Setting Up Web Filtering Policies

Setting Up Web Filtering Policies

Web filtering policies are the core of KyberGate. They determine what students can and cannot access online. This guide walks you through creating, configuring, and deploying filtering policies for your school.

Before You Begin

• You need Admin access to the KyberGate dashboard
• Have a plan for your filtering strategy: what to block, what to allow, and whether policies differ by grade level, time of day, or device group
• Review the Understanding Content Categories article to familiarize yourself with KyberGate's category system

Understanding Policy Structure

Each filtering policy in KyberGate consists of:

1. Category Rules — Allow or block entire content categories (e.g., "Social Media," "Gaming," "Adult Content")
2. Domain Lists — Custom allow-lists and block-lists for specific domains
3. Keyword Filters — Block pages containing specific keywords
4. SafeSearch — Force safe search on Google, Bing, YouTube, and other search engines
5. Schedule — When the policy is active (school hours, after hours, or 24/7)
6. Assignment — Which devices or device groups the policy applies to

Step 1: Create a New Policy

1. Navigate to Web Filtering → Policies
2. Click Create New Policy
3. Enter a Policy Name (e.g., "Elementary Students," "High School Default," "Staff/Faculty")
4. Optionally add a Description to help other admins understand the policy's purpose

Step 2: Configure Category Filtering

KyberGate classifies websites into 50+ content categories powered by a database of over 1.3 million domains. For each category, you can set one of three actions:

• Allow — Let the traffic through
• Block — Show the KyberGate block page
• Flag — Allow the traffic but log it as a flagged event for review

Recommended category settings for K-12:

💡 Pro Tip: Use the Flag action for categories you're unsure about. This lets students access the content while giving you visibility into usage patterns to make informed policy decisions later.

Step 3: Add Custom Domain Rules

Beyond category filtering, you can add specific domains to allow or block:

1. In the policy editor, click Custom Domains
2. To allow a domain (override a blocked category): Add it to the Allow List
   • Example: Allow kahoot.it even though Gaming is blocked
3. To block a domain (override an allowed category): Add it to the Block List
   • Example: Block tiktok.com even though Social Media is set to Flag
4. Use wildcards: *.example.com blocks all subdomains of example.com

Step 4: Configure SafeSearch

1. In the policy editor, toggle SafeSearch Enforcement to ON
2. This forces safe search results on:
   • Google Search
   • Google Images
   • Bing
   • YouTube (Restricted Mode)
   • DuckDuckGo
3. KyberGate enforces SafeSearch at the proxy level — students cannot disable it

Step 5: Set the Policy Schedule

1. Click Schedule in the policy editor
2. Choose when this policy is active:
   • 24/7 — Policy applies at all times
   • School Hours Only — Uses your configured school schedule
   • After Hours Only — Applies only outside school hours
   • Custom Schedule — Define specific days and times
3. You can create separate policies for school hours and after hours with different filtering levels

Step 6: Assign the Policy to Devices

1. Click Assignment
2. Choose how to assign:
   • All devices — Every enrolled device uses this policy
   • Device groups — Assign to specific groups (e.g., "3rd Grade iPads," "Library Chromebooks")
   • Individual devices — Assign to specific devices
3. If a device matches multiple policies, the most restrictive policy takes priority

Step 7: Test with Policy Simulator

Before publishing:

1. Go to Web Filtering → Policy Simulator
2. Select your new policy
3. Enter test URLs and verify the expected behavior:
   • An educational site → Should be allowed
   • A gaming site → Should be blocked
   • A site on your allow list → Should be allowed
4. Adjust the policy if the results don't match your expectations

Step 8: Publish the Policy

1. Review all settings
2. Click Save & Publish
3. The policy will propagate to devices within 1–2 minutes
4. Monitor Activity Logs for the first hour to catch any unexpected blocks or allows

Troubleshooting

Policy not taking effect:

• Check that the policy is assigned to the correct device group
• Verify the device is online and checking in
• Wait 2–3 minutes for policy propagation

Sites being incorrectly categorized:

• Use the Domain Checker tool to see how KyberGate categorizes a domain
• Submit a recategorization request through the dashboard
• In the meantime, add the domain to your custom allow/block list

Multiple policies conflicting:

• KyberGate uses a "most restrictive wins" model when devices match multiple policies
• Check the device detail page to see which policy is active

Related Articles

• How Web Filtering Works in KyberGate
• Creating and Managing Filtering Policies
• Managing Bypass Domains
• SafeSearch Enforcement