From UntangleWiki

Untangle Server User's Guide

Web Filter

Other Links: Web Filter Description Page Web Filter Screenshots Web Filter Forums Web Filter FAQs

---

Contents 1 About Web Filter 2 Blocking Web Content for Specific Websites 3 Unblocking Web Content for Specific Websites 4 Blocking/Unblocking Delays by Category/URL-based Filters 4.1 Blocks Based on Category 4.2 Blocks Based on a Specific URL 5 Unblocking Web Content for Specific Users 6 Allowing Users to Bypass Webpages 7 Blocking Web Content by MIME Type 8 Blocking Web Content by File Type 9 About Web Filter Event Log 10 Related Topics 11 Web Filter FAQs 11.1 How does Web Filter work? 11.2 Can I install Untangle on a single computer to use as Parental Control software? 11.3 Can I unblock websites that are appropriate for my business but are listed in inappropriate content categories? 11.4 Why do category or URL-based blocks/unblocks not go into effect immediately? 11.5 My users complained that they cannot connect to somesite.com, and it keeps showing up in my Event Log as blocked. How can I stop somesite.com from being blocked? 11.6 Why am I not getting all of the content for a web site on my Pass List? 11.7 Can I grant privileged access to some users while still blocking sites for everyone else? 11.8 We run a hotel, where employees are not permitted to browse to inappropriate content yet guests using a public Internet terminal are not restricted. How can we handle this situation? 11.9 Can I create time based policies to let user access personal sites during lunch? 11.10 Can Untangle Web Filter help me block video and music file formats? 11.11 Can Untangle Web Filter help me protect my network from potentially malicious file types like executables? 11.12 Why block both MIME Type and File Types? 11.13 Does Untangle Web Filter block IM, peer-2-peer, or gaming protocols like World of Warcraft? 11.14 What Kind of Reporting Does Untangle Offer? 11.15 Does Untangle Use Blocklists? 11.16 Can I block all web sites except certain ones?

About Web Filter

Web Filter filters web traffic to your protected network for inappropriate content. Unlike other Software Products, the criteria that Web Filter uses is subjective. Web Filter blocks content by the following:

• Categories (for example, Gambling)
• URLs
• MIME Types
• File Types

Top

Blocking Web Content for Specific Websites

The default Block List blocks most undesirable content based on subject matter or categories. You also have the option to add specific websites, using the following procedure.

Note: If you want to improve the overall product by contributing domain names or URLs that you feel should be blocked by default, check out the Web Filter Submission Tool.

1. From Web Filter, click the Block Lists tab.
   

   Figure, Blocking by Subject Matter
2. Click the Edit Sites button.
3. In the table, click the add (+) button to the left of the table.
4. In the new entry, add the URL that you want to block.
5. Click the Save button.

Tip: If you want to temporarily unblock this website later, deselect the block check box.

Top

Unblocking Web Content for Specific Websites

If your organization deems a specific website to be useful and that website is being blocked because of its content or category, or you no longer want to block a website that you specifically blocked, you can unblock it with the following steps:

1. From Web Filter, click the Pass Lists tab.
2. In the Sites area, click the manage list button.
3. In the table, do one of the following:
• If the URL that you want to unblock appears in the table, select the pass check box for that URL.
• If you need to add a new URL, click the add (+) button to the left of the table, and in the new entry, add the URL that you want to unblock.
4. Click the Save button.

1. From Web Filter, click the Block Lists tab.
2. In the Sites area, click the manage list button.
3. In the table, locate an existing URL that you want to unblock, and clear the block check box, or simply delete the row.
4. Click the Save button.

Top

Blocking/Unblocking Delays by Category/URL-based Filters

Whenever the status of a block changes, there are associated delays before the change is visible.

Blocks Based on Category

Category blocking is driven by a database that is part of the Untangle system. The database is downloaded and initialized when the system is created, and is updated whenever the Untangle administrator requests that a category change status from blocked to unblocked (or vice versa). Additionally, this occurs every six hours. This assures that your category database is up to date at all times. This change causes the database contents to be deleted and reloaded from scratch, resulting in a delay of approximately five minutes before requested changes take effect. In future releases, only database changes will be downloaded and installed, so changes will be instantaneous.

