XII. Firewall/Security Features

Firmware 3.7.x

The DNS Filter feature from firmware 3.7.6 onwards links to the router's firewall (for firmware prior to this, refer to the Firmware 3.6.x instructions)
This can be applied either to the entire network using the Default Rule, or it can be applied using Firewall Filter rules - using a filter rule makes it possible to apply the DNS filtering to specific network segments and schedule it if necessary. Please refer to this knowledge base article for details on Scheduling Filter Rules.

There are two types of DNS Filtering on the router:
The DNS filter applied through the firewall has multiple profiles and filters all external DNS access.
The DNS Filter Local Setting filters DNS lookups that use the router IP as the DNS server.

This guide will cover the configuration of both as it is recommended to configure both types of filter to ensure effective DNS filtering.

---

To set this up, go to [CSM] > [Web Content Filter Profile], on there, make sure that the router has a valid and active Web Filter license. To configure the web content filtering, select a profile index number by clicking on the number:

In the Web Content Filter Profile, give it a suitable name, set the Action setting to Block and select the categories to block, in this example, "Social Networking" will be blocked, click OK to save the settings of the profile:

Upon clicking OK, the router will pop up this warning:

This is for your information only and does not affect the configuration of the Web Content Filter, click OK to continue.

---

With the Web Content Filter Profile configured, the DNS Filter Local Setting can now be configured, go to [CSM] > [DNS Filter]. On there, enable the filter and select the Web Content Filter profile to apply using the DNS Filter. The DNS Filter Local Setting affects filtering on the router's DNS server i.e. if a client uses the router IP as the DNS server, the DNS Filter Local Setting needs to be configured.

Click OK to save that then go into one of the DNS Filter profiles in the DNS Filter Profile Table to set up the filtering that will link to the firewall:

In the profile, give it a suitable name and select the Web Content Filter Profile to use, then click OK:

The DNS Filter can now be linked to the firewall and there are two different methods for applying this:

Default Rule - The default rule CSM settings will affect the whole network, it is possible to make exemptions from this or set up other CSM profiles through the use of a filter rule.

Filter Rule - Filter rules can be used to apply CSM to specific network segments i.e. a guest network on 192.168.3.x or apply the rules on a schedule. They can also be used to make exemptions to CSM filter settings configured in the Default Rule, or apply a different profile to a specific network segment while applying CSM using the Default Rule.