Configure DNS Filtering rules in Nebula

Configure DNS Filtering rules with the Rules tab on the DNS Filtering page. Here, assign rules to a Nebula policy, select which security and content categories to block, and specify domains to allow and block. Configuring access for a domain will include its subdomains, but configuring access for a subdomain will not include the entire domain. 

Setup DNS Filtering rule

1. On the left navigation menu, go to Monitor > DNS Filtering.
2. In the top left, select the Rules tab.
3. In the top right, click Add DNS rule.
4. Enter a name for the DNS Rule.
5. Select one or more policies.
6. Click Next to go to the Block List.

Block list

Blocked items cannot be accessed on endpoints covered by the Nebula policy and DNS filtering rule. 

1. Use a template to quickly apply a set of recommended content categories. Click Preview to see which content categories are included in each template or view this article, then click Apply to add them to the block list. 
2. Use the drop-down to block:
   • Domain or subdomain: Enter specific domain or subdomains and click Add. Full URL-path blocking is not supported.
   • Top level domain: Enter a top level domain such as xyz and click Add.
   • Resolved IP address: Enter a specific IP address and click Add.
   • Content categories: Each domain falls into one or more content categories. Select which categories of content to block, such as advertisements or profanity and click Add.
     • Blocking content categories such as Technology may cause popular business domains to be stopped mistakenly. For more information, see Technology content category
   • Security categories: Security categories are pre-selected for you. For more information on each, see Security categories and determine whether any should be removed. 
3. Click Next to proceed to the Allow List.

Allow list

Add domains and IP addresses to the Allow list to make exceptions to the Block list.

1. Enter domains, subdomains, or IP addresses to allow and click Add. 
2. Once complete, click Next.
3. Review the rule and click Save rule once complete.

Notes

• The maximum number of DNS rules is 50.
• The allow list and block list have a limit of 4000 domains each.
• Each policy can only have one DNS rule applied.
• Add domains to the allow list of your DNS rules if you require access to a blocked domain.
• Use the Bulk upload feature to upload a .CSV file with a list of items to add to the block or allow list. Use separate CSV files for different domain types.
• If entering IP addresses, only the domains associated with the IP address are blocked or allowed.

Categories

The available security and content categories are listed below. 

Security categories

These categories are already preselected when creating a DNS rule. We recommend keeping this enabled.

Content categories

Use the Look up domain categories field next to the content categories dropdown to verify the content category of a specific domain.

Technology content category

We advise against blocking the technology content category as most domains for e-commerce activity are included in that category. If you are blocking this category, add these to the allow list:

Return to Nebula DNS Filtering guide.