8.2 WebBlocker URL Filtering
Key Takeaways
- WebBlocker provides content-based URL filtering by querying a cloud-based classification database (Forcepoint) that organizes billions of web addresses into more than 130 granular categories.
- The Firebox maintains an in-memory local cache of resolved domain classifications to accelerate evaluation and minimize latency on repetitive user web requests.
- Administrators configure explicit actions per category—Allow, Deny, or Warn—where Deny presents a customizable block screen and Warn issues an audited interstitial acceptable use alert before permitting access.
- Custom URL Exceptions utilize exact matches, wildcard patterns, and regular expressions, taking absolute precedence over cloud category classifications to enforce strict organizational access rules.
- WebBlocker Override enables authorized users to temporarily bypass blocked categories through local administrator passphrases or Active Directory user/group domain authentication.
8.2 WebBlocker URL Filtering
Quick Answer: WatchGuard WebBlocker enforces granular web access control by classifying requested URLs against a cloud-based database of over 130 categories (powered by Forcepoint). Integrated directly into
HTTP-proxyandHTTPS-proxyactions, WebBlocker evaluates URLs using a local RAM cache and cloud queries. For each category, administrators configure Allow, Deny (displaying a customizable block page), or Warn (displaying an acceptable use warning requiring user confirmation). Custom URL Exceptions (exact, wildcard, or regex) override cloud classifications, while WebBlocker Override allows authorized Active Directory groups or administrators with a passphrase to temporarily bypass restrictions.
WebBlocker Architecture & Cloud Integration
Modern enterprise security policies require precise control over employee web browsing to protect against malicious websites, reduce legal liability, and preserve network bandwidth. WebBlocker fulfills this role as an integrated Layer 7 content filtering engine.
+-----------------------------------------------------------------------------------------+
| WEBBLOCKER LOOKUP ARCHITECTURE |
+-----------------------------------------------------------------------------------------+
| |
| [Client Browser] ---- 1. HTTP GET / HTTPS SNI ----> [Firebox Proxy Action] |
| | |
| v |
| [WebBlocker Exception Match?] |
| / \ |
| (Yes) / \ (No) |
| v v |
| [Apply Exception Action] [Check Local RAM Cache] |
| (Allow or Deny) / \ |
| (Hit) / \ |
| v v |
| [Evaluate Category] (Miss: Cloud)|
| ^ | |
| | v |
| [Update Local Cache] <-- [Forcepoint
| Cloud DB] |
+-----------------------------------------------------------------------------------------+
Integration with Proxy Policies
WebBlocker functions exclusively within application proxy policies:
HTTP-proxy: WebBlocker inspects the complete HTTP request, including the destination host header, FQDN, port, and specific URI path (e.g.,http://example.com/downloads/file.exe).HTTPS-proxy(without Content Inspection): WebBlocker inspects the Server Name Indication (SNI) field presented during the plaintext TLS client handshake. It can classify and filter based on the domain name (e.g.,facebook.com), but cannot see the encrypted subpath or query parameters.HTTPS-proxy(with Content Inspection): The Firebox terminates the TLS handshake, decrypts the session, and presents WebBlocker with the full, unencrypted URL path, enabling path-level category enforcement and custom exception matching on encrypted sites.
Cloud Database & Local In-Memory Caching
WebBlocker does not store billions of URLs on the Firebox flash storage. Instead, it employs a hybrid cloud-and-cache architecture:
- Cloud Classification Database: WebBlocker queries a global threat intelligence and URL categorization database maintained by Forcepoint (formerly Websense). The database catalogs billions of URLs into hierarchical categories, updated continuously with newly registered and compromised domains.
- Local Memory Cache: To eliminate latency and avoid sending external queries for every single HTTP request, the Firebox maintains a high-speed WebBlocker Cache in system RAM. When a category lookup returns from the cloud, the Firebox caches the domain-to-category mapping for a defined Time-to-Live (TTL). Subsequent requests for the same host from any internal client are resolved instantly from local memory.
Category-Based Access Control
WebBlocker organizes website classifications into over 130 granular categories, structured into broader parent functional groups to simplify policy management.
