Domain Allowlist – Concept Overview

Domain Allowlist is a DNS filtering feature in the zWAN Standalone appliance that allows administrators to explicitly permit specific domains, overriding category-based or policy-based blocking rules.

• DNS resolution is permitted.
• Category blocking rules are overridden only if the domain does not belong to an actively blocked category.
• The domain is treated as a user-defined trusted exception.
• Traffic to that domain is allowed only if it passes category validation checks.

This feature ensures business continuity for legitimate services while maintaining category policy integrity.

Core Concept

When a domain is added to the Global Domain Allowlist:

1. The domain name is validated using a DNS format check.
2. Duplicate entries are removed.
3. The system verifies that the domain:
   • Does not already exist in the Blocklist.
   • Does not belong to a currently blocked category.
4. If the domain belongs to a blocked category:
   • The request is rejected.
   • An error message is displayed:
     • E_ADD_DNS_ALLOWLIST_FAILED
     • Following domains belong to blocked categories: domain_name (category_name)

   

5. If validation succeeds:
   • The domain is stored in the Allowlist database.
   • A corresponding runtime entry is created for DNS enforcement.

   

6. If DNS service is active, Unbound is restarted to apply the updated configuration.

Import Allowlist

1. The Import option allows administrators to add multiple domains to the Allowlist or Blocklist in bulk.

   

   • Supports structured file input (CSV format).
     
   • Each domain in the file is validated individually.
   • Invalid domain formats are rejected.
   • Duplicate entries are ignored.
   • Domains that belong to blocked categories are rejected.
   • Domains already existing in the opposite list (Allowlist/Blocklist) are rejected.
2. After import, the system displays a summary indicating:
   • Successfully added domains
   • Failed entries with reason

   

3. This feature simplifies large-scale domain management and reduces manual effort.

Delete Allowlist

Domains can be removed using the delete options available on the page.

Individual Delete

• Each domain entry can be removed individually using the trash icon in the right corner of the domain.
• Once deleted, the domain returns to normal policy evaluation.

Bulk Delete (Delete Selected)

• Multiple domains can be selected using checkboxes.
• Clicking Delete Selected removes all chosen entries at once.
• The system prompts for confirmation before deletion.

After deletion:

• The domain is removed from the corresponding list.
• Any override behavior is immediately withdrawn.
• Standard category and firewall policies apply.

This ensures administrators can efficiently manage and clean up domain entries.

Domain Blocklist – Concept Overview

Domain Blocklist is a DNS filtering feature in the zWAN Standalone appliance that allows administrators to explicitly block specific domains, regardless of category-based policies.

When a domain is added to the Blocklist:

• DNS resolution for that domain is denied.
• The domain is blocked even if its category is allowed.
• The domain is treated as a user-defined restriction.
• All client requests to that domain are prevented at DNS level.

This feature provides granular control to block specific domains that may not fall under a blocked category but still require restriction.

---

Core Concept

When a domain is added to the Global Domain Blocklist:

1. The domain name is validated using a DNS format check.
2. Duplicate entries are removed.
3. The system verifies that the domain does not already exist in the Allowlist.
4. If the domain already exists in the Allowlist:
   • The request is rejected.
   • An error message is displayed:
     • E_ADD_DNS_BLOCKLIST_FAILED
     • Domain Name exists in Allowlist. Please remove it from Allowlist before adding to Blocklist.

   

5. If validation succeeds:
   • The domain is stored in the Blocklist database.
   • A corresponding runtime entry is created for DNS enforcement.

   

6. If DNS service is active, Unbound is restarted to apply the updated configuration.

---

Import Blocklist

1. The Import option allows administrators to add multiple domains to the Blocklist in bulk.

   

   • Supports structured file input (CSV format).
     
   • Each domain in the file is validated individually.
   • Invalid domain formats are rejected.
   • Duplicate entries are ignored.
   • Domains already existing in the Allowlist are rejected.
2. After import, the system displays a summary indicating:
   • Successfully added domains
   • Failed entries with reason

   

3. This feature simplifies large-scale domain restriction management.

---

Delete Blocklist

Domains can be removed using the delete options available on the page.

Individual Delete

• Each domain entry can be removed individually using the trash icon in the right corner of the domain.
• Once deleted, the domain returns to normal policy evaluation.

Bulk Delete (Delete Selected)

• Multiple domains can be selected using checkboxes.
• Clicking Delete Selected removes all chosen entries at once.
• The system prompts for confirmation before deletion.

After deletion:

• The domain is removed from the Blocklist.
• DNS-level restriction is withdrawn immediately.
• Standard category and firewall policies apply.

This ensures administrators can efficiently manage and clean up restricted domains.

---

When Blocklist is Empty

If no domains are configured in the Blocklist:

• Category filtering operates normally.
• No domain-level restriction is applied.
• DNS processing follows defined security policies.

Domain Alerts – Concept Overview

Domain Alerts provides visibility into DNS queries that were blocked or failed due to security policies such as category filtering or domain blocklist enforcement.

This feature allows administrators to:

• View domains that were denied at DNS level.
• Identify affected clients (IP and hostname).
• Analyze the DNS response result (REFUSED, SERVFAIL, NXDOMAIN).
• Quickly add a domain to the Allowlist if required.

Domain Alerts reduces dependency on external logging systems and provides real-time visibility directly within the firewall UI.

---

Core Concept

The Domain Alerts page displays DNS events that were denied or failed during resolution.

Each alert entry includes:

• Timestamp – Date and time of the DNS query.
• Client IP – IP address of the requesting device.
• Client Hostname – Hostname of the client.
• Domain – Queried domain name.
• Result – DNS response status:
  • REFUSED
  • SERVFAIL
  • NXDOMAIN
• Cached – Indicates whether the response was served from cache.
• Time to Resolve – DNS processing time.

---

Add to Allowlist from Alerts

From the Domain Alerts page, administrators can directly allow a blocked domain.

• Clicking the "+" (Add to Allowlist) icon adds the domain to the Global Allowlist.
• The same validation rules as manual Allowlist addition apply:
  • Domain format validation
  • Duplicate check
  • Blocked category validation

  

  

If validation succeeds:

• The domain is added to the Allowlist.
• Future DNS requests for the domain are permitted.
  

Remove from Allowlist

If a domain is already allowlisted, the remove (✕) option allows administrators to withdraw the exception directly from the Alerts page.

• The domain is removed from the Allowlist.
• Standard category and firewall policies apply immediately.
  

Search and Filtering

The search bar allows administrators to:

• Filter alerts by domain name.
• Quickly locate specific DNS events.
• Investigate repeated failures for a particular website.