Preramble
I really feel for ts(yo)u. ツ Yes, this is a known issue for the DIR-625 as well as the DIR-655 and possibly/probably others. It is indeed a massive oversight and/or poor design on the part of D-Link and frankly, quite inexcusable and unjustifiable (another example of reverse progress).
Unfortunately, short of reverse-engineering the firmware there is no way to get the same functionality (as an older model ◔_◔). Even though it could have been fixed with a firmware update, they didn’t bother to fix it and it has been discontinued, so you’re stuck with what you have. Worse, it is not even compatible with third-party firmware, so you are stuck with the stock firmware.
Workaround
Fortunately, there is a more or less practical way to approximate the functionality without too much compromise.
Here is what I did:
Open the router’s management console and navigate to the Website Filter section.
If you have already entered some sites (and discovered that instead of being blocked, they are being allowed, and the only ones allowed), then copy them somewhere (a notepad, Notepad, etc.)
Delete all items in the list (or click [Clear the list below…]), then click [Save Settings].
Open a command-prompt (cmd) and ping each domain to resolve them and find out their IP addresses. Copy the IPs next to the domain names in your block-list.
NB: Some sites (especially those that use CDNs) may resolve to more than one IP address. In this case, if they resolve to a set of IPs in a block, then you can use an IP range (e.g., 1.2.3.0 - 1.2.3.255) to block the site regardless of which IP it returns; if not, then you will have to enter each one individually.
You can Google the IP address or use different WHOIS tools to get more information about it including other domain names that resolve to it and alternate IP addresses for the domain name.
Since this method used in this workaround does not use URLs (let alone wildcards), you will have to manually account for prefixes such as www., en., etc.
Switch to the Access Control page.
Check the ☑ Enable Access Control box and then click [Add Policy]. Click [Next] on the next page.
Enter a descriptive name for the policy.
Select your desired control schedule (that is, when you want it blocked—I use Always). Click [Next].
Select the IP-/Mac-address of the system to block for or Other Machines to block for everything connected to the router. Click [OK].
- Repeat the previous step as necessary (only needed if specifying addresses; for Other Machines, only one entry is required). Click
[Next].
In the Filtering Method page, select Block Some Access to allow you to specify what to block. Selecting Log only will not block anything and selecting Block All blocks everything.
Un-check the ☐ Apply Web Filter box. Checking it will cause the router to use the web-filtering whitelist and block everything other than the sites specified in the Website Filter page which is NOT what you want. (If you enter items in the whitelist in Web Filter without creating a policy in Access Control, then it indiscriminately applies the list to all devices at all times for all ports and protocols. Creating an Access Control policy gives you have a little more—but not enough—control over it.)
Check the ☑ Apply Advanced Port Filters box (you must select at least one of the two methods; this is the one you want).
In the Port Filter page, enter the IP addresses/ranges of the sites you wish to block. You can enter an optional comment for each entry. You can usually leave the port and protocol settings as is since they default to blocking everything. (You really only want to mess with those if for some reason you need to connect to a server in one way but not others such as allowing FTP but blocking HTTP or allowing SVN but not µTorrent). Click [Next].
Select whether you want the router to make a log entry whenever it blocks an attempt to connect to a blocked server. This can be particularly useful for keeping tabs on when programs try to “phone home”. Click [Save].
Now back on the Access Control page, click [Save Settings].
Summary, Postramble, and Notes
That’s it (read “done”, not “simple”); the router should now block the sites you specified, but allow everything else.
The only caveat is that because it is blocking IP addresses instead of domain names, you may have to update them if the site(s) should change their IP(s). Fortunately this does not happen too often for bigger sites (and even small ones) who strive to keep their IP address relatively stable for compatibility and to reduce complexity (it can be a pain to have to update the address in all locations—that’s what variables are for, but they are not used everywhere). You can accommodate changing IPs to some degree by using an IP range instead of specific address(es).
Yes it is ridiculous, a lot of work, not necessarily 100% coverage, and more cumbersome that it need be, but it works and is usually sufficient (and of course cheaper than getting a new router).
