Home Web Filtering

Web Filtering

By KyberGate and 1 other
• 12 articles

Understanding Content Categories

Understanding Content Categories KyberGate classifies websites into 130+ content categories using a curated database of over 1.3 million domains. Understanding these categories is essential for building effective filtering policies that keep students safe while allowing access to educational resources. Before You Begin - Familiarize yourself with your school's Acceptable Use Policy (AUP) - Review your district's CIPA compliance requirements - Know which grade levels and user groups you're filtering for How Categories Work Every domain in KyberGate's database is assigned one or more content categories. When a student visits a website, KyberGate checks the domain's category against the active filtering policy. If the category is blocked, the student sees the block page. Category Groups Categories are organized into logical groups for easier management: 🔴 Safety & Compliance (Typically Always Blocked) - Adult/Mature Content — Pornography, explicit material - Violence & Gore — Graphic violence, weapons - Drugs & Alcohol — Drug use, paraphernalia, alcohol - Gambling — Online casinos, betting sites - Malware & Phishing — Known malicious domains - Proxy/VPN/Anonymizer — Tools used to bypass filters 🟡 Discretionary (Policy-Dependent) - Social Media — Facebook, Instagram, TikTok, Snapchat - Gaming — Online games, game platforms (130+ domains) - Streaming — Netflix, Hulu, Disney+ - Chat & Messaging — WhatsApp Web, Discord, Telegram - AI Tools — ChatGPT, Claude, Gemini, Copilot 🟢 Typically Allowed - Education — Khan Academy, Coursera, educational publishers - Reference — Wikipedia, dictionaries, encyclopedias - Government — .gov sites, civic resources - Health — Medical information, health education - News — Major news outlets, current events - Technology — Developer resources, tech documentation Viewing and Browsing Categories 1. Navigate to Settings → Content Categories in the dashboard 2. Browse the full category list organized by group 3. Click any category to see: - Description of what the category covers - Number of domains in the category - Sample domains - Which policies currently block this category Multi-Category Domains Some domains belong to multiple categories. For example: - reddit.com → Social Media + Forum/Community - youtube.com → Streaming + Education + Social Media - discord.com → Chat & Messaging + Gaming When a domain has multiple categories, it is blocked if any of its categories are blocked in the active policy (unless the domain is on the Allow List). Custom Category Overrides If you disagree with how a domain is categorized: 1. Use the Domain Checker to see current categorization 2. Click "Report Miscategorization" to submit a review request 3. In the meantime, add the domain to your policy's Allow List or Block List for immediate effect Tips - Start with category groups: Block the Safety & Compliance group entirely, then selectively enable Discretionary categories based on your school's needs - Age-appropriate policies: Elementary schools typically block Social Media and Gaming; high schools may allow them during non-instructional time - Review quarterly: As new sites emerge and student behavior changes, revisit your category selections - Use the Policy Simulator: Test how category changes affect access before deploying to students Related Articles - Creating and Managing Filtering Policies - How Web Filtering Works in KyberGate - Using the Domain Checker

Last updated on Apr 17, 2026

YouTube Channel Blocking

YouTube Channel Blocking KyberGate goes beyond simple YouTube allow/block by letting you control access at the individual channel level. Block specific channels that are inappropriate while keeping YouTube available for educational content. Before You Begin - You need Admin or Policy Manager role - YouTube must be allowed in your filtering policy (if YouTube is fully blocked, channel-level controls don't apply) - Devices must be routing through the KyberGate proxy How YouTube Channel Blocking Works KyberGate inspects YouTube traffic at the URL level, identifying which channel a video belongs to. When a student tries to watch a video from a blocked channel, they see the KyberGate block page instead of the video. This works for: - Direct channel page visits (youtube.com/c/ChannelName) - Individual video pages from blocked channels - Embedded videos from blocked channels - YouTube Shorts from blocked channels Blocking a YouTube Channel 1. Navigate to Settings → Web Filtering → YouTube Controls 2. Click "+ Block Channel" 3. Enter the channel in one of these formats: - Channel URL: https://youtube.com/c/ChannelName - Channel ID: UCxxxxxxxxxxxxxxxx - Channel name: Search by name and select from results 4. Add an optional reason (e.g., "Inappropriate gaming content") 5. Choose which policies this block applies to 6. Click "Block Channel" Creating a Channel Allow List For maximum control, you can flip YouTube to Allow List mode: 1. Go to Settings → Web Filtering → YouTube Controls 2. Toggle "Allow List Mode" on 3. Only channels you explicitly add to the Allow List will be accessible 4. All other YouTube channels will be blocked This is ideal for: - Elementary school environments - Specific classroom assignments using curated video content - Standardized testing periods Managing Blocked Channels - View all blocked channels: See the full list with who blocked them and when - Search: Find channels by name in your blocked list - Bulk import: Upload a CSV of channel URLs to block many at once - Temporary unblock: Disable a block without deleting it Monitoring YouTube Activity KyberGate logs all YouTube activity for managed devices: - Which channels students visit - Which videos they watch (title and duration) - Search queries on YouTube - Attempted access to blocked channels View this data in Reports → Activity Logs filtered by "YouTube." Troubleshooting - Channel block not working? Verify the channel URL/ID is correct. Some channels have multiple URLs — try the channel ID format for reliability - Videos still playing? If the video is embedded on another site, ensure your proxy is inspecting that domain (not in the bypass list) - Too many channels to manage? Consider using Allow List mode instead of blocking individually Tips - Combine with Restricted Mode: Use SafeSearch enforcement for YouTube Restricted Mode alongside channel blocking for layered protection - Teacher requests: When teachers need specific channels, add them to the Allow List rather than removing blocks - Student reports: Check the Activity Logs to find channels students are accessing that should be blocked Related Articles - SafeSearch Enforcement - How Web Filtering Works in KyberGate - Understanding Content Categories

Last updated on Apr 17, 2026

Game Blocking and Detection

Game Blocking and Detection KyberGate includes specialized game detection that goes beyond simple domain blocking. With a curated list of 130+ gaming domains and advanced detection for browser-based games, KyberGate keeps students focused during instructional time. Before You Begin - You need Admin or Policy Manager role - Review your school's policy on gaming — some schools allow games during breaks or as rewards - Understand that some educational platforms use game-like elements (gamification) that you may want to allow What KyberGate Blocks Gaming Domains (130+) KyberGate maintains a curated list of known gaming sites, including: - Browser games: CoolMathGames, Poki, Y8, Kizi, Armor Games, Kongregate - Game platforms: Steam, Epic Games, Roblox, Minecraft.net - Mobile game sites: GamePigeon alternatives, io games (agar.io, slither.io, etc.) - Game-adjacent: Game wikis, cheat sites, game streaming (Twitch) - Proxy games: Sites that host games specifically to bypass school filters The list is updated regularly as new gaming sites emerge. Browser-Based Game Detection Many students find unblocked browser games hosted on obscure domains. KyberGate's advanced detection identifies: - HTML5/WebGL game content on otherwise uncategorized domains - Known game frameworks and engines running in the browser - Google Sites and other platforms hosting embedded games Enabling Game Blocking 1. Navigate to Settings → Filtering Policies 2. Select your policy 3. Go to the Categories tab 4. Enable the Gaming category toggle 5. Optionally enable Game Streaming to also block Twitch and similar platforms 6. Click "Save & Deploy" Schedule-Based Game Access Many schools allow gaming during lunch or free periods: 1. Create two policies: - "Instructional Hours" — Gaming category blocked - "Free Time" — Gaming category allowed 2. Set schedules for each policy: - Instructional: 8:00 AM – 12:00 PM, 1:00 PM – 3:00 PM - Free Time: 12:00 PM – 1:00 PM 3. Assign both to the same device group with the appropriate schedule Game Detection Dashboard Monitor gaming activity across your school: 1. Go to Reports → Activity Logs 2. Filter by Category: Gaming 3. View: - Which students are attempting to access games - Most popular gaming sites - Time of day gaming attempts occur - Which devices have the most gaming activity Handling New Game Sites Students are creative at finding new game sites. When you discover one: 1. Check if it's already in the Gaming category via the Domain Checker 2. If not, add it to your policy's Block List 3. Click "Report Miscategorization" to have it added to the global Gaming category 4. It will be categorized within 24 hours for all KyberGate customers Troubleshooting - Student found an unblocked game? Add the domain to your Block List immediately, then report it for global categorization - Educational game being blocked? Add the specific domain to your Allow List. Common examples: Kahoot, Quizlet Live, Prodigy - Google Sites games? These are tricky — enable browser-based game detection for best coverage, or block sites.google.com if your school doesn't use Google Sites Tips - Check activity logs weekly: Look at the Gaming category to spot trends and new game sites students are finding - Educate, don't just block: Pair technical controls with conversations about appropriate device use - Allow educational games explicitly: Maintain an Allow List of approved educational games (Kahoot, Prodigy, Quizlet, etc.) - Monitor "Proxy/VPN" category too: Students often use VPNs to bypass game blocks Related Articles - Understanding Content Categories - Creating and Managing Filtering Policies - Students Bypassing the Filter

