Super User is a question and answer site for computer enthusiasts and power users. It only takes a minute to sign up.
Sign up to join this community
I do not have a great networking knowledge, and I want to block some websites on my home router, I did some search and I found that I Could change the DNS
so all devices will not be able to enter those websites , but I realize that the dns could be changed on the device configuration or using a vpn so the dns in the router will be ignored.
Is there a solution to block websites in a router so all devices connected to this router will not connect to those websites ?
The DNS on a router is responsible for taking a website URL and resolving the IP address and routing path which allows the site to be reached and loaded.
The VPN works on the back of your existing network, and requires that the connection be established through your router before the VPN connection can be started.
The solution here (well, the workaround) would be to block any websites you need to prevent access to using your routers' site filtering configuration, then prevent all VPNs from connecting through the router.
VPN is a pretty broad term (like vehicle, or plant), and the specific method used to establish a VPN connection can vary wildly from one application to another.
A good place to start would be to try blocking the IKE protocol which is used to establish a secure IPSEC tunnel.
IPSEC creates an encrypted connection between two end points, and all data sent over the connection is routed through this tunnel. It's a safe bet that if you are connecting to a VPN, IPSEC is probably the mechanism used to provide it (although to prevent the barrage of corrections, I am fully aware that IPSEC is not the only way this could be done, it's just pretty likely).
IKE (Internet Key Exchange) is the protocol used to securely swap encryption keys used to encrypt the tunnel. Block that, and you stop the tunnel being established.
IKE uses UDP port 500 during stage 1 connection, so blocking this port on the router's firewall may be sufficient.
It is possible to get around this, but with all network security concerns, it's a matter of balancing the risk against the effort of implementing a solution.
Blocking the port should be enough to stop most people from connecting to VPN, and would be sufficient for a home network certainly. As an extra level of security, you can enable MAC address filtering on your router so that only known devices can connect wirelessly.
