling list.

What it cannot do

Web filtering works on names, as most firewalls do without decrypting traffic. It does not see page content, and a site opened by its IP address, or through a VPN service the lists do not know, is not filtered this way. To block applications by what they send, see Block applications.

Need a policy of your own, or filtering per user? Padmini Systems can set it up.