Major Category Classifications
| Parent Category Group | Representative Subcategories | Primary Organizational Concern |
|---|---|---|
| Security & Threats | Phishing, Botnet C2, Malicious Web Sites, Elevated Risk, Keyloggers | Immediate network infection, credential harvesting, data breach. |
| Legal & Liability | Adult/Sexually Explicit, Gambling, Weapons, Hate Speech, Illegal Drugs | Hostile workplace claims, regulatory non-compliance, legal liability. |
| Productivity Loss | Social Web, Games, Streaming Media, Shopping, Web Chat, Entertainment | Employee distraction, loss of operational focus, reduced output. |
| Bandwidth Consumption | P2P File Sharing, Audio/Video Streaming, Internet Radio, Large Downloads | WAN saturation, degradation of mission-critical VoIP and ERP traffic. |
| General Business | Business & Economy, Information Technology, Government, Education, Search Engines | Legitimate operational web access; typically allowed by default. |
Category Actions: Deny, Warn, and Allow
Within a WebBlocker profile, administrators assign an explicit action to every individual category or parent group:
+-----------------------------------------------------------------------------------------+
| WEBBLOCKER ACTION MATRIX |
+-------------+---------------------+-----------------------------------------------------+
| ACTION | USER EXPERIENCE | LOGGING & ADMINISTRATIVE IMPACT |
+-------------+---------------------+-----------------------------------------------------+
| **Allow** | Seamless browsing | Traffic is permitted; logged as allowed if logging |
| | without interruption| is enabled in the proxy action. |
+-------------+---------------------+-----------------------------------------------------+
| **Deny** | Connection dropped; | Blocks access; records a security event; displays |
| | block page served | custom HTML deny page with reason and category. |
+-------------+---------------------+-----------------------------------------------------+
| **Warn** | Interstitial alert; | Displays an acceptable use advisory; user must |
| | user must click | click 'Continue' to proceed; creates an audited |
| | 'Continue' to bypass| warning-bypass log entry in Dimension/Cloud. |
+-------------+---------------------+-----------------------------------------------------+
Customizing the Deny Message (Block Page)
When WebBlocker denies an HTTP request, the Firebox responds with a locally hosted HTML block page. Administrators can customize this message to align with corporate policy:
- Dynamic Variables: The block page can dynamically display the requested URL (
%(url)%), the matched WebBlocker category (%(category)%), client IP address (%(client-ip)%), and client user identity (%(user)%). - Custom Branding: Administrators can insert company logos, support contact information, and excerpts from the acceptable use policy to prevent confusion.
Edge Case Management & Operational Resilience
Network administrators must configure robust safeguards for conditions where cloud lookups fail or websites evade standard categorization.
+-----------------------------------------------------------------------------------------+
| WEBBLOCKER EDGE CASE HANDLING |
+---------------------+-------------------+-----------------------------------------------+
| SCENARIO | CONFIGURABLE MODE | TECHNICAL CONSEQUENCE |
+---------------------+-------------------+-----------------------------------------------+
| Uncategorized Sites | Allow (Default) | Permits access to newly registered or obscure |
| | | sites; lower security, zero business friction.|
| | Deny | Blocks any URL not in the cloud database; |
| | | strict zero-trust posture; may block new sites.|
+---------------------+-------------------+-----------------------------------------------+
| Cloud Server | Fail-Open (Allow) | Permits web traffic if cloud servers are |
| Timeout / Failure | | unreachable; ensures business continuity. |
| | Fail-Closed (Deny)| Blocks all web browsing during cloud outage; |
| | | preserves absolute perimeter security. |
+---------------------+-------------------+-----------------------------------------------+
Uncategorized Websites
Newly registered domains, private corporate portals, and regional web pages may not yet be cataloged in the Forcepoint database:
- Allow (Default): Fireware permits the traffic, relying on Gateway AntiVirus, Intrusion Prevention Service, and APT Blocker to neutralize any malicious content.
- Deny: Fireware drops connections to unclassified sites. While this provides maximum defense against adversary infrastructure deployed minutes prior, it creates administrative overhead due to helpdesk tickets for legitimate unindexed resources.
