In another attempt to reach the goal that I had in the following question, how can I block a certain website using hosts file even if I’m connected to a VPN?

I tried to enable url filter capability of my ASUS Wireless Router:

enter image description here

But that also does only work when I’m not connected to a VPN. What can I do about it?


Short answer: That's impossible

Long answer: The purpose of VPN is to create an end-to-end connection in which the contents of the connection is encrypted and inaccessible to the outside world, hence a virtually private connection. Now you want to defeat the very purpose of this type of networking and peek inside the VPN? Well, you can't; at least you need a supercomputer instead of router, with the ability to break the encryption. You can only filter the connection at its endpoints, i.e. either before the request goes through VPN or after it comes out of it.


If you are connected to a VPN outside of your network and you want to filter out websites, you need to place your router in the middle:

Your computer - Your router - VPN Server

Otherwise your router will only see data garbage and will not be able to filter out anything.


To understand what a VPN does, look at the following:

Without a VPN a normal connection looks like this (simplified)

  1. You (your computer) requests content from www.website.com
  2. Your router forwards a request from your internal IP to www.website.com
  3. www.website.com sends the requested data back to your router
  4. Your router sends the data to your internal IP

If you would want to block websites, your router would be able to block www.website.com because the router is able to deny or allow connections to www.website.com because the router is able to see where the connection is coming from and where it is supposed to go.

With a VPN however:

  1. Your computer connects to the VPN and encrypts the whole connection
  2. Your computer send an encrypted request to the VPN Server
  3. Your router forwards a request from your internal IP to the VPN Server. The router does not know where you really want to go as the router can only see the VPN-Server in the initial request

If you would want to block certain websites you would need the router in the same network as otherwise the router would only see encrypted data.

  • Please rephrase it? If the router wasn't in the middle, it wouldn't see anything at all since the data won't get routed through it... – Marek Rost Jul 30 '16 at 14:26
  • so you mean it's not possible for someone like me who is using softwares like Cyberghost? My computer connects with the vpn server through my router and then that vpn server connects me to the world. so I have the configuration My computer---My router---vpn server – Sepideh Abadpour Jul 30 '16 at 14:27
  • 1
    What he means is that data gets encrypted on your computer. Thus the router cannot know you're requesting that domain. You could block it only if the router was client on the VPN and not your computer. – Marek Rost Jul 30 '16 at 14:28
  • @MarekRost so you mean blocking should be done before the browser sends data to vpn tunnel to encrypt it. so that can only be done through blocking in browser-level ie, leechblock,etc. what about the hosts file? that is my another question. it is impossible for it, too?....I mean does hosts file check the outgoing packs after being encrypted by vpn or before? In fact what's the purpose of hosts file in windows then? – Sepideh Abadpour Jul 30 '16 at 14:39
  • Exactly - browser or the hosts file. Check the other question. – Marek Rost Jul 30 '16 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.