Technical Tip: How to block a domain and sub-domains using Web Filtering
Description
This article describes an example using the site wapka-file.com.
Websites often use associated sub-domains. This article shows how a web filter/URL filter wildcard expression can be used to block all related subdomains.
Scope
FortiGate.
Solution
Using the GUI, go to Security Profiles -> Web Filter. Select the appropriate web filter profile from the top right-corner drop-down menu. Select the box 'Enable URL Filter' under Static URL Filter.
Select 'Create new'. A pop-up opens up. Type URL as *wapka-file*. Select type as 'Wildcard', Action as 'Block', and Status as 'Enable'. Select 'OK', then select Apply at the bottom of the profile. Make sure that the same web filter is applied in the policy.
Example configuration in the CLI:
config webfilter urlfilter
edit 1
set name <name>
config entries
edit 1
set url "*wapka-file*"
set type wildcard
set action block
next
end
next
end
edit 1
set name <name>
config entries
edit 1
set url "*wapka-file*"
set type wildcard
set action block
next
end
next
end
config webfilter profile
edit <profile_name>
config web
set urlfilter-table 1
end
end
next
end
The *wapka-file* will block all the domain names that contain the name wapka-file irrespective of the content before and after the name.
Note: In order to allow/block sub-domains, Deep Packet Inspection must be enabled. For more information, refer to Technical Tip: 'certificate-inspection' and 'deep-inspection' for URL filtering.
Related articles: