0

I want to block all traffic to and from my network to a particular domain. Apparently, this is not possible in Windows, with either a HOSTS file or using firewall rules: the HOSTS file requires every sub-domain to be listed separately, there is no wildcard feature to just cover all of them (why?); and the Windows firewall rules work by IP address, not domain name.

My home office router/firewall is consumer-grade and gives a feature that's supposed to block traffic for certain "keywords"... but it doesn't work at all for https connections because it can't "see" the entire address. Which I think is ridiculous, because it can see the domain name, which is what I want to block.

Anyway - I can't seem to get a straight answer from searching because there's so much noise around this question - if I take a step up in router quality, get a commercial one, will I start to see more useful network management features, like being able to block a domain and all its sub-domains? Can I also prevent machines on the network from taking an end-run around these rules by resolving IP addresses by other means?

Improve this question
3
  • Depending on your requirements (and the technical skills of the people on your network), you might also need to block access to VPN services, for example, which may allow for access to the blocked domain.
    – Matthew
    Nov 2, 2017 at 13:32
  • I am aware of DD-WRT/OpenWRT but found conflicting and confusing information for hardware compatibility. I hate saying this because I am in IT, but I want it to "just work", without having to waste two months of weekends fighting obscure issues and troubleshooting using poor, non-existent, or out-of-date documentation. Yes - sorry, but that is my impression of open source.
    – PJ7
    Nov 2, 2017 at 13:34
  • What's the hold of listing them in the host file since you have them anyway ?
    – Overmind
    Nov 2, 2017 at 13:40

1 Answer 1

Reset to default
2

There are a few options for a home office:

  1. upgrade the router to one with the desired features (high monetary cost)
  2. run your own DNS server internally (high labour cost)
  3. upgrade your existing router to DD-WRT/OpenWRT or alternate firmware (moderate labour cost)
  4. offload the issue to a 3rd party, like a DNS provider, such as OpenDNS (small labour cost to configure your router, free for home use)

Can you prevent direct IP connection? That's another problem entirely. Short answer is 'no'. Long answer is 'yes', but then you are looking at more equipment, technology, and configurations/costs. None of the options here are reasonable for home use.

Improve this answer
5
  • #4 seems reasonable for home use actually
    – PJ7
    Nov 2, 2017 at 13:47
  • 1
    Note that this only works if the devices use the DNS server you specify - if they use another one, they'll be able to access the site still.
    – Matthew
    Nov 2, 2017 at 14:04
  • @Matthew that's right - but you can also do things like blocking DNS requests out using firewall rules, etc. I was not going to go into all the configuration options and workarounds for each option.
    – schroeder ♦
    Nov 2, 2017 at 14:44
  • If they haven't, I'd suggest blocking all traffic originating outside the home network. Generally nothing should reach into a home network. That's not really relevant to the question, but it's still a good idea.
    – baldPrussian
    Nov 2, 2017 at 20:56
  • And a separate comment that's more relevant: some firewalls let you block *.[domain].[tld]
    – baldPrussian
    Nov 2, 2017 at 20:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .