Block Websites on the Firewall the Right Way Domain Rules vs IP Blocking
The firewall is the strongest place to block websites in an office — one rule covers every device. But there is a right way and a wrong way to write that rule, and the wrong way fails silently within weeks. Here is the difference.
🎥 Full video — firewall website blocking demonstrated with the other 4 methods
Sooner or later every admin tries the obvious thing: find the website's IP address, add a deny rule on the firewall, done. It works — for about a week. Then the site moves, or starts answering from a different address, and your rule is blocking nothing while a shared CDN address on your list takes down twenty innocent sites with it. Modern websites do not live on one IP address. This page explains how firewall blocking actually works in 2026, and how to write rules that are still correct next year.
Firewall Policy — Web Filter Applied
Source: Office LAN (all users)DENY
Profile: Web Filter — Social Media, Streaming, GamblingCATEGORY
Source: Accounts VLANALLOWLIST
Fallback rule: Direct IP block listRARELY WORKS
Example policy view: category profiles do the heavy lifting; raw IP deny rules sit at the bottom because they age badly.
1
Why Blocking by IP Address Fails
Three facts of modern hosting kill IP-based rules:
CDNs: sites like Facebook or YouTube are served by content delivery networks from hundreds of changing IP addresses. Your list is stale the day you write it.
Shared hosting: one IP often serves dozens of unrelated websites. Block that address and you block the accountant's bank along with the game site.
Anycast and rotation: DNS answers rotate constantly for load balancing, so even a correct capture is only a snapshot.
IP rules still have one good use: blocking a specific malicious server during an incident. As a website-blocking strategy, they are the wrong tool.
2
The Right Way — URL and Category Filtering on the Firewall
Business firewalls (FortiGate with FortiGuard, Sophos, Palo Alto, and pfSense with add-on packages) carry a web filter profile that judges the domain name, not the IP:
Open the firewall's web filter profile and clone the default before editing
Set the categories you block — social media, streaming, gambling, adult, anonymizers — to Block, and leave business categories alone
Add a static URL filter list for your office's specific sites, using domain entries like *.example.com where the firewall supports wildcards
Attach the profile to the internet policy for the office LAN
Turn on logging for the profile from day one — you will need it the first time someone says the block broke their work
3
How the Firewall Sees an HTTPS Site
With HTTPS, the firewall cannot read the page — the traffic is encrypted. What it can see, without any tricks, is the domain name: from the DNS query and from the SNI name the browser sends when the encrypted connection starts. That is exactly enough for domain and category blocking.
What it cannot see is the full page address after the domain. Blocking one specific page or channel while allowing the rest of a site needs deeper inspection (a proxy or TLS inspection), which is a bigger decision with its own costs — covered in the HTTPS blocking guide in this series. For ordinary office blocking, domain-level is the honest, working answer.
4
Keep the Category Database Alive
Category filtering is only as good as its database:
On FortiGate/Sophos-class devices the category service is a subscription — when the licence lapses, filtering silently degrades. Put the renewal date in your calendar.
Set the firewall to update its filter database automatically and check occasionally that updates are succeeding.
A brand-new site may be unrated. Decide your policy for unrated sites deliberately — most offices allow them and rely on the custom list; high-security offices block them.
5
Test, Log, and Keep a Paper Trail
Test every blocked category from a user PC on the office LAN, and confirm the block page names the category and policy
Test your three most important work sites to prove no over-blocking
Check the firewall log shows the blocked attempts — if it is not logged, it did not happen, as far as any dispute is concerned
Save a backup of the firewall configuration before and after the change
Do this, and your firewall blocking will still be correct months from now — unlike the IP list quietly rotting in some forgotten rule.
🔴 Never do this: blocking a big platform's IP range you found in a forum post. Those ranges belong to CDNs shared by thousands of sites. You will break random business websites, and the first symptom will be a phone call, not a log entry.
🎥 Watch the Full Video
Watch the firewall method done step-by-step in the full video, alongside DNS and ManageEngine.
The firewall questions that come up in every office.
Why did my firewall IP block stop working
Because the website does not have one fixed IP address. Sites behind CDNs rotate through hundreds of addresses, so your rule blocks yesterday's addresses while today's traffic flows freely. Switch to domain-based URL or category filtering on the firewall.
Can a firewall block one YouTube channel but allow YouTube
Not with normal domain filtering — HTTPS hides the page path, so the firewall sees youtube.com, not the channel. Page-level control needs TLS inspection or a proxy, which is a separate, heavier setup most small offices do not need.
My firewall licence expired and blocking stopped. Why
Category databases on business firewalls are subscription services. When the licence lapses, the database stops updating and on many models the filtering itself degrades. Renew the licence and confirm the database update status in the firewall dashboard.
This guide is based on the Technical Anshu video on blocking websites in the office • Stuck on a step? Ask in the video comments — answers come there 🙏