Web Content Filtering

Introducing DrayTek Web Content Filtering

DrayTek Web Filtering allows you to block web content in six main ways:

Features 1, 3, 4, 5 and 6 of the above are included with the router. Feature 2 is included but requires an annual subscription to the external server, which keeps a real-time constantly updated database of web sites. More details of that later.

Features supported varies with router model; please check on specification for confirmation of Web Content Filter capabilities.

2. Web Site Category (powered by URL Reputation)

DrayTek's WCF is built into most of our routers and allows you to select specific categories of web site which your router will allow access to. For example, an office may wish to block access to social networking or other company time-wasting sites or a home user might want to block adult sites from their children. In public Internet access facilities, you might want to block various unsuitable categories.

URL Reputation covers 78 separate categories, including the security-focused section, which you can select as blocked or permitted. Every time one of your users attempts to access a site, the router automatically queries the central URL Reputation server to ascertain its classification. This takes only milliseconds. If a site is blocked by URL Reputation, according to the categories you have selected, instead of the requested web page, a warning message is displayed to the user (you can customise the message).

The URL Reputation central database is continuously updated with new sites and changes to sites but also records normally legitimate sites which have become compromised or contain malware (a unique feature to URL Reputation). Access to the URL Reputation server requires an annual subscription. A free 30-day trial is included with all new routers so that you can try the feature out before subscribing. Scroll down the box below to see the 78 different categories which can be blocked by URL Reputation, either permanently or at certain times of day/week according to your chosen schedule and for the PCs you choose.

Why URL Reputation?

DrayTek's Web Content Filtering, powered by URL Reputation, uses a unique method of categorisation to ensure the most accurate, relevant and up to date database of web sites. In particular compared to other services, these are some important advantages of URL Reputation:

1. URL Reputation is built into the hardware

   There are software solutions for category blocking or parental control but they have to be installed on each PC, tablet or device and maintained on each. Someone with the right skills (a skilled employee or smart child!) can often find a way to bypass or disable the software. DrayTek's URL Reputation operates at your Internet point of entry so examines all web site URLs requested and cannot be turned off without administrative rights to the router.
   
   

2. URL Reputation is a commercial/professional Service

   Unlike some other services, URL Reputation does not rely on volunteers to submit suggestions for sites to include or rely on volunteers to categorise each site submitted (and multiple users to then concur with the category proposal). Relying on community-driven categorisation can lead to inaccuracies, delays, mischief and an incomplete database which omits many sites, particularly those which are more obscure or unknown (which are also more likely to be undesirable). The URL Reputation WCF service continuously evolves to improve performance and accuracy. This cloud-based technology dynamically updates each category as often as every 5 minutes to keep your network safe.
   
   

3. URL Reputation is not a Domain Resolution Service

   Therefore it is not possible to bypass it merely by changing the DNS settings on your PC, or by browsing by IP address instead of URL. URL Reputation intercepts and examines all web requests for their specific destination, in addition to intercepting DNS requests and blocking requests in that way.
   
   

4. Categorisation uses an automated mechanism

   URL Reputation filtering is based on a hugely scalable cloud-based architecture that uses the extensive cloud computing resources available for categorization. URL Reputation uses a dynamically built, relevant local database with real-time connectivity to a hugely scalable cloud-based repository. URL Reputation therefore provides more complete, relevant categorization of the Internet. URL Reputation's main benefit is the highly intelligent and accurate categorisation algorithms which are used to build its database.
   
   

5. Zero-Hour Protection

   The Internet is a living, continuously growing and evolving system. As URL Reputation operates in real-time, it can categorise a site from the moment it becomes available from the first time it is requested, and re-categorise it if it changes at a later date without requiring community-driven or user intervention. Users do not have to manually submit sites for categorisation.
   
