Approved Sites Only (Whitelist Mode)

KyberGate's Approved Sites Only mode (also called Whitelist Mode) lets administrators block all internet traffic by default and only allow access to explicitly approved domains. This is the most restrictive filtering mode available — ideal for schools that need maximum control over student internet activity.

Overview

KyberGate offers two filtering modes for every policy:

When Approved Sites Only is active, students can only access:

• Domains you've explicitly added to the Approved List
• Essential infrastructure (authentication, MDM, KyberGate itself) — automatically allowed

Everything else — including sites that would normally pass through standard filtering — is blocked with a clear message: "This site is not on your school's approved list."

Setting Up Approved Sites Only

Step 1: Open the Policy Manager

1. Log in to the KyberGate Dashboard
2. Navigate to Filtering → Policy Manager in the left sidebar
3. Either create a new policy (click Create Policy) or edit an existing one

Step 2: Switch to Approved Sites Only Mode

1. In the policy editor, go to the General tab
2. At the top, you'll see the Filter Mode section with two options:
   • 🛡️ Blocklist Mode — the default, everything allowed unless blocked
   • 🔒 Approved Sites Only — everything blocked unless approved
3. Click Approved Sites Only
4. A red warning banner will appear confirming the mode is active and showing your current approved domain count

Step 3: Add Approved Domains

Switch to the Filtering tab. You'll see the Approved Sites Only Mode panel at the top with:

• Domain Bundles — pre-built collections of educational domains you can add with one click
• Approved Sites List — the full list of individually approved domains

Using Domain Bundles (Recommended)

Domain Bundles are curated collections of domains for common educational platforms. Click any bundle to instantly add all its domains to your approved list:

Tip: For most schools, start by adding Google Workspace (or Microsoft 365), Educational Platforms, LMS, and Essential Infrastructure. This gives students access to all major learning tools while blocking everything else.

Adding Individual Domains

1. In the Approved Sites List section, type a domain (e.g., example.com) into the input field
2. Press Enter or click Add
3. The domain and all its subdomains (e.g., app.example.com) will be approved
4. You can also Import a list from a text file (one domain per line) or Export your current list

Step 4: Target the Policy

In the General tab under Targeting, choose who this policy applies to:

• All — every device and user in your organization
• Specific Users — select individual students or staff
• Specific Groups — select organizational units (e.g., /Students/Grade 5)
• Specific Devices — select individual iPads, Chromebooks, or laptops

Common approach: Create an Approved Sites Only policy targeted at a specific grade level or group, while keeping standard blocklist filtering for the rest of the school.

Step 5: Set a Schedule (Optional)

You can schedule when the whitelist policy is active:

• School hours only (e.g., 8:00 AM – 3:00 PM, Mon–Fri)
• During testing windows (specific dates and times)
• Always active — no schedule, the policy is always enforced

Step 6: Save and Deploy

Click Save (or Create for new policies). Changes propagate to all proxy servers within 60 seconds. A green toast will confirm: "Policy saved. Changes will propagate to all devices within 60 seconds."

What's Automatically Allowed

Even in Approved Sites Only mode, KyberGate automatically allows essential infrastructure so devices continue to function:

• Authentication — Google SSO, Microsoft login, Clever, ClassLink, Canvas SSO
• Apple infrastructure — MDM enrollment, push notifications, App Store, OCSP
• MDM providers — Jamf, Mosyle, Kandji
• KyberGate itself — Dashboard, proxy, admin panel
• Certificates — OCSP validation for SSL certificates
• CDN/Fonts — Google Fonts, jsDelivr, Cloudflare CDN

You do not need to manually add these — they are always bypassed automatically.

Using the Quick-Start Template

The fastest way to set up Approved Sites Only is with the built-in template:

1. In Policy Manager, click Use Template
2. Select 🔒 Approved Sites Only (Whitelist)
3. The template pre-loads 40+ approved domains including Google Workspace, educational platforms, LMS systems, research sites, and essential infrastructure
4. Customize the list for your school's needs
5. Set targeting and schedule
6. Click Create

Block Page for Whitelist Mode

When a student visits a site that isn't on the approved list, they see a block page with the message:

🔒 This site is not on your school's approved list. Contact your teacher or IT administrator if you need access.

If you've enabled Request Access in your block page settings, students can submit a request directly from the block page. Requests appear in Activity → Access Requests in the dashboard.

Best Practices

Start with Domain Bundles

Don't try to build your approved list from scratch. Start with the relevant Domain Bundles and add individual domains as needed.

Test Before Deploying School-Wide

1. Create the policy targeted at a test group of 5–10 devices
2. Monitor activity logs for blocked requests that should be allowed
3. Add missing domains to the approved list
4. Once stable, expand targeting to the full group

Monitor the Activity Log

After enabling whitelist mode, check Activity → Logs and filter by Blocked to see what's being denied. This helps you identify:

• Educational sites you forgot to add
• Domains needed by specific apps or platforms (e.g., CDN domains for a textbook platform)

Combine with Other Policies

You can have multiple policies at different priority levels:

• Priority 1: "Testing Lockdown" (whitelist, targeted at testing devices, scheduled during test windows)
• Priority 2: "Standard Filtering" (blocklist, for everyone else)

Higher-priority policies are evaluated first. A whitelist policy at priority 1 will enforce approved-only access for its targets, while other devices follow the standard blocklist.

Keep the Approved List Lean

The power of whitelist mode is its restrictiveness. Resist the temptation to add hundreds of domains. A focused list of 50–100 educational domains is typically sufficient for most schools.

Troubleshooting

Related Articles

• Block Page Customization
• Network and Proxy Settings
• Configuring School Schedule
• Students Bypassing the Filter