Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Blocking certain websites To Certain IPs/Mac address on internal network

    Scheduled Pinned Locked Moved General pfSense Questions
    4 Posts 2 Posters 561 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      Keeks
      last edited by

      I have tried to search about, but obviously I either don't understand to can't quite find what I am looking for.....and just looking to see how this can be done in pfsense

      Is is possible to block/restrict access for Certain IPs (or by MAC address) on my internal network to external websites? i.e youtube etc

      if so how can it be done?

      I see thsi in the forums but it is quite old....is it still relevant or is there a better way?

      https://forum.netgate.com/topic/58223/blocking-access-to-certain-web-sites-for-certain-users/2?_=1671369806142

      1 Reply Last reply Reply Quote 0
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        Mmm, you can do that using Squid/Squidguard directly but you would need to enable SSL interception mode to get most of that working as expected and that means some client side config.

        How many groups of IPs/users?

        You can use DNS filtering for some users whilst allowing all traffic for others by passing them and external DNS server directly. That's only really practical for two groups though.

        Steve

        1 Reply Last reply Reply Quote 1
        • K
          Keeks
          last edited by

          Thanks Steve

          Can you point me in the direction of some light reading on DNS filtering setup.....

          This is for a home setup and I think at most 2 groups would be needed....Those with full access and those with restricted access (and possibly to move users between the two groups from time to time).

          I will have a look at Squid/Squid guard also.....

          1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            You would probably want to use the DNS blacklist feature in pfBlocker to filter requests made against the resolver in pfSense.
            By default pfSense will pass it's own interface IP to use for DNS via DHCP to clients. You can also force clients to use that rather than something hardcoded:
            https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html

            You would then add clients you want to be unfiltered as static dhcp leases and set a different DNS server for them to use.

            Steve

            1 Reply Last reply Reply Quote 0
            • First post
              Last post
            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.