   

6. Categorise IP Addresses

   Some other content filtering services can be bypassed simply by the user browsing to an IP address so that the URL is never considered/checked. URL Reputation will categorise sites based on their IP address if a user tries to access via that method. i.e. Both www.facebook.com and 69.63.190.18 would be blocked by URL Reputation if you have prohibited social networking. This is also particularly useful in combating phishing emails which commonly use IP addresses instead of URLs. The DrayTek router can, in addition, block browsing by IP address altogether.
   
   

7. Multiple Categories Per Site

   URL Reputation can identify a single web site or page as falling into several categories, for example a site might provide both 'dating' and 'adult' content so if you choose to block either of those, URL Reputation will correctly identify it as both.
   
   

8. Site granularity

   Whereas other services consider only the top level domain (TLD) i.e. the URL up until the first “/”, URL Reputation will parse/consider the whole URL. This is particularly a problem for Web 2.0 sites such as blog sites (members.tripod.com/sitename) where one user's blog might be for kids and other user's contain adult-suited material. Another example is commercial sites which contain different materials types. For example, URL Reputation will distinguish between "sportsillustrated.cnn.com" (Sports pages) and "sportsillustrated.cnn.com/swimsuit/" (Swimwear models/nudity).
   
   

9. Embedded Links are examined

   Another common methods that users might use to bypass web controls is using parsing or translation web sites.
   For example, if you try to visit: "http://translate.google.com/translate?tl=it&u=http%3A%2F%2Fwww.swimwearplace.com%2F"
   then URL Reputation will correctly identify that you have asked Google to display 'www.swimwear.com' and block it if that is a category you have prohibited, whereas other services will just see 'Google'' and permit access based on the categorisation of Google (search engine).
   
   

4. IP Filtering

This is a more technically complex method. All data sent across the Internet is sent as a 'data packet' between devices (for example between your PC and a web site) Each device has its own IP address (such as '203.0.113.86'). In addition, each data packet can be one of several data types (TCP, UDP, ICMP etc.) and may also have additional information such as TCP port numbers. Don't worry if this all sounds a bit complicated; the useful factor here is that these packets can be distinguished and therefore rules can be set up on the router to block or pass packets which match parameters you choose.

Examples of useful IP filters might be to block incoming mail from all but known mail servers, or to allow access to your internal web server from all addresses except known remote locations. IP Filters can be nested so that a chain of filters can all be tied together and data passed only if one of, or all of the rule criteria are met. As we said, it's a technically complex feature but immensely powerful.

Note : Although we include IP filtering here, most users actually consider that to be part of the main firewall features as it's not filtering 'by content' as such.

6. Network Level SafeSearch

Filtering adult content on large web sites or search engines can prove difficult; blocking access to popular sites such as YouTube, Google or Bing is not a desirable option but applying content filtering to these sites, which force HTTPS connections instead of unencrypted HTTP, is often not possible.

Access to these web sites is secured with TLS encryption, which limits what a router's URL Content Filter or Web Content Filter can achieve because the URL cannot be inspected and additionally may not be indicative of the actual content being displayed.

DrayTek Vigor routers that support LAN DNS can enforce SafeSearch for web sites that offer this facility to network administrators.

YouTube, Google search and Bing search each provide a network level method to control SafeSearch through the use of a special hostname.

Many popular sites now offer this form of SafeSearch that doesn't rely on enforcing settings on individual computers and devices, which can be potentially bypassed and is time consuming to configure.

With DrayTek's LAN DNS feature, accessing "www.google.com" can be redirected to "forcesafesearch.google.com", which enforces SafeSearch for all devices accessing Google search through the DrayTek Vigor router's network.

This can be applied to Google for all countries (or Top-Level-Domains) using wildcards, such as "www.google.*", which avoids the limitation of this being bypassed simply by accessing another country's Google site i.e. "www.google.co.jp" or needing to manually enter every TLD when configuring this facility.

Similarly to the DNS Filter, the LAN DNS feature takes effect on all DNS Lookups passing through the router, so configuring a PC to use another DNS server will not avoid the enforcement of SafeSearch.