Web Filter
The Web Filter tab decides what the cafe's network will and will not carry. Most cafes set it once, against whatever their local rules ask for, and then only touch it when a customer complains about a site.
Categories
Pick the categories you want blocked and they apply to the whole cafe. Categories are the quick way to cover a rule that is written in general terms, which is how most of them are written.
Your own lists
On top of the categories you can add:
- Blocked addresses. A specific site you do not want on your network, whatever category it falls into.
- Allowed addresses. A site that a category catches but you want through. The allow list wins.
The allow list is the one you will reach for in practice. A category sweeps wide, and the first time it catches a game launcher or a payment page you will want one address back rather than the whole category off.
What it can and cannot do
Filtering works on domain names. That shapes what it is good for.
- It stops a customer typing a site into a browser. That is the case it is built for and the case that comes up.
- It is not a way to stop every VPN or every encrypted tunnel. Somebody determined to get around a name-based filter can.
- Turning filtering off does not reach a device until that device asks for a new address, so give it a few minutes before deciding it did not work.
Use it as the cafe's policy, not as a wall. If a customer is actively working around it, that is a conversation at the counter, not a setting.
Blocking a site you just saw
A site that turned up in the connection records can be added to the block list from there, without typing it out. The change is staged like any other and goes live when you apply it.