Last updated on Apr 17, 2026

How Web Filtering Works in KyberGate

How Web Filtering Works in KyberGate KyberGate uses a cloud-based proxy architecture with SSL/MITM inspection to provide comprehensive web filtering for K-12 schools. This article explains the technology behind KyberGate's filtering engine and how it keeps students safe online. Overview Unlike traditional DNS-based filters that can only block entire domains, KyberGate inspects traffic at the URL and content level. This means you can allow YouTube.com while blocking specific channels, or permit Google searches while enforcing SafeSearch. How It Works 1. Proxy Architecture All web traffic from managed devices routes through KyberGate's cloud proxy network. The proxy sits between the student's device and the internet, inspecting each request in real time. - 8 global proxy regions with smart geo-routing for low latency - PAC file auto-configuration deployed via MDM — no manual setup on devices - SSL/MITM inspection decrypts HTTPS traffic for deep content analysis 2. Domain Database KyberGate maintains a curated database of 1.3 million+ domains organized into 130+ content categories. Each domain is classified and updated continuously. - Categories include: Adult Content, Gaming, Social Media, Streaming, Violence, Drugs, Gambling, and more - New domains are categorized within hours of discovery - Admins can override any categorization with custom allow/block rules 3. Real-Time Inspection When a student visits a website, KyberGate performs multiple checks: 1. Domain lookup — Is the domain in a blocked category? 2. URL path analysis — Is this specific page restricted? 3. Keyword scanning — Does the page content contain flagged terms? 4. SafeSearch enforcement — Are search engines forced to safe mode? 5. AI chat monitoring — Are AI tools being used appropriately? 4. Block Page When content is blocked, students see a branded block page with: - The reason the site was blocked - The content category that triggered the block - A "Request Access" button to ask their teacher or admin for an exception Filtering Modes | Mode | Description | |------|-------------| | Category-based | Block entire content categories (e.g., all Gaming sites) | | Domain-level | Block or allow specific domains | | Keyword | Block pages containing specific words or phrases | | Schedule-based | Apply different policies during school hours vs. after hours | Tips - Policy Simulator: Use the Policy Simulator in the dashboard to test how a URL would be handled before deploying changes - Bypass Domains: Add trusted domains to the bypass list to skip proxy inspection entirely (useful for internal school resources) - Game Detection: KyberGate blocks 130+ known gaming domains automatically when the Gaming category is enabled Related Articles - Creating and Managing Filtering Policies - Using the Domain Checker - SafeSearch Enforcement - Managing Bypass Domains

Last updated on Apr 17, 2026

Creating and Managing Filtering Policies

Creating and Managing Filtering Policies Filtering policies are the core of KyberGate's web filtering. A policy defines what content categories, domains, and keywords are blocked or allowed for a group of devices or students. Before You Begin - You need Admin or Policy Manager role in KyberGate - Ensure your devices are enrolled and assigned to device groups - Review the default policy to understand baseline filtering Creating a New Policy 1. Navigate to Settings → Filtering Policies in the KyberGate dashboard 2. Click "+ New Policy" in the top right 3. Enter a Policy Name (e.g., "Elementary School — Standard") 4. Optionally add a Description explaining the policy's purpose Step 1: Configure Category Blocks 5. In the Categories tab, you'll see all 130+ content categories 6. Toggle categories on (blocked) or off (allowed) 7. Common categories to block for K-12: - Adult Content, Gambling, Drugs, Violence, Weapons - Social Media (optional — many schools allow during breaks) - Gaming (blocks 130+ game domains automatically) - Proxy/VPN (prevents filter bypass attempts) Step 2: Add Custom Domain Rules 8. Switch to the Domains tab 9. Add specific domains to the Block List or Allow List 10. Use wildcards for subdomains: *.example.com blocks all subdomains 11. Domain rules override category settings (an allowed domain won't be blocked even if its category is blocked) Step 3: Configure Keyword Blocking 12. In the Keywords tab, add terms that should trigger a block 13. Keywords are matched against page content, not just URLs 14. Use phrases for accuracy (e.g., "how to make a weapon" vs. just "weapon") Step 4: Set Schedule 15. In the Schedule tab, define when the policy is active 16. Options include: - Always active — 24/7 filtering - School hours only — Define start/end times per day - Custom schedule — Different rules for different days Step 5: Assign to Groups 17. In the Assignment tab, select which device groups this policy applies to 18. A device can only have one active policy at a time 19. Click "Save & Deploy" to activate Managing Existing Policies - Edit: Click any policy name to modify its settings - Duplicate: Use the ⋯ menu → "Duplicate" to create a copy for a similar group - Disable: Toggle the policy off without deleting it - Delete: Remove the policy (devices revert to the default policy) Policy Priority When multiple policies could apply, KyberGate uses this priority order: 1. Classroom overrides (Focus/Restrict mode in KyberClassroom) 2. Device-specific policy (assigned directly to a device) 3. Group policy (assigned to the device's group) 4. Default policy (catches everything else) Tips - Test before deploying: Use the Policy Simulator to enter any URL and see how it would be handled under a policy - Start restrictive, then loosen: It's easier to allow sites teachers request than to chase down everything that should be blocked - Use descriptions: Future admins will thank you for explaining why a policy exists Troubleshooting - Policy not taking effect? Check that the device group assignment is correct and the device has synced recently - Site blocked that shouldn't be? Add it to the Allow List in the policy, or check if a keyword rule is triggering a false positive - Site allowed that should be blocked? Verify the correct category is enabled, or add the domain to the Block List manually Related Articles - How Web Filtering Works in KyberGate - Using the Domain Checker - SafeSearch Enforcement - Managing Bypass Domains

