Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Problem

I have a D-Link router and am having trouble figuring out how to get it to block certain websites.

Background

With my old (revision A1) DI-524, I had several different kinds of flexible options (seen below) to filter web access. In my case, I really only used the domain-blocking function to block certain sites for all devices on the home LAN.

With this newer router (DIR-625 A1), it looks instead of letting you create a blacklist of sites to block (and allow everything else), the web-filtering function only lets you create a white​list of sites to allow (and block everything else). This might be good in an office, but for home use, this is completely useless since there is no way to make a list of all conceivable sites to be allowed (the router has no markings to specify that it is meant for business/home use).

Testing/Research

After some research, it looks like the C revision of the router has had a firmware update to allow the user to choose whether the sites listed are to be allowed or blocked (like the old DI-524 did), but this is of little help to revision A customers because the last firmware for it does not have this.

Some people have made vague, incomplete suggestions about using the access-control function to block sites, but even if those could work, I cannot/don’t want to have to create a block-rule for each and every device that I may connect to the router (with the DI-524, I didn’t have to). Others have suggested blocking with OpenDNS, but that is not practical either since it would require not only making sure that everything uses the OpenDNS servers, but also to make sure they all use nothing but the OpenDNS servers.

Summary

Is there a way to get this router to block only some websites for the whole LAN, or should I grab a hammer and “rage quit” D-Link permanently?


DI-524 domain filter options

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

Preramble

I really feel for ts(yo)u. Yes, this is a known issue for the DIR-625 as well as the DIR-655 and possibly/probably others. It is indeed a massive oversight and/or poor design on the part of D-Link and frankly, quite inexcusable and unjustifiable (another example of reverse progress).

Unfortunately, short of reverse-engineering the firmware there is no way to get the same functionality (as an older model ◔_◔). Even though it could have been fixed with a firmware update, they didn’t bother to fix it and it has been discontinued, so you’re stuck with what you have. Worse, it is not even compatible with third-party firmware, so you are stuck with the stock firmware.

Workaround

Fortunately, there is a more or less practical way to approximate the functionality without too much compromise.

Here is what I did:

  1. Open the router’s management console and navigate to the Website Filter section.

  2. If you have already entered some sites (and discovered that instead of being blocked, they are being allowed, and the only ones allowed), then copy them somewhere (a notepad, Notepad, etc.)

  3. Delete all items in the list (or click [Clear the list below…]), then click [Save Settings].

    Website Filter page

  4. Open a command-prompt (cmd) and ping each domain to resolve them and find out their IP addresses. Copy the IPs next to the domain names in your block-list.

    PING to find IPs

    • NB: Some sites (especially those that use CDNs) may resolve to more than one IP address. In this case, if they resolve to a set of IPs in a block, then you can use an IP range (e.g., 1.2.3.0 - 1.2.3.255) to block the site regardless of which IP it returns; if not, then you will have to enter each one individually.

    • You can Google the IP address or use different WHOIS tools to get more information about it including other domain names that resolve to it and alternate IP addresses for the domain name.

    • Since this method used in this workaround does not use URLs (let alone wildcards), you will have to manually account for prefixes such as www., en., etc.

      • Some sites will resolve them to the same server:

        Wikipedia IPs

      • While others will have different IPs:

        Facebook IPs

  5. Switch to the Access Control page.

  6. Check the ☑ Enable Access Control box and then click [Add Policy]. Click [Next] on the next page.

    Access Control page

  7. Enter a descriptive name for the policy.

    Policy Name

  8. Select your desired control schedule (that is, when you want it blocked—I use Always). Click [Next].

    Blocking schedule

  9. Select the IP-/Mac-address of the system to block for or Other Machines to block for everything connected to the router. Click [OK].

    Filtered machine(s)

    • Repeat the previous step as necessary (only needed if specifying addresses; for Other Machines, only one entry is required). Click [Next].

  10. In the Filtering Method page, select Block Some Access to allow you to specify what to block. Selecting Log only will not block anything and selecting Block All blocks everything.

    Filter method

    1. Un-check the ☐ Apply Web Filter box. Checking it will cause the router to use the web-filtering whitelist and block everything other than the sites specified in the Website Filter page which is NOT what you want. (If you enter items in the whitelist in Web Filter without creating a policy in Access Control, then it indiscriminately applies the list to all devices at all times for all ports and protocols. Creating an Access Control policy gives you have a little more—but not enough—control over it.)

    2. Check the ☑ Apply Advanced Port Filters box (you must select at least one of the two methods; this is the one you want).

  11. In the Port Filter page, enter the IP addresses/ranges of the sites you wish to block. You can enter an optional comment for each entry. You can usually leave the port and protocol settings as is since they default to blocking everything. (You really only want to mess with those if for some reason you need to connect to a server in one way but not others such as allowing FTP but blocking HTTP or allowing SVN but not µTorrent). Click [Next].

    Filter rules

  12. Select whether you want the router to make a log entry whenever it blocks an attempt to connect to a blocked server. This can be particularly useful for keeping tabs on when programs try to “phone home”. Click [Save].

    Filter logging

  13. Now back on the Access Control page, click [Save Settings].

Summary, Postramble, and Notes

That’s it (read “done”, not “simple”); the router should now block the sites you specified, but allow everything else.

The only caveat is that because it is blocking IP addresses instead of domain names, you may have to update them if the site(s) should change their IP(s). Fortunately this does not happen too often for bigger sites (and even small ones) who strive to keep their IP address relatively stable for compatibility and to reduce complexity (it can be a pain to have to update the address in all locations—that’s what variables are for, but they are not used everywhere). You can accommodate changing IPs to some degree by using an IP range instead of specific address(es).

Yes it is ridiculous, a lot of work, not necessarily 100% coverage, and more cumbersome that it need be, but it works and is usually sufficient (and of course cheaper than getting a new router).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.