3

I have a friend who owns a coffee shop and he has a public network. He asked me for a way to prevent the customers from visiting any web site that present a potential threat to the admin (websites that has either sexual content or any kind of extremism). How can I block such sites?

  • 2
    Pay someone to maintain it, including managing the legal issues of operating such points. You don't want this mess on your hands. – Trotski94 Oct 4 '16 at 10:53
  • 2
    @JamesTrotter, that is a very sensible alternative - you should put that in as another answer. – Julian Knight Oct 4 '16 at 12:25
3

What you need is a web filter. This creates the ability to inspect the traffic and filter it depending on the destination.

Note that, unlike the other answer, this does not need any SSL interception since all you are doing is reviewing the IP names and addresses.

Typically, you will use a product that uses dynamically updated block lists, generally grouped so that you can disable access to whole categories such as gambling very easily.

There are many products that will do this at different price points. One example is Sophos UTM though that is most likely overkill for your needs as it is an enterprise tool. Trend and most of the other recognised security vendors all have web filtering tools available.


If you want something quick and dirty, you can also switch your DNS service to use OpenDNS. OpenDNS also provides dynamically updated web filter lists but they work simply by preventing an IP Address lookup so it is possible to bypass the restrictions - generally by users manually setting their own DNS servers.

  • You can only see the IP/Domain in question. What do you do for sites hosted on free webhosting for example? Sophos UTM for example, is able to do real content scanning with SSL interception, but you need to get the end user to install the Root CA first. – sebastian nielsen Oct 4 '16 at 13:12
  • 2
    I really doubt this is necessary. You are only trying to demonstrate that you have taken "reasonable" precautions to protect both clients and your assets. SSL interception would open up a whole load of new issues that you simply don't need to deal with and is overly complex and costly. – Julian Knight Oct 4 '16 at 13:24
1

You can block inappropriate websites using OpenDNS Familyshield service to configure which websites can/cannot be seen on your network

  • That does not "prevent" since it can easily be worked around by users setting a different DNS server. In addition, FamilyShield is the simple home version. You just need to register your network with OpenDNS to get full access to the block lists. – Julian Knight Oct 4 '16 at 12:19
-4

I would suggest using a so called SSL Interception proxy. To get the user to install the CA Root certificate, its possible to use a captive portal, to force the end user to install the CA Root to gain internet access.

This is how to do it: first, you have a portal page. This portal page must use a VALID certificate. This portal page, lets call it captive.yourdomain.tld , have a valid certificate that is issued by a valid CA already in trust.

On this portal page, you have instructions how to download the .cer CA certificate and how to import it in browser.

Now, from captive.yourdomain.tld, you set HSTS with subDomains activated.

Then, you have a 1x1 iframe, that is loaded from, lets say validate.captive.yourdomain.tld . This validate.captive.yourdomain.tld uses a server certificate that is signed by your CA Proxy Interception certificate. This validate.captive.yourdomain.tld page also have a form, that auto-submits (using a javascript) valid credentials to access the WLAN network. Best option here is to use TOTP codes or something, to prevent people from bypassing it.

If you want, you could have a terms of service page instead, but the "I Agree" button is inside said TOTP form behind Iframe (instead of a javascript auto-submit, then the iframe needs to be slightly larger). If the user hasn't installed the Root CA, the "I Agree" button won't load, and the user is unable to agree to the terms.

The result is a captive portal, that REQUIRES installing a CA root certificate in the browser to gain internet access at all. Since the page is bootstrapped with a real certificate, user will be prevented access (by HSTS no user recourse block page) if the validate.captive.yourdomain.tld fails to validate, which it would if you haven't imported the CA root.

The user does not need to authenticate to the captive portal, it happens automatically provided you have imported the CA root.

Here is a video how it looks: https://www.youtube.com/watch?v=5OXbfnG-hdg (But it can be implemented on any captive portal device tha allows a custom authentication page to be uploaded)


Then when you have done this, you can use any proxy in-between with this SSL interception proxy to filter content by keywords, URL or whatever you see fit.

  • 3
    Wouldn't that (at least theoretically) allow the coffeeshop to see all content? Even encrypted communication with your bank, logins, etc. Even when not 100% sure of that anyone slughtly computer literate would just deny the certificate and then complain when things do not work. – Hennes Oct 4 '16 at 11:16
  • @Hennes : Thats why there should be step-for-step instructions. And there will be no certificate popup, either the certificate is installed and then user is automatically redirected and given access, or the certificate is not installed, and then nothing will happen. And yes, the coffeeshop will see all content. But thats the only way to implement viable filtering. If the user don't want the coffeshop to see all content, user should not use the network. And the traffic is still secured from client to coffeshop, so a illegit user cannot snoop on the wireless signals to read the SSL content. – sebastian nielsen Oct 4 '16 at 11:30
  • 2
    This is not what the OP asked for. Nor is it necessary. All that is needed is a simple web filter. – Julian Knight Oct 4 '16 at 12:18
  • 1
    The URL is visible always as it is the address. This is sufficient for by far the majority of checks you need to make. The best (e.g. most expensive) products are capable of doing dynamic risk scores and these are done outside your network. So personal websites can be marked as untrusted or not depending on your risk appetite and circumstances. Cheaper products still maintain lists and categorisations of millions of sites and will be more than enough for most casual use. – Julian Knight Oct 4 '16 at 13:20
  • 1
    You can even get these lists for your own use. For example, someone maintains a really good filter list for the Ubiquity EdgeRouter Lite that I use. It would be perfectly acceptable to use that in most small cafe environments. – Julian Knight Oct 4 '16 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.