Block websites by category, for example adult content, for every device on your network. People who open a blocked site see a clear block page with your organisation's name, instead of an error. Nothing has to be installed or set up on the devices to block them; installing one certificate only makes the block page appear on HTTPS sites too.

At a glance:

How it works

1. A device asks the firewall's DNS for a site's address.
2. If the site is in a blocked category for that device's network, the firewall answers with its block address instead of the real one.
3. The browser connects to the block address, and the firewall shows the block page.

The block address is chosen by the firewall: an address outside all your networks that exists only on the firewall itself. You never enter it, and it does not change when your LAN or internet addresses change. In a failover pair it works on whichever firewall is active.

Devices must use the firewall as their DNS server. With Korthveil's DHCP server, they do automatically. To stop devices from going around it, DNS resolver › Interception › Redirect clients' DNS (port 53) to the firewall sends every DNS query to the firewall, and the web filter turns off the browsers' own encrypted DNS (Firefox and iCloud Private Relay are told to use the network's DNS).

Step 1: Turn on the DNS resolver

The web filter decides and the firewall's DNS enforces. If Network › DNS resolver is not on yet, the web filter page shows a link: turn it on, save and commit (see DNS filtering).

Step 2: Turn on web filtering

1. Security › Web filtering.
2. The first time, the page is filled in for you: - UT1 category lists on, with adult and mixed_adult; - the rule Block adult content for your internal networks (not the internet side); - Safe search on for Google, Bing and DuckDuckGo, and YouTube restricted (moderate); - the block page with the automatic block address.
3. Press Save to pending changes, then commit.
4. The firewall downloads the lists, about 4.6 million adult sites, in a few minutes. Lists and activity shows the progress and then ready.

Step 3: Choose more categories (optional)

Under Category lists, every category is listed with its description: gambling, violence, drugs, malware, phishing, social networks, games, dating, and many more. Tick the ones you want, or Select all. Then add them to a rule under Policy:

• Block: the site is blocked.
• Warn: the block page says the site may not be appropriate and offers Continue, for the time you set (60 minutes by default).
• Allow: an exception, for example for one network.

Rules apply per zone (network). Never filter these domains lists sites that are always allowed.

Step 4: Make the block page yours

Block page:

• Organisation: your company or family name, at the top.
• Heading: empty shows This site is blocked.
• Accent colour and Logo (PNG, JPEG or WebP, up to 256 KB).
• Message: for example why sites are filtered.
• Contact: the help desk's e-mail or phone number.

Press Preview (or Preview warning) to see the page before you save.

Advanced lets you set a fixed block address, the port, the zones that reach the page, or your own HTML template. The template gets the site, category, client, user, time, a reference number for the help desk, and your texts; it cannot load anything from other sites.

Step 5: The block page on HTTPS sites

Almost every site uses HTTPS. A browser only shows a page for an HTTPS address if it trusts the certificate. Without the firewall's certificate, a blocked HTTPS site shows the browser's own warning (Your connection is not private); the site is still blocked.

To see the block page instead, install the firewall's web filter certificate on each device once:

1. Security › Web filtering › Block page › Download the certificate (korthveil-web-filter-ca.crt). From a phone on your network, the block page itself also offers it: open any blocked http:// address and follow Install the certificate.
2. Install it: - Windows: double-click the file, Install Certificate, Local Machine, Place all certificates in the following store, Trusted Root Certification Authorities, Finish. - macOS: double-click the file (Keychain Access opens), choose the System keychain, then double-click the certificate, Trust, When using this certificate: Always Trust. - iPhone and iPad: open the file, Settings › Profile Downloaded › Install, then Settings › General › About › Certificate Trust Settings, turn on Korthveil Web Filter CA. - Android: Settings › Security › Encryption & credentials › Install a certificate › CA certificate, choose the file. - Firefox uses its own list: Settings › Privacy & Security › Certificates › View Certificates › Authorities › Import, tick Trust this CA to identify websites.

The firewall uses the certificate only for sites it blocks. Everything else goes directly to the real site and is never decrypted. The certificate's private key never leaves the firewall. In a failover pair, each firewall has its own certificate: install both.

Check it

• Check a site: enter an address (and optionally a device's address) to see what the policy decides and why.
• Recent blocks: the latest blocked and warned sites, with the device and the category.
• On a device, open a site in a blocked category: the block page appears.

Troubleshooting