Last updated on Apr 17, 2026

Using the Domain Checker

Using the Domain Checker The Domain Checker is a built-in tool that lets you instantly look up how KyberGate categorizes any domain. Use it to verify filtering behavior, troubleshoot access issues, or check if a site is properly categorized before a teacher reports a problem. Before You Begin - You need any role in KyberGate (Viewer or above) - Access the Domain Checker from the dashboard sidebar under Tools → Domain Checker How to Use the Domain Checker 1. Navigate to Tools → Domain Checker in the KyberGate dashboard 2. Enter a domain name in the search field (e.g., coolmathgames.com) 3. Click "Check" or press Enter 4. Review the results: Results Breakdown The Domain Checker returns: - Domain: The full domain being checked - Category: The content category assigned (e.g., "Gaming", "Education", "Social Media") - Status: Whether the domain is currently Blocked, Allowed, or Bypassed - Policy Match: Which policy is causing the block/allow decision - Custom Rules: Whether any manual overrides exist for this domain - Last Updated: When the domain's categorization was last reviewed Checking Multiple Domains You can check multiple domains at once: 1. Click "Bulk Check" at the top of the Domain Checker 2. Enter up to 50 domains, one per line 3. Click "Check All" 4. Results are displayed in a table you can sort and export Requesting a Re-Categorization If you believe a domain is incorrectly categorized: 1. Check the domain using the Domain Checker 2. Click "Report Miscategorization" next to the result 3. Select the category you believe is correct 4. Add an optional note explaining why 5. Submit the request — KyberGate's team reviews recategorization requests within 24 hours Using Domain Checker for Troubleshooting The Domain Checker is your first stop when: - A teacher reports a site is blocked that shouldn't be - A student claims they can't access an educational resource - You want to verify a new policy is working correctly - You need to check if a game site is in the Gaming category Example Workflow Teacher: "My students can't access Khan Academy." You: Check khanacademy.org in Domain Checker → See it's categorized as "Education" → Check it's not in any Block List → Verify the device's policy allows Education → Identify the issue is a keyword rule blocking "academy" → Fix the keyword rule. Tips - Bookmark frequently checked domains: The Domain Checker keeps your recent search history for quick access - Use the Policy Simulator for deeper testing: The Domain Checker shows categorization; the Policy Simulator shows how a specific policy handles the URL - Check subdomains separately: docs.google.com and drive.google.com may have different categorizations Related Articles - How Web Filtering Works in KyberGate - Creating and Managing Filtering Policies - Students Bypassing the Filter

Last updated on Apr 17, 2026

SafeSearch Enforcement

SafeSearch Enforcement SafeSearch enforcement ensures that students always get filtered search results on major search engines, even if they try to disable SafeSearch manually. KyberGate enforces SafeSearch at the proxy level, making it impossible for students to bypass on managed devices. Before You Begin - You need Admin or Policy Manager role - Devices must be enrolled and routing traffic through the KyberGate proxy - SafeSearch enforcement is a per-policy setting How SafeSearch Enforcement Works KyberGate enforces SafeSearch by rewriting search engine requests at the proxy level: - Google: Appends &safe=active to all search queries and blocks access to Google search settings - Bing: Forces &adlt=strict parameter on all Bing searches - YouTube: Enables YouTube Restricted Mode, hiding age-inappropriate content and comments - DuckDuckGo: Forces &kp=1 safe search parameter Because enforcement happens at the proxy, students cannot disable it from their browser settings, search engine preferences, or browser extensions. Enabling SafeSearch Enforcement 1. Navigate to Settings → Filtering Policies 2. Select the policy you want to modify (or create a new one) 3. Go to the SafeSearch tab 4. Toggle "Enforce SafeSearch" to On 5. Select which search engines to enforce: - ✅ Google Search - ✅ Google Images - ✅ YouTube Restricted Mode - ✅ Bing - ✅ DuckDuckGo 6. Click "Save & Deploy" YouTube Restricted Mode YouTube Restricted Mode is a special case worth understanding: - What it does: Hides potentially mature videos based on YouTube's own content classification - Comments: Most comments are hidden in Restricted Mode - Live streams: Some live content may be restricted - Not perfect: YouTube's classification isn't flawless — some inappropriate content may slip through, and some educational content may be incorrectly restricted Combining with YouTube Channel Blocking For maximum control over YouTube, combine SafeSearch enforcement with KyberGate's YouTube Channel Blocking feature. This lets you: - Block specific YouTube channels by name or URL - Allow only approved educational channels - Monitor which YouTube content students are watching Verifying SafeSearch Is Working 1. On a managed device, go to google.com/preferences 2. The SafeSearch setting should show as locked (enabled and uneditable) 3. Try searching for known-blocked terms — results should be filtered 4. Check YouTube — the Restricted Mode indicator should appear at the bottom of the page Troubleshooting - SafeSearch not enforcing? Verify the device is routing through the KyberGate proxy (check the PAC file configuration) - YouTube Restricted Mode not active? Ensure the YouTube option is checked in the policy's SafeSearch settings - Search results still showing inappropriate content? SafeSearch isn't 100% — use keyword blocking as an additional layer for sensitive terms - Teacher needs unrestricted YouTube? Create a separate policy for teacher devices with YouTube Restricted Mode disabled Tips - Layer your protections: SafeSearch + keyword blocking + category blocking provides defense in depth - Educate teachers: Let them know SafeSearch is enforced so they understand why some search results differ from their personal devices - Monitor AI search: New AI-powered search features (Google AI Overviews, Bing Chat) are also filtered through KyberGate's SafeSearch enforcement Related Articles - How Web Filtering Works in KyberGate - Creating and Managing Filtering Policies - YouTube Channel Blocking

Last updated on Apr 17, 2026

Managing Bypass Domains

Managing Bypass Domains Bypass domains are websites that skip KyberGate's proxy inspection entirely. Traffic to these domains goes directly from the device to the internet without being filtered, inspected, or logged. Use bypass domains sparingly for sites that conflict with proxy inspection. Before You Begin - You need Admin role in KyberGate - Understand that bypassed domains are completely unfiltered — no blocking, no logging, no SafeSearch - Have a clear reason for bypassing (not just "a teacher asked") When to Use Bypass Domains Appropriate uses: - Sites with certificate pinning that break under SSL inspection (e.g., some banking or government sites) - Internal school resources hosted on private networks - Standardized testing platforms that require direct connections (e.g., certain state assessment tools) - Video conferencing tools that have quality issues through the proxy (e.g., Zoom, Google Meet) Inappropriate uses: - Sites a teacher wants unblocked → Use the Allow List in the filtering policy instead - Sites that are slow → Check proxy region settings before bypassing - "Just in case" entries → Every bypass is a gap in your protection Adding a Bypass Domain 1. Navigate to Settings → Network & Proxy → Bypass Domains 2. Click "+ Add Domain" 3. Enter the domain name (e.g., zoom.us) 4. Optionally add a note explaining why this domain is bypassed 5. Choose the scope: - All devices — Every managed device bypasses this domain - Specific groups — Only selected device groups bypass this domain 6. Click "Save" Wildcard Entries - zoom.us — Bypasses only the exact domain - *.zoom.us — Bypasses all subdomains of zoom.us - *.*.zoom.us — Not supported; use *.zoom.us instead Managing Existing Bypass Domains - View all: The bypass domain list shows each domain, who added it, when, and the note - Edit: Click the domain to change its scope or note - Disable temporarily: Toggle the domain off without deleting it - Delete: Remove the domain to resume proxy inspection Common Bypass Domains for Schools These domains frequently need bypassing in school environments: | Domain | Reason | |--------|--------| | *.zoom.us | Video conferencing quality | | *.webex.com | Video conferencing quality | | *.state.*.us | State assessment platforms | | *.collegeboard.org | SAT/AP testing | | *.air.org | Standardized testing (AIR) | | Internal domains | School-hosted resources | Auditing Bypass Domains We recommend reviewing your bypass list quarterly: 1. Go to Settings → Network & Proxy → Bypass Domains 2. Sort by Date Added to find old entries 3. For each entry, ask: "Is this still needed?" 4. Remove any entries that no longer have a valid reason 5. Document the review in your IT change log Troubleshooting - Bypass domain still being filtered? Ensure you included the correct subdomain pattern. Check that the device has synced its PAC file recently - Site works without proxy but not with bypass? The issue might not be the proxy — check the site's own firewall or IP restrictions - Too many bypass domains? If your list is growing beyond 20-30 entries, consider whether the proxy configuration or SSL certificate deployment needs attention Tips - Less is more: Every bypass domain is a blind spot in your filtering and monitoring. Keep the list minimal - Document everything: Always add a note explaining why a domain was bypassed. Future admins will thank you - Test after adding: Verify the bypass works by visiting the site on a managed device and confirming it no longer appears in activity logs Related Articles - How Web Filtering Works in KyberGate - Network and Proxy Settings - Certificate Installation Issues

