Demo library › Chapter 5
5 Filter the internet for an office with no appliance.
A DNS location for the London office, security and content categories, social media kept to lunch, and the same policy on every laptop.
The problem
Horizon Inc's London office filters the internet with an appliance in a cupboard: it needs patching, it has a licence renewal, and it does nothing for anyone working from home. The company wants malware and phishing blocked everywhere, a short list of categories it will not allow, and social media kept to lunch.
Lands with: IT teams running branch offices, and anyone with a web filter up for renewal
Before you start
- A terminal with
curl, and the lab's Windows client with the Cloudflare One client on. - The office's DNS address: Networks → Resolvers & proxies → DNS locations → Horizon Inc HQ (London) → its DNS over HTTPS address.
Run it
The office is a DNS location
| Do | Say |
|---|---|
| Open Horizon Inc HQ (London). | This replaces the appliance. Point the office router's DNS here and every device in the building is filtered - printers, phones, guests - with nothing installed on any of them. |
| Traffic policies → Firewall policies → DNS: Block security risks, Block gambling and adult content, Social media outside lunch. | Security categories maintained by Cloudflare, a short acceptable-use list, and a schedule: social networks are blocked in London working hours and open at lunch and after work. |
From the terminal, ask the office resolver for a test domain:
curl -s -H "accept: application/dns-json" "https://<your location>.cloudflare-gateway.com/dns-query?name=malware.testcategory.com&type=A" | The answer is 0.0.0.0. Cloudflare's test domain sits in the Malware category, and the office
resolver refuses to give out its address - for every device that asks. |
And the same policy on every laptop
| Do | Say |
|---|---|
On the Windows client, open http://malware.testcategory.com. | The same block, with Horizon Inc's block page - at home, in a hotel, anywhere the Cloudflare One client is on. One policy for the office and the people who are not in it. |
What the audience should see
0.0.0.0for the malware test domain from the office resolver.- Horizon Inc's block page for the same domain in the browser.
Where the evidence is
Gateway DNS logs: both queries, blocked by Block security risks, one from the office location and one from the user's device, with Alice's identity on the second.
Known limitations
- There is no real office network in the lab, so the demo queries the location's DNS over HTTPS address. A real office points its router at the location's IPv4 or IPv6 resolver instead.
- The schedule depends on the time of day you run it.
Part of: Secure web gateway and data protection · The full tour