How to Block All Websites Except ZipGrade Using pfSense / pfBlockerNG?

[invoker]

I’m looking for some guidance on configuring pfSense to restrict internet access on a specific network/VLAN.

My goal is to:

Block access to all websites/internet browsing by default.
Allow only ZipGrade and any domains/services that ZipGrade requires to function properly.
If possible, manage this using pfBlockerNG together with pfSense firewall rules.
Make sure users cannot easily bypass the restriction by accessing websites through different domains, IP addresses, or DNS.
Still allow the required DNS/NTP or other essential services needed for the clients to operate normally.

What would be the recommended way to accomplish this?

Would it be better to use an allowlist in pfBlockerNG, firewall aliases/rules, DNSBL, or a combination of these?

I would also appreciate advice on how to identify all domains/CDNs/API endpoints used by ZipGrade, since I understand that simply allowing zipgrade.com may not be enough if the application relies on additional services.

If anyone has implemented a similar “deny all, allow only selected websites/apps” setup on pfSense, I’d appreciate seeing your recommended firewall rule order or configuration.

Thank you!

[stephenw10]

You might be able to use an ASN if ZipGrade have one/some and maintain them. Better they might maintain an IP or domain list that can be fetched directly and allowed.

But unfortunately that is rare to see. Worth checking for first though.