Last updated on Apr 17, 2026

Approved Sites Only (Whitelist Mode)

Approved Sites Only (Whitelist Mode) KyberGate's Approved Sites Only mode (also called Whitelist Mode) lets administrators block all internet traffic by default and only allow access to explicitly approved domains. This is the most restrictive filtering mode available — ideal for schools that need maximum control over student internet activity. Overview KyberGate offers two filtering modes for every policy: | Mode | How It Works | Use Case | |------|-------------|----------| | Blocklist Mode (default) | Everything is allowed unless specifically blocked by category, domain, or keyword | Standard school filtering | | Approved Sites Only | Everything is blocked unless specifically approved | Maximum restriction, testing lockdowns, pilot programs | When Approved Sites Only is active, students can only access: - Domains you've explicitly added to the Approved List - Essential infrastructure (authentication, MDM, KyberGate itself) — automatically allowed Everything else — including sites that would normally pass through standard filtering — is blocked with a clear message: "This site is not on your school's approved list." Setting Up Approved Sites Only Step 1: Open the Policy Manager 1. Log in to the KyberGate Dashboard 2. Navigate to Filtering → Policy Manager in the left sidebar 3. Either create a new policy (click Create Policy) or edit an existing one Step 2: Switch to Approved Sites Only Mode 1. In the policy editor, go to the General tab 2. At the top, you'll see the Filter Mode section with two options: - 🛡️ Blocklist Mode — the default, everything allowed unless blocked - 🔒 Approved Sites Only — everything blocked unless approved 3. Click Approved Sites Only 4. A red warning banner will appear confirming the mode is active and showing your current approved domain count Step 3: Add Approved Domains Switch to the Filtering tab. You'll see the Approved Sites Only Mode panel at the top with: - Domain Bundles — pre-built collections of educational domains you can add with one click - Approved Sites List — the full list of individually approved domains Using Domain Bundles (Recommended) Domain Bundles are curated collections of domains for common educational platforms. Click any bundle to instantly add all its domains to your approved list: | Bundle | Domains | What's Included | |--------|---------|-----------------| | 🔵 Google Workspace | 28 | Docs, Sheets, Slides, Drive, Gmail, Classroom, Meet, Calendar | | 🟦 Microsoft 365 | 21 | Teams, Outlook, Word, Excel, PowerPoint, OneDrive, SharePoint | | 📚 Educational Platforms | 28 | Khan Academy, Quizlet, Kahoot, Newsela, IXL, BrainPOP, Duolingo, and more | | 🎓 Learning Management | 13 | Canvas, Schoology, Blackboard, Clever, ClassLink, PowerSchool | | 📝 Testing & Assessment | 20 | NWEA MAP, College Board SAT, ACT, i-Ready, SBAC, Illuminate | | 🔍 Research & Reference | 18 | Wikipedia, Britannica, Google Scholar, JSTOR, Library of Congress, NASA | | 💬 School Communication | 8 | Gmail, Outlook, Remind, ClassDojo, Seesaw | | 🧪 STEM & Coding | 13 | Code.org, Scratch, Tinkercad, PhET simulations, GeoGebra | | 📖 Library & Reading | 11 | Epic!, Sora/OverDrive, Follett Destiny, Gutenberg | | ⚙️ Essential Infrastructure | 22 | Auth providers, CDN, fonts, MDM, certificates | Tip: For most schools, start by adding Google Workspace (or Microsoft 365), Educational Platforms, LMS, and Essential Infrastructure. This gives students access to all major learning tools while blocking everything else. Adding Individual Domains 1. In the Approved Sites List section, type a domain (e.g., example.com) into the input field 2. Press Enter or click Add 3. The domain and all its subdomains (e.g., app.example.com) will be approved 4. You can also Import a list from a text file (one domain per line) or Export your current list Step 4: Target the Policy In the General tab under Targeting, choose who this policy applies to: - All — every device and user in your organization - Specific Users — select individual students or staff - Specific Groups — select organizational units (e.g., /Students/Grade 5) - Specific Devices — select individual iPads, Chromebooks, or laptops Common approach: Create an Approved Sites Only policy targeted at a specific grade level or group, while keeping standard blocklist