Blocks Based on a Specific URL

When a specific URL is added or removed from either the Block List or Pass List, there are also delays. These are related to the "lifespan" of a web page (as defined by the web server which transmits the page), and the cache settings of the user's browser. You have no control over the page lifespan, but your browser may allow you to shorten and/or eliminate the use of browser caching. If your browser cannot use the cache, it cannot load a copy of the requested page from its cache, so blocks would immediately occur. Also, testing a block on a web page that is currently loaded causes confusion (unless caching is turned off) because the page will still load.

[[#top|Top]

---

--Hamdan 07:12, 23 January 2010 (PST)

Unblocking Web Content for Specific Users

If you only have a few users that need to bypass web filter controls, consider using pass lists, not a separate virtual rack.

Before You Begin: Assign the user a static IP address. If the Untangle Server is your router, go to Assigning Network Computers Static IP Addresses.

1. From Web Filter, click the Pass Lists tab, and click the manage list button.
2. In the table, select the add (+) button. A new row appears.
3. In the IP address/range text box, specify the computer IP address and subnet mask of user that you want to be exempt from the web filter.
4. Click the Save button.

Top

Allowing Users to Bypass Webpages

Some organizations may wish to allow certain users to bypass the Web Filter. This option is available under "User Bypass."

If User Bypass is set to None no users will be allowed to bypass the block page. If User Bypass is set to Temporary users will be allowed to bypass the block page. If User Bypass is set to Permanent and Global then users will be allowed to bypass the block page and bypassed sites will be added to the permanent global pass list.

User Bypass is best when combined with Policy Manager so that only certain users are allowed to bypass.

1. From Web Filter, click the Block Lists tab
2. Under User Bypass choose None, Temporary, or Permanent and Global
3. Click the Save button.

Top

Blocking Web Content by MIME Type

1. From Web Filter, click the Block Lists tab, and click the MIME Types tab.
2. In the table, do one of the following:
• If the MIME type that you want to block appears in the table, select the block check box for that MIME type.
• If you need to add a new MIME type, click the add (+) button to the left of the table, and in the new entry, add the MIME type that you want to block.
3. Click the Save button.

Top

Blocking Web Content by File Type

1. From Web Filter, click the Block Lists tab.
2. In the File Types area, click the manage lists button.
3. In the table, do one of the following:
• If the file type that you want to block already appears in the table, select the block or log check box or both.
• If you want to block a file type that isn't in the list, click the add (+) button to the left of the table, then specify the file type that you want to block.
4. Click the Save button.

Top

About Web Filter Event Log

Use the following terms and definitions to understand the Web Filter Event Log:

timestamp	The time the event took place.
action	The action which the Untangle Server took on the web request.
client	IP address of the client who made the request.
request	A description of the request made (e.g. http://someurl/somepath.html).
reason for action	The reason the action was taken.
server	The server IP Address. The server is the computer that receives the request.

Top

Related Topics

• About Limiting Network Congestion
• ESoft Web Filter

Top

Web Filter FAQs

How does Web Filter work?

Untangle Web Filter transparently scans HTTP traffic in order to block or log specific activity. Websites can be blocked or logged based on content category (porn, gambling, social networking, etc.), specific url (MySpace, YouTube, ESPN, etc.), MIME Type or File Types (.exe, .mp3, .avi, etc..)

Can I install Untangle on a single computer to use as Parental Control software?

No. You cannot install Untangle on a single computer to use as Parental Control software. Installing Untangle will wipe out your existing operating system and all files on your hard drive. It can only be used as a Gateway to implement Parental Control or Web Filtering on connected client computer(s).

For a single PC, other Internet filter/Parental Control software can be used.

Can I unblock websites that are appropriate for my business but are listed in inappropriate content categories?

Yes, any website can be placed on a “Pass List” by URL to override blocklisting when it is also in a content category “Block List.” This is particularly useful in industries like healthcare where legitimate medical or drug-related research could require access to sites that have been miscategorized in category block lists (usually pornography or drug content).

