RansNet devices support URL filtering based on DNS blacklist/whitelist, and allows administrator to configure list of domains or FQDN to permit or deny. We can configure a list via CLI, or integrate with RansNet cloud DNS for category based URL filtering. 

There are several ways to filter URLs accesses:

1. Use DNS reject/resolve features. This is the simplest and most effective way for URL filtering and logging. In this method, mbox acts as a DNS proxy server, intercepts client DNS requests, and determines if the requested destination DNS resolution should be denied (reject) or permitted (resolve). It works well for both http and https websites.

2. Use firewall object-group with FQDN. This requires setting up object-group to include a list of Fully Qualified Domain Name (FQDN), and use firewall-access/deny rules to permit/deny access to the destination.

3. Use cloud DNS for category based DNS filter. RansNet cloud DNS records a total of more than 100 million websites and groups them into different categories, so that we can easily choose to permit/deny URL accesses by categories. This simple option requires the on-premise device to point to RansNet DNS server as upstream name-server, then administrator can login to DNS filtering dashboard to configure filtering policies. There's a small subscription cost for this option, but it is an ideal balance between costs and functionality for most SME enterprises. We will cover this feature in a separate document.

NOTE: 

• After apply config, please wait for a few seconds before testing. 

• If the testing PC accessed/tested the URL before, please clear browser cache and reboot your testing PC (flush off DNS cache) before trying

• DNS filtering may not be effective for some modern browsers which use DNS-over-HTTPS (DoH). To verify if the router blacklisting/whitelisting works, use nslookup command in your command prompt. To disable DoH in chrome, 

DNS Blacklisting

URL blacklisting is basically to deny/disallow DNS requests for some URLs only and permit everything else. To achieve URL blacklisting, we simply need to configure DNS reject for this target domain. DNS reject is an extension of our DNS rewrite feature to "spoof" target domain/URL DNS resolution to a fake IP 0.0.0.0 (therefore denied). All other DNS requests are passed to upstream name-server for normal resolution (default permitted).

CONFIGURATION STEPS

1. Configure upstream DNS name-server (usually ISP name servers or the famous google name servers, 8.8.8.8 and 8.8.4.4)

2. Configure firewall rules to force intercept user DNS traffic.

3. Configure DNS reject to deny target domains/URLs.

NOTE: if we define a domain here, the sub-domain URLs will also be blocked. For example, if we block yahoo.com, all other subdomain URLs (eg. xxx.yahoo.com) will be blocked. If you just want to block a specific subdomain URL only, please configure a Fully Qualified Domain Name (FQDN).

4. Enable URL logging. 

   • The URL logging here is really DNS query logging. By default, mbox logs all DNS query requests. Because each URL access request triggers a DNS request first, so DNS query logging is a good equivalent to URL logging (without the full URI details of course).

   • Then we configure mbox to be a log client sending query logs to a log collector for reporting, either external log server or log locally (HSG only).

CONFIGURATION EXAMPLES

In this configuration guide, we configure HSG  for DNS filtering and also use it  as a syslog server.

Verify the configuration by trying to connect to the blocked sites and other non-blocked sites. You will not be able to browse the sites in the blocked list and should have no problem accessing to other sites.

DNS whitelisting

URL whitelisting is "opposite" to blacklisting. Basically, you want to allow certain URL access only, and everything else should be blocked. To achieve this objective, we will use a combination of DNS reject and resolve features. Because mbox by default permits all DNS requests. So the approach is to deny first, and only resolve the permitted target ones.

• DNS reject denies DNS requests. So we simply need to configure "ip host . reject" to deny all.

• DNS resolve permits the target domains/URLs by telling mbox to resolve these domains/URLs normally through upstream name-server.

CONFIGURATION STEPS

1. Configure upstream DNS name-server (usually ISP name servers or the famous google name servers, 8.8.8.8 and 8.8.4.4)

2. Configure firewall rules to force intercept user DNS traffic. Since now mbox is working as a DNS server for users, we need to intercept all users DNS queries and determine allow or disallow

3. Configure DNS/URL rewrite to deny all others (just put a . to denote all)

4. Configure DNS/URL resolve to permit target domains/URLs only

NOTE: if we define a domain here, the sub-domain URLs will also be blocked. For example, if we block yahoo.com, all other subdomain URLs (eg. xxx.yahoo.com) will be blocked. If you just want to block a particular URL only, try to be as specific as possible 

CONFIGURATION EXAMPLES

In the config example, we will permit facebook, whatsapp and some google services only, and deny everything else. Below shows a snip of the config.

As you can see from above, configuring whitelisting is a lot harder than blacklisting, because some sites or services require more than one domains. Eg. accessing to facebook will require permitting several domains and FQDN.

• In actual deployment, for some well-known services, you can google search what are the domains you must whitelist in order to permit their access

• However, if some intended domain/URL access is still denied, it's because not all the related/embedded domains are permitted (denied by mbox). You can use tcpdump to sniff on the LAN interface to find out what are the additional associated/linked domains you need to permit. 

Try to be "specific" with tcpdump so that you don't get overwhelmed with the amount of output in a live network. In below example, we use tcpdump to find out DNS (udp/53) resolution results only for user source IP 192.168.1.252 (your testing PC IP), so that we can find out which sites (DNS requests) are blocked (DNS returned 0.0.0.0). Then we can add them to resolve list if they're meant to be permitted.