I'm looking for a way to filter internet access (homes setting, not business) by means of an 'only allow' access list. In other words, you would have to populate the list with what sites you choose to allow access to. If you wanted a particular PC to only be able to access cnn.com, finance.yahoo.com, and pbs.org - this would be the most sensible approach.

I understand this could become quite tedious, but for some parents, it would be a surefire method for keeping their littles ones from stumbling upon the wrong sites. Of course, the common sense approaches are a must as well, keep the PC in an open, communal room, check on the kids, etc.

But ultimately, for peace of mind, I think that an 'allow only' approach would work best. However, I've yet to find a web filter which allows for this setup. They all seem to have an 'always allow' filter, but never an 'allow only'.

closed as off topic by Michael Hampton, Dave M, mdpc, Scott Pack, Alex Jan 25 '13 at 21:53

Questions on Server Fault are expected to relate to server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here. If this question can be reworded to fit the rules in the help center, please edit the question.


If you are seriously concerned; I would get an extra machine and put it inline with the other PC forcing it to go through a Squid proxy; this will allow you to monitor/limit the websites that it can go through. You can also do a dig on cnn.com, etc... and get the ranges that they are from. Then do a whois to get the ranges and block all BUT those authorized ranges on your router. The best option is the proxy as you have better control over the web sites and the content of those sites as well. The blocking on an ACL should be a last option as you can end up blocking things that you may not have meant to block (i.e. if you go to CNN.com and it pulls an add from another page that ad will NOT load this could also be a random image on the page as well).

  • +1 This would certainly be an easy to implement solution and should cost little or nothing. You may also consider using a full firewall (I use Smoothwall) and use its squid proxy to do the blocking. – John Gardeniers Jul 13 '09 at 2:01
  • +1 Blacklists and whitelists are EASY to config with Squid. My company is running many machines through a Squid proxy using a whitelist (or an allow-only list). Also, these are Windows machines, as is the machine running Squid. – cop1152 Jul 13 '09 at 3:03

The software the company I work for makes can do this. I don't want to really push out software here, but our site is www.awarenesstech.com.


Running another PC is going to cost you $10-20/month in power alone. You're better off using an ISP that provides child filtering and paying them the premium or finding a better, non-technical solution.

  • Electricity must be expensive in your area. My firewall will operate for a year for that sort of money. The benefits of having total control should not be discounted lightly. – John Gardeniers Jul 13 '09 at 4:15

Another option is to edit the hosts file with the sites that you allow, this can have issues with maintaining IP's especially if the site uses high availability.

You would then change the DNS to something other then a DNS.


Better try out dansguardian on linux. http://dansguardian.org/

  • For whitelisting? DG needds squid or similar, and so I would suggest it is total overkill for bog standard whitelists. – Tom Newton Jul 13 '09 at 10:13
  • It has both option. Exception & blocking list. I am using it past 1yrs. Its giving a good response. – Caterpillar Jul 14 '09 at 6:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.