Skip to content

Blocklists & Filtering

VeloGuardian DNS uses a layered filtering system: blocklists provide domain lists, categories organize them, profiles define what to block for each client, and rules override everything.

When a DNS query arrives:

  1. Local DNS records are checked first (always takes priority)
  2. Allow rules in the client’s profile are checked — if the domain is allowed, it passes through
  3. The domain is looked up in the filter index (built from all enabled blocklists)
  4. If found, the domain’s categories are compared against the client’s profile’s blocked categories
  5. Deny rules force a block regardless of category matching
  6. If not blocked, the query goes to the upstream DNS server

Blocklists are external domain lists that the appliance downloads and indexes. Manage them from Filtering > Blocklists in the sidebar.

BlocklistFocusFormat
Steven Black UnifiedAds, trackers, malware, fakenewshosts
OISD SmallAds, tracking, telemetrydomains
Phishing Army ExtendedPhishing domainsdomains
URLhaus Malware FilterActive malware distributiondomains

Click Add Blocklist and fill in:

FieldDescription
NameDisplay name for the blocklist
URLDirect download URL for the list file
Formathosts (IP + domain pairs), domains (one per line), or adblock (Adblock Plus syntax)
CategoriesWhich filtering categories this list applies to (multi-select)
EnabledWhether the list is active

After adding, click Update Now to download immediately, or wait for the scheduled update (default: daily at 4 AM).

FormatDescriptionExample line
hostsStandard hosts file — IP followed by domain0.0.0.0 ads.example.com
domainsOne domain per line, no IPads.example.com
adblockAdblock Plus filter syntax||ads.example.com^

Lines starting with # or ! are treated as comments in all formats.

Blocklists are re-downloaded and the filter index is rebuilt on a cron schedule. The default is 0 4 * * * (daily at 4 AM). Change this under Settings > Blocklist Update Schedule.

VeloGuardian DNS includes 90+ filtering categories based on the FortiGuard FTGD taxonomy, organized into groups:

GroupExample categories
SecurityMalware, Phishing, Botnet, Spam URLs
AdultPornography, Explicit Violence, Nudity
BandwidthStreaming Media, Peer-to-Peer, File Sharing
ProductivitySocial Media, Gaming, Web Chat
General InterestNews, Sports, Entertainment, Shopping
BusinessFinance, IT, Cloud Applications

Browse all categories under Filtering > Categories. Each category shows how many domains are indexed under it.

Categories are read-only — they come from the built-in FTGD taxonomy. You assign blocklists to categories when adding or editing a blocklist, and block categories per profile.

Profiles define what gets blocked for which clients. Each profile has a set of blocked categories, optional custom rules, and optional time-based schedules.

Manage profiles under Filtering > Profiles.

The default profile applies to any client that isn’t explicitly mapped to another profile. It’s created automatically on first boot and cannot be deleted.

Click Add Profile and configure:

FieldDescription
NameUnique name (e.g., “Kids”, “Office”, “Guest”)
Is DefaultMake this the default for unmapped clients (only one can be default)
Filtering EnabledMaster toggle — if off, no filtering for this profile
Blocked CategoriesSelect which categories to block (multi-select grouped grid)

Under Filtering > Clients, map devices to profiles:

Match typeDescriptionExample
IPSingle IP address192.168.1.100
SubnetCIDR block192.168.1.0/24
MACMAC addressAA:BB:CC:DD:EE:FF
HostnameDevice namejohns-laptop
IP rangeIP address range192.168.1.100-192.168.1.200

Resolution order: exact IP match first, then CIDR subnets (first match wins), then the default profile.

Each profile can have per-domain rules that override blocklist decisions:

  • Allow — the domain is always permitted, even if it matches a blocklist
  • Deny — the domain is always blocked, even if it doesn’t match any blocklist

Manage rules by expanding a profile on the Profiles page and using the Custom Rules section.

Override a profile’s blocked categories during specific time windows. For example, block social media during work hours but allow it in the evening.

Each schedule entry has:

FieldDescription
NameOptional label (e.g., “Work hours”)
DaysDays of the week this schedule applies
Start timeStart time in 24h format (HH:MM)
End timeEnd time in 24h format (HH:MM)
Blocked categoriesCategories to block during this window (can differ from the base profile)
ActiveToggle the schedule on/off

Overnight schedules are supported — if the start time is after the end time (e.g., 22:00–06:00), the schedule spans midnight.

When multiple schedules apply to the same time window, the first match wins.

Manage schedules by expanding a profile on the Profiles page and using the Schedules section.

  1. Edit the default profile
  2. Check the Advertising, Malware, Phishing, and Spam URLs categories
  3. Save — all devices on your network are now protected
  1. Create a profile called “Kids”
  2. Block adult content, gaming, social media, and streaming categories
  3. Under Clients, add each child’s device IP mapped to the “Kids” profile
  4. Add a schedule: allow streaming on weekends (Sat/Sun 09:00–21:00) by removing the streaming category from the schedule’s blocked list

Allow a specific domain that’s incorrectly blocked

Section titled “Allow a specific domain that’s incorrectly blocked”
  1. Find which profile the affected device uses
  2. Expand that profile on the Profiles page
  3. Under Custom Rules, add the domain with action Allow
  4. The domain is immediately unblocked for all clients using that profile