block everything except some domain
-
Hi,
Sorry if the questions has already been asked but i didn't find any resource to help me.
I'm aware on Netgate products, i already sold about 30 Netgate appliance... but i have a problem with my last customers who ask me to block everything except about 20 websites for a specific range on his network.
Rest of the range have to access everything without restrictions.It's a 5100 model appliance with Pfsense+.
I have tried with Squid, it works fine a time but begin to fail within 3-4 days...
so i'd like to test pfblocker but i don't understand how it works.
Is someone have a good tutorials which explain PfBlocker ?Thank you for your help and sorry for my bad English ;)
-
@thierrym I'd create an alias (url or ip/fqdn) and input all the websites that they want people to be able to access. Then, on the firewall tab just create an allow rule for any request with a destination of the alias. Immediately under that, put a deny all to all rule. Believe that should work.
-
@gabacho4 said in block everything except some domain:
and input all the websites that they want people to be able to access. Th
thank you for your answer, i'll give it a try :)
Edit : ok but in alias section, wildcard on a domain are not possible :(
-
@ThierryM sorry. That wasn’t provided as a requirement in your first post. Given that you are only talking about 20 sites, you could just input each one as a separate entry.
Based on what I’ve seen online from some google searches you could also accomplish this by using pfblockerng and then enabling the TLD blocking feature. You’d have to host you own list (locally would make sense) but it should do what you want.
I personally would probably just go with the first option because you’re only dealing with a few sites and the latter option is, to me, more work.
-
you're right sorry for this mistakes, i just want to allow not about 20 websites but 20 domains and all subdomains. Thanx again for your answer, so i'm gonna try with pfblocker !
-
@thierrym hahaha. Oh yeah, now you’re talking about something much larger than I thought you were initially. I think the pfblockerng option is your best choice based in your clarified requirements. Shouldn’t be too bad to set up. Best of luck!