Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have set up Blocked Services on a TP-Link router to block the HTTP Protocol. But we we would also like to whitelist specific sites over HTTP. How can I do this?

share|improve this question

closed as not a real question by Tanner Faulkner, Renan, wizlog, 8088, Dave M Feb 21 '13 at 13:18

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

The router operates on a lower level and does not know HTTP. – kinokijuf Feb 20 '13 at 19:28

OSI Model

In which layer of the OSI Model are you "blocking" HTTP?

If you are blocking it at the transport layer (TCP/UDP), so that port 80 is blocked, then you have already prevented all traffic from going out on port 80, so you can't then take that back and make it less restrictive with a whitelist at the same time.

Most whitelists live in the session or application layer, and do things like whitelist certain domain names, rather than IPs, which are more brittle (a remote site might decide to change IP address while its domain name remains the same).

Likely, the software you are using to block port 80 is at the transport layer, so you need to use something to block at a higher layer, which may or may not be possible using the original TP-Link firmware (it depends on the exact model of router you are using).

You may have to set up a mandatory HTTP proxy, by blocking all HTTP(S) traffic from all hosts on the LAN except for one box, which you put in the DMZ, and open up a proxy that will proxy requests through if they match the whitelist. You can use Linux and Squid for that. If you have no clue how to do that, don't ask another question on SU about it; search the Internet first. There are hundreds upon hundreds of guides out there already.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.