webfilter-ng

Spec sheet

Purpose

webfilter-ng filters HTTP and HTTPS web access by domain name using the HTTP Host field or TLS SNI.Read 11 Oct 2026 · github.com

Deployment

It is intended to run on a standalone Linux computer or as a router or internet gateway.Read 11 Oct 2026 · github.com

Integrations

The README describes using a local BIND9 DNS resolver and DHCP distribution for gateway DNS filtering, and names CleanBrowsing as a DNS filtering service option.Read 11 Oct 2026 · github.com

License

The repository identifies the project license as LGPL-3.0.Read 11 Oct 2026 · github.com

Categorification

The categorify.org API option is gateway-only, and the README says its current implementation adds reliability only to adult-content filtering.Read 5 Oct 2026 · github.com

Categorification API

The categorify.org API option is available only for gateway filtering, and the README says its current implementation adds reliability only to adult content filtering.Read 11 Oct 2026 · github.com

DNS bypass checks

With DNS filtering, webfilter-ng compares the requested website IP with IPs supplied by the DNS filtering service and blocks requests when they do not match.Read 11 Oct 2026 · github.com

Filtering methods

The project describes four usage options: squidGuard, a public DNS filtering service, DNS filtering plus the categorify.org API, or a whitelist or blacklist.Read 11 Oct 2026 · github.com

Filtering modes

The README describes filtering with squidGuard, a public DNS filtering service, that service with the categorify.org API, or a whitelist or blacklist.Read 5 Oct 2026 · github.com

HTTPS handling

It says HTTPS traffic can be filtered without decrypting it or installing root certificates on client computers.Read 11 Oct 2026 · github.com

IPv6 limit

The README says IPv6 is not yet supported and instructs users to disable it on the Linux computer or router.Read 5 Oct 2026 · github.com

Logs

The README gives /var/log/webfilter-ng as the location for logs.Read 11 Oct 2026 · github.com

Notable limits

The README says IPv6 is not yet supported and should be disabled on the Linux computer or router.Read 11 Oct 2026 · github.com

Platform requirement

Installation instructions specify Debian or Ubuntu and require Linux networking packages including iptables and libnetfilter_queue.Read 5 Oct 2026 · github.com

Platform requirements

The documented installation requirements are for Debian or Ubuntu and include build tools, iptables, and netfilter queue libraries.Read 11 Oct 2026 · github.com

Protocol limit

The README says standard IETF QUIC is not currently filtered; Google-QUIC support is described as work in progress.Read 11 Oct 2026 · github.com

QUIC limit

The README says standard IETF QUIC is not currently filtered; Google-QUIC support is described as experimental or work in progress.Read 5 Oct 2026 · github.com

Safe search

The README describes an optional gateway setup to enforce safe search on Bing and Google using a BIND9 RPZ zone.Read 11 Oct 2026 · github.com

TLS filtering

It reads TLS ClientHello SNI to filter HTTPS without decrypting traffic or installing root certificates on client computers.Read 5 Oct 2026 · github.com

Transparent operation

The README says filtering is transparent and client proxy settings are not needed.Read 11 Oct 2026 · github.com

Where Specifiction places it

• Internet Filtering Software#56 of 656.7