6

On Windows 7 and 8 Microsoft Family Safety included the feature where you could block access to all websites except those explicitly listed in a whitelist at the Family Safety web site. With Windows 10, this feature has been removed, although Microsoft says that they are planning to return that feature at some point in the future (see https://account.microsoft.com/family/faq/).

In the meantime, is there a way to achieve similar functionality with another program or service? This service should work regardless of which browser is used.

Improve this question

2 Answers 2

Reset to default
5

If it's OK to block access for everyone who uses that computer, you can edit the HOSTS file to null-route non-approved websites, redirecting them to an IP address that doesn't exist (or, if you want to be annoying, redirect them all to something like nyan.cat).

As an admin, press Win+R and type

%systemroot%\system32\drivers\etc\

in the dialog box, and press ENTER. On the list of files in Explorer, right-click on "hosts", click "Open With" from the context menu, and then open it with Notepad. Once you're in, you can edit it like this:

#allowed sites
173.194.33.128 google.com
198.252.206.16 superuser.com
#blah blah, more sites here

#blocked sites
<paste the contents of http://pastebin.com/63hfPx8M here>

This null-routes all TLDs (.com, .net, etc.) and only allows through whitelisted sites.

To whitelist more sites, add a line for each website to the HOSTS file by putting the IP address of the website (see below), then a space, then the website name. Don't put "http://" in the name, or anything after the .com/.net/whatever TLD the website has.

To find the IP of a website, first do Win+R, then "cmd", then Enter. When the black box comes up, type ping <website> and press Enter. (Again, don't put "http://" or any of that stuff in.) Some stuff will show up, but what matters is the IP, which is in brackets:

C:\Users\Me>ping google.com

Pinging google.com [173.194.33.128] with 32 bytes of data:

So Google's IP is 173.194.33.128.

Improve this answer
8
  • Is that new for windows 10? I can see that being useful in some cases.
    – Journeyman Geek ♦
    Oct 19, 2015 at 5:35
  • That behavior is not new, as far as I can tell. It's always been possible to null-route domains in the hosts file.
    – bwDraco
    Oct 19, 2015 at 5:42
  • @JourneymanGeek It's not new, this works through like windows 98 or something. I know it works in XP and greater.
    – MilkeyMouse
    Oct 19, 2015 at 7:08
  • 2
    @JourneymanGeek - Did you just ask if editing the hosts file was a new feature of Windows 10 :$ The problem with this solution is that companies like Google update server configuration daily. You are not directed to the same physical server every day and thus the address will change slightly when that happens.
    – Ramhound
    Oct 19, 2015 at 11:07
  • 1
    I've tested this on Win10, Win7 and WinXP and it doesn't work. Resolving .com to 0.0.0.0 does nothing, because the system will go directly for superuser.com which still resolves just fine - it doesn't need to know .com's IP to get superuser.com's IP. DNS normally isn't used recursively, programs will ask directly for the domain they're interested in. DNS is hierarchical and works mostly like this under the hood, but end users don't care - they have their non-authoritative DNS servers that handle this for them.
    – gronostaj
    Nov 18, 2022 at 9:33
2

The answer from MilkeyMouse does not work : HOST file cannot use TLD like .com, .org...

Here is a simpler solution :

Put all the sites you want to whitelist into the HOST file in C:\Windows\System32\drivers\etc\hosts

Change your IPv4 DNS server to 127.0.0.1 (go to Network Connections, right-click on your connection to internet (generally it's the Wifi) : Properties, Then modify your IPv4 configuration to have only one DNS server 127.0.0.1, uncheck IPv6).

Then Win-R ipconfig /flushdns

As you don't have a DNS server responding on your PC identified as 127.0.0.1, your PC doesn't know how to access any internet site.

Your HOST file now acts as a whitelist.

If you have any problem with your host file, check hosts file ignored, how to troubleshoot?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .