DEV Community

ZeroTrust Architect
ZeroTrust Architect

Posted on • Originally published at cacheguard.com

Blocking Adult Content at the Proxy Layer: Mandatory HTTPS Enforcement, Category Filtering, and Always-On VPN

#networking #security #linux #selfhosted

DNS-based adult content filtering is the most commonly recommended approach and the least reliable technically. Here is why it fails and how to implement proxy-layer filtering that cannot be bypassed with a DNS settings change.

Blocking Adult Content at the Home Gateway

Why DNS filtering fails for adult content blocking

DNS filtering intercepts name resolution queries and returns NXDOMAIN for blocked domains. Three bypass vectors make it unreliable:

1. Manual DNS override (30 seconds, no technical knowledge required):

# iOS: Settings → Wi-Fi → [network] → Configure DNS → Manual → 8.8.8.8
# Android: Settings → Network → Private DNS → dns.google
# Windows: Network adapter settings → IPv4 → DNS servers → 8.8.8.8
Enter fullscreen mode Exit fullscreen mode

Result: queries go to Google's resolver, which does not enforce your blocklist.

2. DNS over HTTPS (DoH) — enabled by default in several environments:

  • Firefox: uses Cloudflare DoH by default (about:config → network.trr.mode = 2)
  • Windows 11: DoH supported natively, configurable without admin rights
  • Chrome: uses DoH when the configured DNS server supports it

DoH encrypts DNS queries in HTTPS, making them indistinguishable from regular web traffic. Your DNS filter never sees the query.

3. Mobile data — bypasses the home network entirely. No DNS filtering, no network controls.

Proxy-layer enforcement architecture 

[Client] → [iptables REDIRECT] → [Squid proxy] → [Category filter] → [Internet]
                                        ↑
                    Cannot bypass: traffic physically redirected by kernel
Enter fullscreen mode Exit fullscreen mode

Step 1: Mandatory proxy via iptables 

# Redirect all HTTP to transparent Squid port
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 \
  ! -d 192.168.1.1 -j REDIRECT --to-port 3128

# Block direct HTTPS bypassing the proxy
# (Squid handles HTTPS via CONNECT in explicit mode)
# Force all clients to use explicit proxy for HTTPS:
iptables -A FORWARD -p tcp --dport 443 -j DROP
Enter fullscreen mode Exit fullscreen mode

For explicit proxy mode: configure clients to use 192.168.1.1:3128 as proxy. The FORWARD DROP rule ensures any device that ignores the proxy configuration cannot reach port 443 directly.

Step 2: Squid adult content category filtering 

# /etc/squid/squid.conf

url_rewrite_program /usr/bin/squidGuard -c /etc/squidguard/squidGuard.conf
url_rewrite_children 5
Enter fullscreen mode Exit fullscreen mode 
# /etc/squidguard/squidGuard.conf

dbhome /var/lib/squidguard/db
logdir /var/log/squidguard

dest adult {
    domainlist adult/domains
    urllist    adult/urls
}

dest anonymizers {
    domainlist anonymizers/domains
}

acl {
    default {
        pass !adult !anonymizers all
        redirect http://192.168.1.1/blocked.html
    }
}
Enter fullscreen mode Exit fullscreen mode

The anonymizers category blocks web-based proxy services that could be used to route around the adult content filter.

Step 3: HTTPS filtering via CONNECT method

In explicit proxy mode, HTTPS connections use the HTTP CONNECT method. The proxy sees the destination hostname in plaintext before the TLS handshake:

CONNECT www.adult-site.com:443 HTTP/1.1
Host: www.adult-site.com:443
Enter fullscreen mode Exit fullscreen mode

Squid evaluates ACLs against the CONNECT target:

acl adult_ssl ssl::server_name_regex -i "/etc/squid/adult_domains.txt"
http_access deny CONNECT adult_ssl
Enter fullscreen mode Exit fullscreen mode

For category-based HTTPS filtering without SSL decryption, this provides hostname-level blocking. For URL-path-level filtering on HTTPS, SSL inspection (ssl-bump) is required.

Extending filtering outside the home: always-on IKEv2 VPN

Mobile devices on cellular data bypass all home network controls. An always-on VPN routes all device traffic through the home gateway regardless of the underlying network:

# /etc/ipsec.conf — StrongSwan full-tunnel VPN
conn family-devices
    keyexchange=ikev2
    leftsubnet=0.0.0.0/0    # Route all traffic through tunnel
    rightsourceip=10.9.0.0/24
    rightdns=192.168.1.1    # Internal DNS
    auto=add
Enter fullscreen mode Exit fullscreen mode

iOS always-on VPN (via configuration profile):

<key>OnDemandEnabled</key>
<integer>1</integer>
<key>OnDemandRules</key>
<array>
    <dict>
        <key>Action</key>
        <string>Connect</string>    <!-- Connect on any network -->
    </dict>
</array>
Enter fullscreen mode Exit fullscreen mode

Android always-on VPN: Settings → Network → VPN → [profile] → Always-on VPN + Block connections without VPN.

Once the device is on the VPN, all traffic routes to the home gateway → through the Squid proxy → through the category filter → then to the internet. The adult content filter applies regardless of the physical connection.

URL blacklist maintenance

Category databases require regular updates. Options:

  • Free community-maintained lists (variable quality, manual update)
  • Commercial subscription databases (higher coverage, automated updates)

For automated updates via cron:

# Update squidGuard category database
0 3 * * * /usr/bin/squidGuard -C all && /usr/bin/squid -k reconfigure
Enter fullscreen mode Exit fullscreen mode

CacheGuard ships Squid + SquidGuard + mandatory proxy enforcement + IKEv2 VPN pre-integrated, with an optional URL blacklist subscription for continuously updated adult content categories.

→ https://www.cacheguard.com/block-adult-content-home-network/

Originally published on the CacheGuard Blog. CacheGuard is free and open source — GitHub.

Top comments (0)