filtering for the rest of the school. Step 5: Set a Schedule (Optional) You can schedule when the whitelist policy is active: - School hours only (e.g., 8:00 AM – 3:00 PM, Mon–Fri) - During testing windows (specific dates and times) - Always active — no schedule, the policy is always enforced Step 6: Save and Deploy Click Save (or Create for new policies). Changes propagate to all proxy servers within 60 seconds. A green toast will confirm: "Policy saved. Changes will propagate to all devices within 60 seconds." What's Automatically Allowed Even in Approved Sites Only mode, KyberGate automatically allows essential infrastructure so devices continue to function: - Authentication — Google SSO, Microsoft login, Clever, ClassLink, Canvas SSO - Apple infrastructure — MDM enrollment, push notifications, App Store, OCSP - MDM providers — Jamf, Mosyle, Kandji - KyberGate itself — Dashboard, proxy, admin panel - Certificates — OCSP validation for SSL certificates - CDN/Fonts — Google Fonts, jsDelivr, Cloudflare CDN You do not need to manually add these — they are always bypassed automatically. Using the Quick-Start Template The fastest way to set up Approved Sites Only is with the built-in template: 1. In Policy Manager, click Use Template 2. Select 🔒 Approved Sites Only (Whitelist) 3. The template pre-loads 40+ approved domains including Google Workspace, educational platforms, LMS systems, research sites, and essential infrastructure 4. Customize the list for your school's needs 5. Set targeting and schedule 6. Click Create Block Page for Whitelist Mode When a student visits a site that isn't on the approved list, they see a block page with the message: 🔒 This site is not on your school's approved list. Contact your teacher or IT administrator if you need access. If you've enabled Request Access in your block page settings, students can submit a request directly from the block page. Requests appear in Activity → Access Requests in the dashboard. Best Practices Start with Domain Bundles Don't try to build your approved list from scratch. Start with the relevant Domain Bundles and add individual domains as needed. Test Before Deploying School-Wide 1. Create the policy targeted at a test group of 5–10 devices 2. Monitor activity logs for blocked requests that should be allowed 3. Add missing domains to the approved list 4. Once stable, expand targeting to the full group Monitor the Activity Log After enabling whitelist mode, check Activity → Logs and filter by Blocked to see what's being denied. This helps you identify: - Educational sites you forgot to add - Domains needed by specific apps or platforms (e.g., CDN domains for a textbook platform) Combine with Other Policies You can have multiple policies at different priority levels: - Priority 1: "Testing Lockdown" (whitelist, targeted at testing devices, scheduled during test windows) - Priority 2: "Standard Filtering" (blocklist, for everyone else) Higher-priority policies are evaluated first. A whitelist policy at priority 1 will enforce approved-only access for its targets, while other devices follow the standard blocklist. Keep the Approved List Lean The power of whitelist mode is its restrictiveness. Resist the temptation to add hundreds of domains. A focused list of 50–100 educational domains is typically sufficient for most schools. Troubleshooting | Issue | Solution | |-------|----------| | All sites are blocked, including approved ones | Verify the policy is saved and enabled. Check that domains are in the Allowed List, not the Blocked List. Wait 60 seconds for propagation. | | Students can access sites not on the list | Check if another policy with higher priority is allowing those sites. Verify the whitelist policy's targeting matches the affected devices/users. | | Essential services (Google login, MDM) are blocked | These should be automatically bypassed. If not, contact KyberGate support — this may indicate a proxy version issue. | | Block page doesn't mention "approved list" | The proxy serving that device may need an update. Contact your KyberGate administrator. | | Domain bundles aren't appearing | Ensure your dashboard is on the latest version. Try a hard refresh (Ctrl+Shift+R). | Related Articles - Block Page Customization - Network and Proxy Settings - Configuring School Schedule - Students Bypassing the Filter