Cloud Connectivity Timeouts (Server Failure)
If the Firebox loses Internet connectivity to the WebBlocker cloud infrastructure (due to an upstream ISP failure or cloud server maintenance), the appliance evaluates the Server Failure / Timeout setting:
- If configured to Allow, web traffic is permitted without category enforcement until cloud communication is re-established.
- If configured to Deny, all user web requests trigger a block page, ensuring no unrated web traffic traverses the firewall.
Custom URL Exceptions
To handle false positives or enforce rigid corporate mandates, administrators define URL Exceptions within the WebBlocker action. URL Exceptions take absolute priority over cloud classifications:
- Match Types:
- Exact URL: Matches a precise address (e.g.,
http://www.finance-portal.com/reports). - Wildcard Pattern: Uses asterisks to match subdomains and paths (e.g.,
*.partner-site.com/*or*training*.corp.com/*). - Regular Expression (Regex): Formulates complex pattern matching for advanced path criteria.
- Exact URL: Matches a precise address (e.g.,
- Exception Action: Exceptions can be defined as Allow (bypassing category blocks) or Deny (blocking specific URLs within an otherwise allowed category).
- Performance Advantage: When a request matches a URL Exception, the Firebox skips the cloud query and cache lookup entirely, immediately enforcing the designated action.
WebBlocker Override & User Bypass Mechanisms
In enterprise operations, business requirements frequently demand that select personnel access normally restricted web categories (e.g., human resources browsing recruitment boards, legal staff reviewing gambling sites, or marketing managing corporate social media profiles).
+-----------------------------------------------------------------------------------------+
| WEBBLOCKER OVERRIDE ARCHITECTURE |
+-----------------------------------------------------------------------------------------+
| |
| [User Encounters Deny Page] ---> [Clicks 'WebBlocker Override' Link] |
| | |
| v |
| [Select Authentication Method] |
| / \ |
| v v |
| [Local Admin Passphrase] [Active Directory Login] |
| • Configured in WebBlocker • Authenticates via Kerberos/LDAP |
| • Static shared password • Restricted to specific AD Groups |
| \ / |
| v v |
| [Firebox Grants Temporary Lease] |
| • Duration: e.g., 15, 30, or 60 minutes |
| • Audit log written to Dimension / Cloud |
+-----------------------------------------------------------------------------------------+
Local Administrator Passphrase Override
Administrators can configure a static WebBlocker Override Passphrase within the WebBlocker configuration:
- When a user reaches a blocked site, an "Override" button or link appears on the block page.
- The user clicks the link and enters the override passphrase.
- If verified, the Firebox issues a temporary access token granting the client IP address an unblocked session for a configured time limit (e.g., 15 minutes to 8 hours).
Directory Service User & Group Override (Active Directory)
In corporate environments, sharing a static passphrase introduces security and auditing risks. WebBlocker supports enterprise identity integration:
- User and Group Permissions: Override authorization is mapped directly to specific Active Directory Security Groups (e.g.,
Domain Admins,Marketing_Team,HR_Managers) or Firebox-DB local users. - Authentication Flow: On the block page, the user authenticates using their individual domain credentials (
usernameandpassword). - Auditing & Non-Repudiation: The Firebox verifies group membership against Active Directory. When granted, Fireware logs the event with the exact user identity, client IP, requested URL, category, and timestamp, ensuring full non-repudiation in WatchGuard Dimension and Cloud Visibility.
A network security administrator must allow corporate workstations to access an external vendor site at 'https://vendor.logistics-cloud.net/portal', which is currently being blocked by WebBlocker under an unauthorized content category. What is the most targeted and efficient method to permit this site without unblocking the entire parent category?
During a wide-scale telecommunications fiber cut, a Firebox loses its ability to reach external DNS root servers and WatchGuard cloud services. Which WebBlocker configuration parameter determines whether internal users can continue browsing existing web pages or are entirely blocked from web access during this cloud outage?
Which WebBlocker action presents users with an interstitial notification outlining corporate acceptable use policies, but still allows the user to proceed to the requested web page upon confirming the advisory?
An enterprise wants to allow members of the Marketing department to access social media sites blocked for other employees, without sharing a static administrator password or creating separate physical subnets. How should the administrator configure WebBlocker to fulfill this requirement?