How DNS, Firewalls and Endpoint Tools Block Websites
What Happened — HackRead explains that website filtering can be enforced at four distinct points in a request’s lifecycle: DNS resolution, network firewalls, web‑proxy or secure web‑gateway, and endpoint security agents. The article details what each layer observes, common bypass techniques (e.g., DNS‑over‑HTTPS, VPN tunneling, encrypted traffic), and why a single filter often misses malicious traffic.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for a documented, layered web‑filtering control that spans DNS, network, and endpoint – a core control objective for continuous access‑control assurance.
- Highlights gaps that can undermine audit evidence; without unified logging across these layers, organizations struggle to prove effective outbound traffic controls.
- Aligns with Verisq’s Control Mapping capability, which helps map each filtering layer to a single control objective and collect continuous evidence for audit readiness.
Who Is Affected
- Enterprises of all sizes that enforce internet‑use policies.
- SaaS and cloud‑service providers that rely on DNS, firewalls, or endpoint agents to protect customers.
Recommended Actions
- Inventory and document web‑filtering controls at DNS, firewall, proxy, and endpoint levels.
- Ensure each layer logs policy decisions and integrates with a central SIEM or compliance repository.
- Test common bypass methods (DoH, VPN, encrypted tunnels) and remediate gaps.
- Map the layered controls to the relevant VCF control objective (network traffic filtering & monitoring) and capture evidence for audit.
Technical Notes – The four enforcement points are:
- DNS filtering – blocks domain resolution; bypass via DNS‑over‑HTTPS or alternative resolvers.
- Network firewalls – enforce IP/port rules; may miss encrypted payloads.
- Web‑proxy / Secure Web Gateway – inspects HTTP/HTTPS; can be evaded with TLS‑termination or tunneling.
- Endpoint tools – host‑based URL filtering; vulnerable to local proxy settings or compromised agents.
Source: https://hackread.com/how-dns-firewalls-endpoint-tools-block-websites/