Demo library › Chapter 5
Filter the internet for an office, with no appliance
A DNS location for the London office, blocking security risks and unwanted categories, social media limited to lunch, and the same policy on every laptop.
The problem
The London office filters the internet with an appliance that needs patching and does nothing for people working from home.
Lands with: IT teams running branch offices
Before you start
- A terminal with
curl, and the Windows client with the Cloudflare One client on. - The office's DNS address: Networks → Resolvers & proxies → DNS locations → Horizon Inc HQ (London) → its DNS over HTTPS address.
Run it
The office is a DNS location
| Do | Say |
|---|---|
| Open Horizon Inc HQ (London). | This replaces the appliance. Point the office router here and every device in the building is filtered, with nothing installed on any of them. |
| Traffic policies → Firewall policies → DNS: Block security risks, Block gambling and adult content, Social media outside lunch. | Security categories maintained by Cloudflare, a short list of blocked categories, and social media blocked during London working hours. |
Query the office resolver: curl -s -H "accept: application/dns-json" "https://<your location>.cloudflare-gateway.com/dns-query?name=malware.testcategory.com&type=A" | The answer is 0.0.0.0. The test domain is in the Malware category, so the resolver will not give out its address. |
Whybackground, if you are asked
Pointing the office router at the location filters every device in the building - printers, phones, guests - with nothing installed. The categories are maintained by Cloudflare, so nobody updates a block list.
The same policy on every laptop
| Do | Say |
|---|---|
On the Windows client, open http://malware.testcategory.com. | The same block, with Horizon Inc's block page, wherever the client is on. |
Whybackground, if you are asked
One policy covers the office and the people who are not in it: at home, in a hotel, anywhere the client is on. The appliance in the cupboard only ever covered the building.
What the audience should see
0.0.0.0for the test domain from the office resolver.- Horizon Inc's block page in the browser.
Where the evidence is
Gateway DNS logs: both queries, blocked by Block security risks - one from the office location, one from Alice's device.
Known limitations
- There is no real office network in the lab, so the demo queries the location's DNS over HTTPS address.
- The schedule depends on the time of day.
Part of: Secure web gateway and data protection · The full tour