Blocking internet to a specific LAN IP with exceptions

Question

I want to be able to mostly block internet access for a specific LAN IP address. It was pretty easy to set up a Reject rule to do this for all traffic from that IP going LAN to WAN and that works perfect... All internet access is blocked for that IP. 
 When I try to add exceptions so that specific sites will work (via FQDN), it doesn't work. To start, I'm just trying to allow *.google.com and it doesn't work. 
 I also tried creating another firewall rule to specifically allow *.google.com for that IP address, and placed it above the reject rule in the list, but it still doesn't work. 
 Anyone have any tips on how to make this work? Thanks in advance.

Nicholas Bethard · Accepted Answer

I think I figured out the answer using Yash's post as a clue. Instead of a separate rule like Yash suggested, I added the DNS servers I use (1.1.1.1 and 8.8.8.8) as well as the DNS service to the reject rule's exclusions (as well as ICMP for testing). Now it works. Hooray.

FormerMember · Answer

Hi Nicholas Bethard , 
 You need to create a firewall rule on top of the Reject rule to allow DNS traffic. 
 
 After that, you can just add an exclusion in the Reject rule for required URLs and services(HTTP and HTTPS for web traffic).

Blocking internet to a specific LAN IP with exceptions

Top Replies