Blocking certain websites To Certain IPs/Mac address on internal network

[Keeks]

I have tried to search about, but obviously I either don't understand to can't quite find what I am looking for.....and just looking to see how this can be done in pfsense

Is is possible to block/restrict access for Certain IPs (or by MAC address) on my internal network to external websites? i.e youtube etc

if so how can it be done?

I see thsi in the forums but it is quite old....is it still relevant or is there a better way?

https://forum.netgate.com/topic/58223/blocking-access-to-certain-web-sites-for-certain-users/2?_=1671369806142

[stephenw10]

Mmm, you can do that using Squid/Squidguard directly but you would need to enable SSL interception mode to get most of that working as expected and that means some client side config.

How many groups of IPs/users?

You can use DNS filtering for some users whilst allowing all traffic for others by passing them and external DNS server directly. That's only really practical for two groups though.

Steve

[Keeks]

Thanks Steve

Can you point me in the direction of some light reading on DNS filtering setup.....

This is for a home setup and I think at most 2 groups would be needed....Those with full access and those with restricted access (and possibly to move users between the two groups from time to time).

I will have a look at Squid/Squid guard also.....

[stephenw10]

You would probably want to use the DNS blacklist feature in pfBlocker to filter requests made against the resolver in pfSense.
By default pfSense will pass it's own interface IP to use for DNS via DHCP to clients. You can also force clients to use that rather than something hardcoded:
https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html

You would then add clients you want to be unfiltered as static dhcp leases and set a different DNS server for them to use.

Steve