URL filtering (manual)

URL blacklisting is basically to deny/disallow certain URL accesses only and permit everything else. To achieve URL blacklisting, we simply need to configure DNS reject for this target domain. DNS reject is an extension of our DNS rewrite feature to "spoof" target domain/URL DNS resolution to a fake IP 0.0.0.0, therefore denied.

All other DNS requests are passed to upstream name-server for normal resolution (therefore permitted).

CONFIGURATION STEPS

1. Configure upstream DNS name-server (usually ISP name servers or the famous google name servers, 8.8.8.8 and 8.8.4.4)

2. Configure firewall rules to force intercept user DNS traffic. Since now mbox is working as a DNS server for users, we need to intercept all users DNS queries and determine allow or disallow

3. Configure DNS/URL reject to deny target domains/URLs.

NOTE: if we define a domain here, the sub-domain URLs will also be blocked. For example, if we block yahoo.com, all other subdomain URLs (eg. xxx.yahoo.com) will be blocked. If you just want to block a particular URL only, try to be as specific as possible 

4. Enable URL logging. 

   • The URL logging here is really DNS query logging. By default, mbox logs all DNS query requests. Because each URL access request triggers a DNS request first, so DNS query logging is a good equivalent to URL logging (without the full URI details of course).

   • Then we configure mbox to be a log client sending query logs to a log collector for reporting, either external log server or log locally (HSG only).

CONFIGURATION EXAMPLES

In this configuration guide, we configure HSG  for DNS filtering and also use it  as a syslog server. Refer to this section for details on mbox logging.

Once above is configured, connect your PC to the LAN port (either to eth1 or to a switch connected to eth1). Verify the configuration by trying to connect to the blocked sites and other non-blocked sites. You will not be able to browse the sites in the blocked list and should have no problem accessing to other sites. For HSG, login to mbox GUI, check live logs, you will see the URL live logs.

URL whitelisting is "opposite" to blacklisting. Basically, you want to allow certain URL access only, and everything else should be blocked. To achieve this objective, we will use a combination of mbox DNS reject and resolve features. 

• DNS reject denies DNS requests. So we simply need to configure "ip host . reject" to deny all.

• DNS resolve permits the target domains/URLs by telling mbox to resolve these domains/URLs normally through upstream name-server.

CONFIGURATION STEPS

1. Configure upstream DNS name-server (usually ISP name servers or the famous google name servers, 8.8.8.8 and 8.8.4.4)

2. Configure firewall rules to force intercept user DNS traffic. Since now mbox is working as a DNS server for users, we need to intercept all users DNS queries and determine allow or disallow

3. Configure DNS/URL rewrite to deny all others (just put a . to denote all)

4. Configure DNS/URL resolve to permit target domains/URLs only

NOTE: if we define a domain here, the sub-domain URLs will also be blocked. For example, if we block yahoo.com, all other subdomain URLs (eg. xxx.yahoo.com) will be blocked. If you just want to block a particular URL only, try to be as specific as possible 

CONFIGURATION EXAMPLES

In the config example, we will permit facebook, whatsapp and some google services only, and deny everything else. Below shows a snip of the config.

As you can see from above, configuring whitelisting is a lot harder than blacklisting, because some sites or services require more than one domains. Eg. accessing to facebook will require permitting several domains.

• In actual deployment, for some well-known services, you can google search what are the domains you must whitelist in order to permit their access

• However, if some intended domain/URL access is still denied, it's because not all the related/embedded domains are permitted (denied by mbox). You can use tcpdump to sniff on the LAN interface to find out what are the additional associated/linked domains you need to permit. 

Try to be "specific" with tcpdump so that you don't get overwhelmed with the amount of output in a live network. In below example, we use tcpdump to find out DNS (udp/53) resolution results only for user source IP 192.168.1.252 (your testing PC IP), so that we can find out which sites (DNS requests) are blocked (DNS returned 0.0.0.0). Then we can add them to resolve list if they're meant to be permitted.