Can I restrict a single computer to a single website?

bwoolley

I need to block access to all websites except for one specific site, but this restriction is only needed on one computer. Can a Web Content Filter profile be applied to just one client?

PeterUK

Currently there is no On site reputation filter allow list only
https://community.zyxel.com/en/discussion/31412/on-site-reputation-filter-allow-list-only
or a way to do Web Content Filter allow list only from what I can tell as it meant to be a block Filter on Content to then allow exceptions.

Some thing I have been doing that you can do if you make this one client by fixed IP or DHCP IP MAC binding is WILDCARD FQDN depending on the firewall model your using Currently you can do like *grc.com or grc.com and *.grc.com and make a group list of these WILDCARD FQDN so that you can make a policy control rule to block from LAN to WAN source IP of client then a from LAN to WAN source IP allow rule for DNS NTP and anything else then a from LAN to WAN source IP allow rule for HTTPS and the destination WILDCARD FQDN group.

Now when the client does DNS in the clear (not encrypted) the USG will see the DNS and add IP's to the WILDCARD FQDN to then allow under the rule

Note that some sites have 3rd party links and if you don't allow them the browsing can be slow

PeterUK

delete

PeterUK

delete

Zyxel_Judy

Hi @bwoolley ,

As requested, the following example demonstrates how to restrict a single computer to access only one specific website, while allowing all other computers on the network to browse freely.

Scenario:

• LAN 1, Subnet 192.168.1.0/24 can access all websites
• 192.168.1.100 (Client A) is restricted to www.zyxel.com only

Solution:

Go to Configuration > Security Policy > Policy Control and add the following rules in the exact order listed:

Rule	From	To	Source	Destination	Action
Rule 1	LAN1	WAN	192.168.1.100	www.zyxel.com	Allow
Rule 2	LAN1	WAN	192.168.1.1 – 192.168.1.99	Any	Allow
Rule 3	LAN1	WAN	192.168.1.101 – 192.168.1.254	Any	Allow
Rule 4	LAN1	WAN	192.168.1.0/24	Any	Deny

Before configuring the rules, go to Configuration > Object > Address/GeoIP > Address to create the address objects required for the rules above.

Note: Ensure that Client A (192.168.1.100) is assigned a static IP address so that the policy is applied consistently.