Web filter

The URL filter on the Firewalla blocks what you list on the child’s devices while they’re on the VPN. Everything not listed is allowed. You run it from Family Filter for Mac (the Web blocking card, site details and the timeline), or from Family Filter for iPhone on an iPhone.

The Web blocking card

Closed, it’s a one-line summary of what’s blocking now. Open, it shows:

• Turn off for… each device, and Turn filter off… for all of them.
• A box to paste a URL or type a domain, with Block and Never block.
• Always blocked, with Unblock on each entry.
• The Focus sets on now, each with when it ends, and +30 min or End for one started on demand.
• Never blocked, with Remove.
• Tried to open, last 7 days: blocked requests, with the device and what blocked each one.
• Hosts the filter can’t decrypt, because an app refused its certificate.

What a rule matches

• A domain (youtube.com) blocks the site and all its subdomains.
• A page (youtube.com/watch?v=abc, reddit.com/r/something) blocks that page, what’s under it (/r/something/comments/…), and the same page with extra query parameters (&t=10). It doesn’t block pages whose names merely start the same: wikipedia.org/wiki/Cat doesn’t block /wiki/Caterpillar.
• A path ending in / (youtube.com/shorts/) blocks everything under it.
• www. and https:// are ignored. Paths are case-sensitive.

Never blocked

Never-blocked entries are written the same way. Allowing youtube.com/watch?v=abc lets that one video through a youtube.com block. Allowing classroom.google.com covers its subdomains and pages. An entry is never on both lists: adding it to one takes it off the other.

Which wins

1. iCloud Private Relay is always blocked. It would carry Safari past the filter, and blocking it is Apple’s documented way for a network to turn it off.
2. A temporary exception (“allow this page for 2 hours”, “block this until 5pm”) beats everything else while it lasts.
3. Otherwise the most specific entry wins, across never blocked, Always blocked and the Focus sets on now: a subdomain beats its domain, and a page beats its site. If two are equally specific, never blocked wins.

So youtube.com never blocked with youtube.com/shorts/ blocked blocks only Shorts. And bbc.com blocked with bbc.com/bitesize/ never blocked lets Bitesize through.

From the timeline

Every page in the timeline has a Block menu (shown on hover):

• Block this page or Block all of the site.
• Never block this page or the site.
• Block or allow the page or site for a while: 15 minutes to the end of the day. This is a temporary exception.
• Add to a Focus block set: the page or the site, to any set.

Pages a rule covers say Blocked or Allowed.

What the child sees

A blocked page shows the filter’s own page instead of the site:

A page blocked by Focus Mode gets a gentler page that says when it opens again. See Focus Mode.

Switching it off

Turn filter off… turns the whole filter off for an hour, a set time, or until you turn it back on. The child’s devices stay on the VPN, but nothing is blocked or logged. A banner in Family Filter for Mac says so while it’s off, with Turn back on. Turning it back on also cuts the connections opened in the meantime.

Turn off for one device works the same way for that device alone. It stays on the VPN and is still watched for VPN-off use.

Both are pushed to the parents’ iPhones, with who switched it off.

If the filter stops answering

A watchdog checks the filter all the time. If it stops answering, the parents’ iPhones are told, and told again when it’s back.

Apps handled by domain

Some apps, such as Apple’s own services, are handled by domain rather than page by page. The Web blocking card lists them, and they can be blocked like any other site.

Source: filter/README.md