Web filtering

Web filtering, under Security in the device menu, blocks domains at the gateway's DNS resolver, per network. The guest VLAN and the office can have different policies.

What this does and does not do

Blocking happens in DNS: nothing is decrypted and no certificate is installed on clients. A device configured with its own resolver, or using DNS-over-HTTPS, is not affected. Treat it as a policy control, not an enforcement boundary. To enforce it, add a firewall rule that stops clients reaching outside resolvers directly.

Turning it on

Tick Enable web filtering. With it off, the gateway resolves normally and no policy applies.

Upstream resolvers

Queries that are not blocked go to the Upstream resolvers. Click Edit, then + Add resolver and enter an address (e.g. 9.9.9.9), and Save. Leave the list empty to keep the system's resolvers; the page then says Using the system's resolvers.

Policies

Each policy is a named set of blocked domains, allowed domains, and the networks it applies to.

1. Click + Add policy.
2. Fill in:
   • Name — must be unique
   • Description
   • Blocked — one domain per line
   • Allowed — one domain per line. Allowed wins over blocked: block example.com and still allow docs.example.com.
   • Networks — one CIDR per line. Leave empty to apply to every client.
3. Click Save.

The table shows a policy without networks as applying to all clients. Edit on a row opens Edit policy; Delete asks Delete this policy?

The form refuses entries that cannot work: {value} is not a domain name, {value} needs a prefix, e.g. 10.20.0.0/24, and a policy with this name already exists.

Size limit

The page shows how many domains are listed and how much of the gateway's configuration size limit they use: {domains} domains listed · configuration is {kib} KiB of the {max} KiB a gateway can receive. A configuration over the limit cannot be applied. Shorten a blocklist or split it across policies.

Changes follow the usual Apply Changes / Confirm cycle.