squid on opnsense for web filtering

[tommycat95]

I am trying to block all websites except a couple for a client that wants opnsense on it.  He has asked me to block all websites except two sites related to his business.  Considering that dns could return so many different IPs for any site, is squid able to do this type of web filtering or do I need research dns filtering?  This extreme blocking is the first time I am doing it for a site that can have upwards of 20+ computers and I am not sure there is a good solution to achieve that.  Anybody done such a thing?  Would appreciate the advise.  Thanks

[meyergru]

Squid would by any means only filter based on DNS names as well. However, it would need traffic inspection (i.e. break up connections) to do that unless you also control the clients proxy settings. Since most web traffic is HTTPS these days, you would need SSL bumping and this in turn would need you to put the neccessary CA certificate on all clients. Which is infeasible for some devices.

But even if you did that, it is not even as easy as you think: Blacklisting is somewhat easy - whitelisting is not. I bet there are many URLs missing from your "two sites" that are needed for operation, like:

- Microsoft update sites (and there are lots!)
- Android update sites
- Apple updates sites

Not to speak of API URLs that may be used for business applications in your customers network. How will you find what URLs are really needed besides the two your customer thinks are neccessary?

You are most certainly going down a rabbit hole there.