# URL filter issue **URL:** \ **Category:** Web Proxy, URL Filter & Update Accelerator\ **Created:** [6 February 2020 09:41 UTC](https://community.ipfire.org/t/url-filter-issue/1161 "2020-02-06T09:41:18Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![ziko](https://community.ipfire.org/user_avatar/community.ipfire.org/ziko/32/268_2.png) [@ziko](https://community.ipfire.org/u/ziko)\ **Post date:** [6 February 2020 09:41 UTC](https://community.ipfire.org/t/url-filter-issue/1161/1 "2020-02-06T09:41:18Z")
Hello. On URL filter page checked (for example: porn). When user goes directly to porn web site on web browser by typing [websitename.com](http://websitename.com) server blocks it but when user searched on web browser (for sample: porn site ) and clicks to any result links web site is opens. How can we block content permanently? ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [6 February 2020 10:28 UTC](https://community.ipfire.org/t/url-filter-issue/1161/2 "2020-02-06T10:28:15Z")
Maybe the search delivers the https URL. This can be blocked by non-transparent proxy only. ---
**Author:** ![arne\_f](https://community.ipfire.org/user_avatar/community.ipfire.org/arne_f/32/12760_2.png) [@arne\_f](https://community.ipfire.org/u/arne_f)\ **Post date:** [6 February 2020 11:30 UTC](https://community.ipfire.org/t/url-filter-issue/1161/3 "2020-02-06T11:30:05Z")
For clarificaton: The transparent / non-transparent setting has no influence of https connections. For https filtering with the proxy the browser need to be configured to use the proxy. To force the user to do this you should block the direct way. ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [6 February 2020 11:37 UTC](https://community.ipfire.org/t/url-filter-issue/1161/4 "2020-02-06T11:37:46Z")
Arne, you described it very exactly. But forcing clients to use the proxy is equivalent to non-transparent mode, IMHO. ---
**Author:** ![xperimental](https://community.ipfire.org/user_avatar/community.ipfire.org/xperimental/32/16702_2.png) [@xperimental](https://community.ipfire.org/u/xperimental)\ **Post date:** [6 February 2020 11:46 UTC](https://community.ipfire.org/t/url-filter-issue/1161/5 "2020-02-06T11:46:48Z")
Arne is right - you don’t need to - but it’s as you’ve said equivalent to non-transparent operation so there is no need to run transparent anymore. ---
**Author:** ![ziko](https://community.ipfire.org/user_avatar/community.ipfire.org/ziko/32/268_2.png) [@ziko](https://community.ipfire.org/u/ziko)\ **Post date:** [6 February 2020 13:19 UTC](https://community.ipfire.org/t/url-filter-issue/1161/6 "2020-02-06T13:19:18Z")
Thank you very much for hint. I checked this. Search delivers the https URL that’s why web site opens. ---
**Author:** ![ziko](https://community.ipfire.org/user_avatar/community.ipfire.org/ziko/32/268_2.png) [@ziko](https://community.ipfire.org/u/ziko)\ **Post date:** [6 February 2020 13:20 UTC](https://community.ipfire.org/t/url-filter-issue/1161/7 "2020-02-06T13:20:20Z")
Do I have to reconfigure every computer for blocking? There is no other option for blocking from server? ---
**Author:** ![xperimental](https://community.ipfire.org/user_avatar/community.ipfire.org/xperimental/32/16702_2.png) [@xperimental](https://community.ipfire.org/u/xperimental)\ **Post date:** [6 February 2020 13:27 UTC](https://community.ipfire.org/t/url-filter-issue/1161/8 "2020-02-06T13:27:11Z")
Yes because you have to make sure that all clients use the proxy server. That’s why you need firewall rules that block http + https, too. If you don’t configure the clients to use the proxy and don’t have that firewall rules the clients may resolve the server IP somehow else while you don’t have a clue of it at all. ---
**Author:** ![beli3ver](https://community.ipfire.org/user_avatar/community.ipfire.org/beli3ver/32/3367_2.png) [@beli3ver](https://community.ipfire.org/u/beli3ver)\ **Post date:** [4 July 2020 09:19 UTC](https://community.ipfire.org/t/url-filter-issue/1161/9 "2020-07-04T09:19:37Z")
Let me get this right, I block HTTP and HTTPS from green everywhere and only allow the port for the proxy to force users to use the proxy, is that understood correctly by me? ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [4 July 2020 09:51 UTC](https://community.ipfire.org/t/url-filter-issue/1161/10 "2020-07-04T09:51:13Z")
Yes! URLFilter is a proxy ‘addon’. To work effectively, all web traffic must go through the proxy. For HTTPS URL filtering works on basis of the unresolved URL. Did not look into the lists, whether also IPs of sites to block are contained. EDIT: just made a little test. /var/ipfire/urlfilter/blacklists/tracker/domains contains IPs. Thus I suspect, this is true for the other lists also. ---
