Internet Access

Access Policy

Your own categories

A named set of domains, used anywhere a category is: in a rule on this page, and in TLS Inspection’s Never Decrypt list. A domain in one of yours is judged by your category alone, whatever else we classify it as.

Category and site rules for traffic heading out to the internet. Rules apply in the order shown.

A rule can run in report only before it blocks anyone. Put a new rule in report only, watch what it would have caught, then switch it to blocking.

Global Rules apply to everybody. A rule for a group or a person is merged over them, least specific first, so the organization sets a floor and the exceptions are written where they belong.

Cloud Routing

Sends chosen destinations out through Fowlguard, so the far end sees an address that belongs to your organization rather than the person's own. Destinations are given as addresses or as names, wildcards included, and each carries a condition: everyone, or only when the person is at home, or only when they are at the office.

Block Page

What somebody sees when a rule refuses them. Set the wording and the logo here, and it carries the request route that sends an appeal to Access Requests. Worth writing before you switch a rule from report only to blocking, since it is the only thing the person will read.

TLS Inspection

Decrypts HTTPS on the device so the rest of the policy can read it. Without it, a rule about a path, a keyword, a file or an agent's User-Agent has nothing to act on, and a blocked site shows the browser's own connection error instead of your block page.

What is never decrypted, before you configure anything

The engine ships with a never-decrypt list: the major payment and banking providers, government and health portals, and anything under a reserved national namespace such as *.gov.*. Matching is on a label boundary, so bank.com covers www.bank.com and never notbank.com.

Four categories are excepted whatever you choose: banking, health, government and legal. Decrypting that traffic is unlawful in several jurisdictions, which is why it is not a preference.

Before it does anything: the certificate authority

Every device needs the Fowlguard certificate authority in its trust store before inspection does anything at all. Until it is there, those devices keep browsing undecrypted rather than breaking.

What is never decrypted, whatever you configure

Three things are decided by the far end rather than by you, and the engine handles each without asking.

Applications that pin their own certificate reject ours and cannot be decrypted by anyone. The engine notices the refusal, stops trying for that host, and lets it through, so the application keeps working rather than failing. It is not inspected. If one misbehaves, add it to Never Decrypt These Sites and the engine stops attempting it at all.

Servers that demand a client certificate cannot be intercepted either: the certificate belongs to the device and we do not hold its key. The engine learns which hosts do this and lets them through instead of breaking the connection.

HTTP/3 and QUIC. Inspection reads TLS over TCP, and a site offering HTTP/3 would move every request after the first onto QUIC, where nothing sees it. On macOS the system proxy already takes HTTP/3 away from every application it inspects; elsewhere the engine refuses it so the browser falls back to TCP, at the cost of one round trip. Your own mesh traffic is never affected.

Writing the lists: a host, or a host and everything under it

Every domain list on this page reads entries the same way, one per line.

google.com matches that host and nothing else. mail.google.com is a different host and is not covered.

*.google.com matches subdomains at any depth — mail.google.com, a.b.google.com — but not the apex google.com itself.

To cover a domain and everything under it, write both lines. That is deliberate: an entry for google.com used to quietly cover mail.google.com too, which meant nobody could exempt one host without exempting the whole estate under it.

.google.com is accepted as another spelling of *.google.com, because it is the habit people bring from other products.

Matching is on a label boundary in every case, so google.com never matches notgoogle.com, and *.google.com never matches evil-google.com.

The most common reason to add an entry is an application that pins its certificate. Those fail to connect rather than failing politely, so the symptom is a program that simply will not start or sign in, with no certificate warning anywhere.

Exceptions to never decrypt

A host named under Exceptions To Never Decrypt is inspected even though its category is on the never-decrypt list. Use it for a service your own organization operates, or for a name we have categorised wrongly.

Three things it cannot override. A host the category data calls malicious is decrypted anyway. A host that pins its own certificate is still passed through, which is about whether interception works rather than whether it is allowed. And a host you have also put on Never Decrypt These Sites stays excepted.

Policy Tracer

Answers what happens when one person opens one address, and why - which rule decided it, and what the rule said. Use it before changing a rule, and again afterwards.

Requiring Fowlguard to be running

On the Global Rules there is one switch that is not about a site or a category: Require Fowlguard To Be Running.

Web filtering and Application Control only cover a device while the engine is running. Neither can judge traffic that never reaches it, so a person who closes the client is a person outside both of them - not blocked, not reported, simply unseen. Turning this on says that is not a choice individuals make for themselves.

It is deliberately separate from Open at login in the client, which stays the person's own preference. That setting is about reaching your FGMesh, and private access needs no enforcing: a device that does not connect reaches nothing internal, which limits only the person who chose it. Internet access is the opposite, which is why the switch exists here and not there.

Block Page

Heading is shown large at the top. Title is the name of the browser tab, and defaults to the heading.

Category Enforcement

The console marks categories that behave differently from the rest, so a category that quietly does nothing is visible rather than assumed to work.

Has its own artifact, or needs no list at all. Blocks more than the category names — the enforcement is broader than the list suggests. Folds onto an artifact with no data — nothing backs it. Selecting it has no effect on a device — it can be chosen, and changes nothing.

Rules and your own categories

Warn is not a block: the user sees a caution page and can click through. It takes a path as well as a host.

Keywords are matched in the hostname, and in the path for unencrypted HTTP. An encrypted request only exposes the hostname unless TLS Inspection is on.

In your own categories and in Application Control, a domain covers its subdomains. That is the opposite of the TLS Inspection lists above, which take patterns — those decide whether traffic is decrypted at all, so they ask you to be explicit.