Technical Tip: Allow certain websites using static URL filter and block all other websites without using FortiGuard category-based filter

Steps to create a URL filter list:

1. Create a web filter profile by going to Security Profiles -> Web Filter -> Create new.
2. Enable the URL filter option under the Static URL Filter.
3. Select 'Create New' to create a new entry in the URL filter.
4. Add the allowed domain with Action 'Monitor' or 'Allow' with the 'Enable' status.

6. Repeat the same for all other allowed domains.
7. Select 'Create New' to create a new entry in the URL filter.
8. Select 'Wildcard'
9. Set Action 'Block' with status 'Enable'.
10. In the URL field, keep *, which means it will block anything.

In the following example, the domains www.msn.com and https://ping.eu have been allowed, but all other URLs have been blocked, all by using a static URL filter list without using a FortiGuard category-based filter. This web filter profile has been configured in the policy, and all of the traffic will be blocked, except for access to https://www.msn.com and https://ping.eu.

CLI Reference:

config webfilter urlfilter
    edit 1
        set name "Auto-webfilter-urlfilter_4lgtg8uv8"
            config entries
                 edit 1
                     set url "www.msn.com"
                     set action monitor
                 next
                 edit 2
                     set url "ping.eu"
                     set action monitor
                 next
                 edit 3
                     set url "*"
                     set type wildcard
                     set action block
                 next
             end
    next
end

config webfilter profile
    edit "Restricted_Profile"
        config web
            set urlfilter-table 1
end

Additionally, check the forward traffic logs or web filter security event logs to verify whether all of the websites are blocked except for the allowed websites.

Related articles:

Technical Tip: Web filtering order of execution

Technical Tip: Use static URL filtering without FortiGuard Web Filter license

Technical Tip: Allow all website using static url filter without using Fortiguard category based filter