**Author:** ![beli3ver](https://community.ipfire.org/user_avatar/community.ipfire.org/beli3ver/32/3367_2.png) [@beli3ver](https://community.ipfire.org/u/beli3ver)\ **Post date:** [4 July 2020 10:08 UTC](https://community.ipfire.org/t/url-filter-issue/1161/11 "2020-07-04T10:08:14Z")
I found a better way. Are use a script to integrate in unbound directly Filter list for different categories. And I foresee clients to use my DNS so ever seen works perfectly now and I don’t use a proxy any more ---
**Author:** ![bbitsch](https://community.ipfire.org/user_avatar/community.ipfire.org/bbitsch/32/7420_2.png) [@bbitsch](https://community.ipfire.org/u/bbitsch)\ **Post date:** [4 July 2020 10:30 UTC](https://community.ipfire.org/t/url-filter-issue/1161/12 "2020-07-04T10:30:35Z")
That’s another approach. But you also have to force your clients to use IPFire. Integration into the DNS server however doesn’t catch all accesses by IP, which should be blocked. ---
**Author:** ![beli3ver](https://community.ipfire.org/user_avatar/community.ipfire.org/beli3ver/32/3367_2.png) [@beli3ver](https://community.ipfire.org/u/beli3ver)\ **Post date:** [4 July 2020 10:46 UTC](https://community.ipfire.org/t/url-filter-issue/1161/13 "2020-07-04T10:46:27Z")
That’s true but The ipfire the only way to the Internet. I disallow to change the DNS With GPO’s so they have no other choice ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [4 July 2020 12:04 UTC](https://community.ipfire.org/t/url-filter-issue/1161/14 "2020-07-04T12:04:57Z")
Hi, > Are use a script to integrate in unbound directly Filter list for different categories. with regards to DNSSEC, you want to avoid this since there is no way of telling (from the clitent’s perspective) whether the DNS resolver tampers with certain queries or an attacker is modifying them. DNS-based filtering is what PiHole does - it works, it sells (unfortunately), but it really is not sexy. Forcing clients to use IPFire’s proxy works - I run several IPFire machines for several years using this setup -, except for (mobile or proprietary) applications which are not capable of using HTTP proxies. Thanks, and best regards, Peter Müller ---
**Author:** ![beli3ver](https://community.ipfire.org/user_avatar/community.ipfire.org/beli3ver/32/3367_2.png) [@beli3ver](https://community.ipfire.org/u/beli3ver)\ **Post date:** [4 July 2020 12:16 UTC](https://community.ipfire.org/t/url-filter-issue/1161/15 "2020-07-04T12:16:36Z")
I know it’s not a clean solution. But I need for the office network it easy and clean way to Block IPs and domains A lot of people visiting some bad sites like porn and we have a lot of malware the network I should only block the sites not more ---
**Author:** ![pmueller](https://community.ipfire.org/user_avatar/community.ipfire.org/pmueller/32/9019_2.png) [@pmueller](https://community.ipfire.org/u/pmueller)\ **Post date:** [4 July 2020 12:45 UTC](https://community.ipfire.org/t/url-filter-issue/1161/16 "2020-07-04T12:45:10Z")
Hi, > But I need for the office network it easy and clean way to Block IPs and domains I see. To my knowledge, SquidGuard is missing capabilities to query resolved IP addresses against IP-based blacklists. When it comes to DNSBLs, there are some Squid helper scripts available which fix this. There is a [ticket](https://bugzilla.ipfire.org/show_bug.cgi?id=11975) for this, but I did not had time to work on it, yet. However, this has some disadvantages if you do not run your own DNSBL server, as you are effectively exposing your user’s browser history to the DNSBL company, your resolver, and anyone in between. Since those DNSBL tend to be more complete and accurate than Shalla, for example, I guess it is still better than nothing. Thanks, and best regards, Peter Müller ---
**Author:** ![decibel](https://community.ipfire.org/user_avatar/community.ipfire.org/decibel/32/9736_2.png) [@decibel](https://community.ipfire.org/u/decibel)\ **Post date:** [5 July 2020 04:14 UTC](https://community.ipfire.org/t/url-filter-issue/1161/17 "2020-07-05T04:14:10Z")
Sorry but I am still confused over the settings for https sites. Although the contents of data to/from these sites is encrypted, the address is not, so why is this a problem as suggested above? For example, in my case, I have no proxy on my local PC and I have no firewall rule blocking https - but if I go to [hsbc.com](http://hsbc.com) (which is a https site), I can only access the site if I have unchecked the finance/banking box in the URL filter page.