I want to block a large number of websites (like thousands to millions) from the MacBook and iPhones and my initial solution was using /etc/hosts file to block websites in the MacBook and using Mobile Device Management for filtering websites but it slows down browsing as the number of blacklisted sites increase.

So I thought of an alternative where I can use a VPN, and I connected to the VPN it will search (using binary search) and block the blacklisted websites. I searched a lot on implementation but no luck. Anyone here has an idea how can I implement that?


  • You will never see a MAC address of a web site, unless it is on the same network as you. MAC addresses are only ever seen on the local LAN. Only the IEEE protocols use MAC addresses, and other data-link protocols use something else or nothing for addressing, and you have no idea what protocols are in use across the Internet. – Ron Maupin Nov 5 '19 at 14:01
  • 1
    In any case, I do not think you understand what a VPN is (basically just an encrypted point-to-point tunnel that looks like a direct link). What do you intend to be the tunnel endpoints, and how would that help you blacklist web sites? I think you are trying to ask an X-Y question. – Ron Maupin Nov 5 '19 at 14:05
  • @ron-maupin, I apologize! By mac, I meant products developed by Apple, like MacBook pro. Yes, I do have limited knowledge of VPN but I'm aware that we use it to tunnel endpoints. I just need a server that I can connect to so that it filters websites that I have blocked by searching through millions of blacklisted websites (faster). – Siraj Farhan Nov 5 '19 at 14:56
  • Unfortunately, questions about hosts and consumer-grade devices like that are off-topic here. You could ask about those on Ask Different or Super User. – Ron Maupin Nov 5 '19 at 15:00
  • In networking MAC is Media Access Control (layer-2 of the OSI model). There is an explanation in the description of the tag you used. – Ron Maupin Nov 5 '19 at 15:01

Hi and welcome to network engineering.

That's what web filtering proxy servers (transparent or explicit) are for. As such they are bordering to be off-topic here. And ressource recommendations are off-topic, too.

Yet sometimes, such proxies (especially in their "transparent" variety) are embedded in the software running on "next generation firewalling" product ranges, on hardware boxes or virtual appliances offered by some vendors.

What they do is this: These boxes fake the initial (TCP) session setup, impersonating the server to the client, and they wait for the client to issue the application layer request, typically a HTTP GET or the start of an SSL/TLS negotiation for HTTPS. At the same time, on their "outside interface", they impersonate the client and start talking to the "real" server on the internet. Then this initial traffic is closely inspected.

They look at headers from the HTTP request (such as the HTTP Host header or the GET request) or they inspect the SSL/TLS dialog (such as the ServerNameIndication from the client or the CN or SAN's from the certificate the server presents). Then, they match this information against their filtering mechanism (e.g. a local database, or a an online lookup in the database of the given vendor), and process or block the request accordingly.

One step further, these boxes can not only look at HTTP or the not-yet-ecrypted part of SSL/TLS, but sometimes, they even generate an SSL/TLS certificate ad-hoc (using an internal CA of their own) and present it to the client.

If the client (by configuration or trickery) happens to trust a certificate for "my.bank.com" which is signed by "ourwebfilterproxy.company.com", then SSL/TLS session is established, the client issues its http request and the webfiltering box can look at the encrypted content. Yes, that's what others call a man-in-the-middle attack.

In this context, a VPN (which variety? MPLS L3-VPN? Multipoint L2 VPN? Remote Access VPN? Site to Site VPN?) is only one of many options to get the traffic-of-interest to flow through such a "next generation firewall", if that box or VM is not hosted on your premises.

Seen from a distance, your primary filtering criterion is probably the web site's domain name in the URL. Therefore, you might want to consider tackling the problem from that side: There are ways to accomplish a large subset of such "web" filtering by doing DNS filtering, by offering a restrictive DNS service and by preventing client systems from using alternative DNS servers --- but now we're getting off-topic, definitely.

|improve this answer|||||
  • @marc-netztier-luethi Great explanation! Here's what I think I should do. Please let me know your thoughts. I should use a combination of VPN and web filtering proxy servers. 1. Setup an OpenVPN server. 2. Setup local web filtering proxy with filtering logic in the same server where the OpenVPN server is setup. 3. All the requests from the VPN server are filtered through the proxy. 4. Connect any device to this VPN and I have got a web-filtering VPN. – Siraj Farhan Nov 5 '19 at 14:42
  • @SirajFarhan, you need to connect the VPN to another end. There is no such thing as a single-ended VPN. A VPN is a tunnel between two points. In any case, host/server configurations and protocols above OSI layer-4 are off-topic here. We could help with on-topic (enterprise-grade) network equipment (routers, switches, etc.) configurations. – Ron Maupin Nov 5 '19 at 14:48
  • Before providng feedback (which would probably have to be outside of NE-SE), can you please rephrase your question to clarify it? See Ron Maupin's comment about the X-Y question. Such as: what do you mean by "mac" in this context (a computing device by Apple Inc.? a MAC address, and how are MAC addresses relevant to your problem?). So far, it is only clear that you want to "filter probably millions of web sites". Which is the audience (company staff? family? students on a campus?) ? How much control do you have over the end devices (proxy settings, DNS settings, network environment?) – Marc 'netztier' Luethi Nov 5 '19 at 14:52
  • @marc-netztier-luethi, I have rephrased the question. – Siraj Farhan Nov 5 '19 at 15:02

Not the answer you're looking for? Browse other questions tagged or ask your own question.