Why do category or URL-based blocks/unblocks not go into effect immediately?

Whenever the status of a block changes, there are associated delays before the change is visible. Details about the delays are as follows:

• Blocks Based on Category
• Blocks Based on a Specific URL

My users complained that they cannot connect to somesite.com, and it keeps showing up in my Event Log as blocked. How can I stop somesite.com from being blocked?

You can add a rule to the Pass List for somesite.com, as described in Blocking Web Content for Specific Websites.

Why am I not getting all of the content for a web site on my Pass List?

It's common for a web site to display links, banners and content from other web sites as part of their web pages. There are two easy methods to re-integrate the content while maintaining your access controls.

METHOD #1 (preferred)

1. Access the Web Content Control Event Log, and either Refresh the list or set it to Auto-Refresh.
2. In your browser, access the web site that has missing content -or- the page on that web site that is missing content.
3. Check the Web Content Control Event Log again, and refresh if necessary. Web sites whose content is missing will be shown at the top of the list.
4. Access the Web Content Control Pass List, and add the URL(s) that appeared in the event log. Remember to click Save.
5. Access the web site (or the specific page) again. The content should now be present.

METHOD #2

1. In your browser, access the web site that has missing content -or- the page on that web site that is missing content.
2. Right-click in your browser and select View Source in Internet Explorer or View Page Source in Firefox. PLEASE NOTE that the source of the web page may be very lengthy and/or difficult to read. ALSO, embedded Java, Flash, Shockwave may pull content from elsewhere and those sites will not be available to be listed as part of the page source.
3. Access the Web Content Control Pass List, and add URL(s) that appeared in page source. Remember to click Save.
4. Access the web site (or the specific page) again. The content will hopefully be present.

Can I grant privileged access to some users while still blocking sites for everyone else?

Yes, individual policies can be created for adminstrators, executives or any other user that requires unique Internet access to complete their job.

We run a hotel, where employees are not permitted to browse to inappropriate content yet guests using a public Internet terminal are not restricted. How can we handle this situation?

Configure the web filter policies as you would for employees. Then, create a pass list to exempt guests. For more information, go to Unblocking Web Content for Specific Users.

Can I create time based policies to let user access personal sites during lunch?

Yes, policies can be created to allow access to blocked sites such as webmail or social networking during break or off-peak network usage hours.

Can Untangle Web Filter help me block video and music file formats?

Yes, Untangle Web Filter can block numerous types of file format including audio and video files such as mp3, wmf, wav, avi, mpg and mov.

Can Untangle Web Filter help me protect my network from potentially malicious file types like executables?

Yes, Untangle Web Filter can block numerous file types including executables such as exe, ocx, bin, dll, cab, bin, and com.

Why block both MIME Type and File Types?

In an ideal world, both pieces of information would always be present for every web request. However, some sites use incorrect content types or extensions. Also, the behavior of operating systems (Windows vs. Mac) is different when given only file extension or content type. To be safe, both lists should be used.

Does Untangle Web Filter block IM, peer-2-peer, or gaming protocols like World of Warcraft?

Untangle Web Filter does not block protocols that can “hop ports.” However, Protocol Control, another module that runs the Untangle platform, does block “port hopping” traffic and comes preconfigured with dozens of signatures that block popular IM clients, games like World Warcraft and peer-2-peer applications like BitTorrent.

What Kind of Reporting Does Untangle Offer?

Untangle Web Filter provides network and user based reporting. The reports show high level trends like peak network usage hours and also drill-down into user level incidents for activity monitoring.

Does Untangle Use Blocklists?

Yes, Untangle uses Urlblacklist.com. However, we have found that false positives make these blocklists insufficient on their own. Thus, we manually inspect all blocklists before updating Untangle content categories.

Can I block all web sites except certain ones?

Yes, simply block all categories (including "Uncategorized"). Then add whatever sites you'd like to pass to the pass list. Beware that the complex nature of the web and the fact that many applications communicate over http can make this approach difficult.