Smoothwall - Blocking whole domains

[sippo]

So the pesky students are playing online games via websites with *.io.

 

Smoothwall/Guardian will not allow me to block all sites ending in that domain.

 

Any idea's?

[KibosJ]

We have the below in the URL patterns part of the category and it works great for us

 

[^/]+\.[i][o]($|[/])

[sippo]

We have the below in the URL patterns part of the category and it works great for us

 

[^/]+\.[i][o]($|[/])

 

So I just copy that into the blocked category?

[KibosJ]

So I just copy that into the blocked category?

 

Yes, copy that string into the URL Patterns part of the category and then block the category

[Arthur]

@sippo. There's a much simpler method of blocking whole domains.

 

Go to Guardian > Categories > A custom category (that applies to the users you want to block the domains for).

 

Under Domain/URL filtering enter the domains you want to block, but don't include the dot. e.g.

 

To block .xyz or .io enter xyz or io.

 

That's it.

Edited May 2, 2017 by Arthur
typo

[KibosJ]

@sippo. There's a much simpler method of blocking whole domains.

 

Go to Guardian > Categories > A custom category (that applies to the users you want to block the domains for).

 

Under Domain/URL filtering enter the domains you want to block, but don't include the dot. e.g.

 

To block .xyz or .io enter xyx or io.

 

That's it.

 

Well I wish I knew that would work, that's much easier

[Arthur]

that's much easier

Definitely!

 

Btw, I discovered this method in the following thread...

 

www.edugeek.net/forums/smoothwall-direct-support/165683-block-entire-domain-extensions.html

[sippo]

I don't seem to have that category...

[KibosJ]

I don't seem to have that category...

 

You'll need to create a new category and then apply it in the web filter

[Arthur]

I don't seem to have that category...

If you haven't created any of your own categories in Smoothwall you'll have create a new one (as @KibosJ mentioned) and then apply it to the relevant computers or users in the web filter (as you would with any other category or category group).

[sippo]

Thanks for this all.

 

Some unhappy kids in school now!

[supportman]

Thanks for this, very useful. We've had a load of spam email phishing links recently with a blue button going to various .host addresses.

 

Just group blocked them all with the above method so very happy

[TechMonkey]

Just so you are aware, if you just put the TLD in, no dot or wildcard, that will filter it too.

[Arthur]

Just so you are aware, if you just put the TLD in, no dot or wildcard, that will filter it too.

I mentioned that in post #5 too.

[Garacesh]

El bumpo.

 

We started doing this a while back thanks to the massive amounts of phishing emails pointing at xyz domains etc. Currently our list reads:

• xyz
  
• ru
  
• host
  
• mobi
  
• io
  
• su
  

 

No dots, no asterisks, nothing else, just those strings exactly, in the Domain/URL filtering block

 

However one of our users has had an issue downloading a file from their dropbox and Smoothwall is telling me that it's the blocked gTLD's/ccTLD's rule that's blocking it.. Except the blocked URL is https://[random].dl.dropboxusercontent.com/cd/0/get/Ad-[rand]-[rand]-[rand]-[rand]/file

 

Matched: Custom blocked content, Core Blocked Content, Blocked gTLDs and ccTLDs

Action: Block

 

Except I've checked the 'Custom blocked content' list and dropboxusercontent.com is not in there, and the full URL doesn't match anything in URL patterns block either.

 

Seeing the same with other sites that don't match the pattern too..

https://static.hotjar.com/c/hotjar-266940.js? (sv = 5)

Which I don't really care about it blocking hotjar, it still says one of the rules it's blocking it on is the blocked gTLD's rule

 

Matched: Blocked gTLDs and ccTLDs, Custom blocked content, Core Blocked Content

Action: Block

 

So it seems something is going awry with the rule.. Have I just formatted something wrong, oor..?

Edited March 29, 2019 by Garacesh

[ibpalle]

Interesting - should only match the final tld using that rule. You could try using the url patterns method listed above instead. Also, try running the policy tester for the url - might get some more info from that result.

 

Is there anything else in the Blocked gTLDs and ccTLDs category apart from domains? Anything in search or url patterns?

[Garacesh]

Is there anything else in the Blocked gTLDs and ccTLDs category apart from domains? Anything in search or url patterns?

Nope and nope. It's literally just those entries previously mentioned.

 

Weirdly, if I watch the live feed and filter by category ('cctld'), all I get is .io, .ru etc coming up. Nothing that looks like it shouldn't be blocked based on the rule.

[howartp]

If you put 'io' in a rule, won't it block biology.com for example?

[ibpalle]

If you put 'io' in a rule, won't it block biology.com for example?

 

Not if you add it to the domain/url list. That will only check against the tld, from the back.

 

So io will match

 

badserver.baddomain.io

and

baddomain.io

 

but not

 

io.ioinadomain.net