Home / Resources / Internet Access
Four surfaces, reached from the Internet Access page.
A named set of domains, used anywhere a category is: in a rule on this page, and in TLS Inspection’s Never Decrypt list. A domain in one of yours is judged by your category alone, whatever else we classify it as.
Category and site rules for traffic heading out to the internet. Rules apply in the order shown.
A rule can run in report only before it blocks anyone. Put a new rule in report only, watch what it would have caught, then switch it to blocking.
Global Rules apply to everybody. A rule for a group or a person is merged over them, least specific first, so the organization sets a floor and the exceptions are written where they belong.
Sends chosen destinations out through Fowlguard, so the far end sees an address that belongs to your organization rather than the person's own. Destinations are given as addresses or as names, wildcards included, and each carries a condition: everyone, or only when the person is at home, or only when they are at the office.
What somebody sees when a rule refuses them. Set the wording and the logo here, and it carries the request route that sends an appeal to Access Requests. Worth writing before you switch a rule from report only to blocking, since it is the only thing the person will read.
Decrypts HTTPS on the device so the rest of the policy can read it. Without it, a rule about a path, a keyword, a file or an agent's User-Agent has nothing to act on, and a blocked site shows the browser's own connection error instead of your block page.
The engine ships with a never-decrypt list: the major payment and banking providers, government
and health portals, and anything under a reserved national namespace such as *.gov.*.
Matching is on a label boundary, so bank.com covers www.bank.com and never
notbank.com.
Four categories are excepted whatever you choose: banking, health, government and legal. Decrypting that traffic is unlawful in several jurisdictions, which is why it is not a preference.
Every device needs the Fowlguard certificate authority in its trust store before inspection does anything at all. Until it is there, those devices keep browsing undecrypted rather than breaking.
Three things are decided by the far end rather than by you, and the engine handles each without asking.
Applications that pin their own certificate reject ours and cannot be decrypted by anyone. The engine notices the refusal, stops trying for that host, and lets it through, so the application keeps working rather than failing. It is not inspected. If one misbehaves, add it to Never Decrypt These Sites and the engine stops attempting it at all.
Servers that demand a client certificate cannot be intercepted either: the certificate belongs to the device and we do not hold its key. The engine learns which hosts do this and lets them through instead of breaking the connection.
HTTP/3 and QUIC. Inspection reads TLS over TCP, and a site offering HTTP/3 would move every request after the first onto QUIC, where nothing sees it. On macOS the system proxy already takes HTTP/3 away from every application it inspects; elsewhere the engine refuses it so the browser falls back to TCP, at the cost of one round trip. Your own mesh traffic is never affected.
A host named under Exceptions To Never Decrypt is inspected even though its category is on the never-decrypt list.
A host named under Exceptions To Never Decrypt is inspected even though its category is on the never list. Use it for a service your own organization operates, or for a name we have categorised wrongly.
Three things it cannot override. A host the category data calls malicious is decrypted anyway. A host that pins its own certificate is still passed through, which is about whether interception works rather than whether it is allowed. And a host you have also put on Never Decrypt These Sites stays excepted.
Answers what happens when one person opens one address, and why - which rule decided it, and what the rule said. Use it before changing a rule, and again afterwards.
On the Global Rules there is one switch that is not about a site or a category: Require Fowlguard To Be Running.
Web filtering and Application Control only cover a device while the engine is running. Neither can judge traffic that never reaches it, so a person who closes the client is a person outside both of them - not blocked, not reported, simply unseen. Turning this on says that is not a choice individuals make for themselves.
It is deliberately separate from Open at login in the client, which stays the person's own preference. That setting is about reaching your FGMesh, and private access needs no enforcing: a device that does not connect reaches nothing internal, which limits only the person who chose it. Internet access is the opposite, which is why the switch exists here and not there.
Fowl