Last updated on Jun 09, 2026

Domain Bundles: Quick-Add Educational Platforms

Domain Bundles: Quick-Add Educational Platforms Domain Bundles are pre-curated collections of domains for common educational platforms and services. Instead of manually adding dozens of domains one by one, you can add an entire bundle with a single click. Where to Find Domain Bundles Domain Bundles appear in two places in the Policy Manager: 1. Approved Sites Only mode — When a policy is set to whitelist mode, bundles appear prominently at the top of the Filtering tab with full descriptions and add/remove toggles 2. Standard (Blocklist) mode — Bundles appear as compact quick-add buttons at the bottom of the Allowed List section Available Bundles 🔵 Google Workspace (28 domains) Everything your school needs for Google-based learning: - Core apps: Google Docs, Sheets, Slides, Drive, Gmail, Calendar - Classroom tools: Google Classroom, Google Meet, Google Forms, Google Sites - Collaboration: Google Chat, Google Keep, Jamboard - Infrastructure: Google Fonts, APIs, authentication, Play Store - Full list: google.com, googleapis.com, gstatic.com, googleusercontent.com, docs.google.com, sheets.google.com, slides.google.com, drive.google.com, mail.google.com, calendar.google.com, meet.google.com, classroom.google.com, chat.google.com, sites.google.com, forms.google.com, keep.google.com, jamboard.google.com, admin.google.com, accounts.google.com, fonts.googleapis.com, fonts.gstatic.com, ssl.gstatic.com, lh3.googleusercontent.com, play.google.com, clients1-4.google.com 🟦 Microsoft 365 (21 domains) For Microsoft-based schools: - Core apps: Word, Excel, PowerPoint (via Office Online) - Communication: Teams, Outlook - Storage: OneDrive, SharePoint - Authentication: Microsoft SSO, Azure AD - Full list: microsoft.com, microsoftonline.com, office.com, office365.com, live.com, outlook.com, sharepoint.com, onedrive.com, onenote.com, teams.microsoft.com, login.microsoftonline.com, login.live.com, cdn.office.net, officeapps.live.com, msftauth.net, msauth.net 📚 Educational Platforms (28 domains) Popular K-12 learning tools: - Core: Khan Academy, Quizlet, Kahoot, IXL, BrainPOP, Newsela - Interactive: Edpuzzle, Quizizz, Nearpod, Pear Deck, Flipgrid - Language: Duolingo, Memrise - Reading: CommonLit, ReadWorks - Coding: Scratch, Code.org, Codecademy - Science: CK-12, Desmos, PBS LearningMedia - Full list: khanacademy.org, quizlet.com, kahoot.com, kahoot.it, edpuzzle.com, newsela.com, brainpop.com, ixl.com, mobymax.com, prodigygame.com, readworks.org, commonlit.org, ck12.org, desmos.com, duolingo.com, quizizz.com, nearpod.com, peardeck.com, flipgrid.com, seesaw.me, padlet.com, scratch.mit.edu, code.org, codecademy.com, pbslearningmedia.org, natgeoed.org 🎓 Learning Management Systems (13 domains) LMS and SIS platforms: - Canvas, Schoology, Blackboard, Google Classroom - SSO: Clever, ClassLink - SIS: PowerSchool, Skyward - Other: Moodle, Brightspace, Edmentum 📝 Testing & Assessment (20 domains) Standardized testing platforms — critical during test windows: - National: NWEA MAP, College Board (SAT/AP), ACT - State: Smarter Balanced (SBAC/CAASPP), PARCC - Adaptive: i-Ready, Curriculum Associates - Other: Illuminate, Pearson, AIR - Tip: Combine this bundle with the "Testing Lockdown" template for a ready-made assessment policy 🔍 Research & Reference (18 domains) Safe research and reference tools: - Encyclopedias: Wikipedia, Britannica, World Book Online - Academic: Google Scholar, Google Books, JSTOR, EBSCO - Government: Library of Congress, National Archives, Census.gov, NASA - Science: Smithsonian, National Geographic, Nature, Science Magazine 💬 School Communication (8 domains) Parent-teacher and school communication tools: - Gmail, Outlook - Remind, ClassDojo, Seesaw - Bloomz, Talking Points 🧪 STEM & Coding (13 domains) Science, technology, engineering, and math tools: - Coding: Code.org, Scratch, CodeHS, Codecademy, Replit - Design: Tinkercad, Thingiverse - Science: PhET Simulations, GeoGebra, Stellarium - Math: Wolfram Alpha, Symbolab 📖 Library & Digital Reading (11 domains) Digital library and reading platforms: - School libraries: Epic!, Sora (OverDrive), Follett Destiny, Mackin VIA - Free resources: Project Gutenberg, Open Library - Audio: Audible, Storyline Online ⚙️ Essential Infrastructure (22 domains) Critical domains needed for devices to function — these are also automatically bypassed in whitelist mode, but adding them explicitly ensures compatibility: - Auth: Google, Microsoft, Clever, ClassLink SSO - Apple: MDM enrollment, push notifications, App Store - MDM: Jamf, Kandji, Mosyle - CDN: jsDelivr, Cloudflare - KyberGate: Dashboard, proxy, admin How to Add a Bundle 1. Open a policy in the Policy Manager 2. Go to the Filtering tab 3. Find the bundle you want and click it 4. All domains in the bundle are instantly added to your Approved List 5. A green ✓ Added badge appears on the bundle when all its domains are in your list How to Remove a Bundle Click a bundle that shows ✓ Added to remove all of its domains from your Approved List. Domains that were added individually (not from the bundle) will not be affected. Partial Bundles If you've manually added some domains from a bundle but not all, the bundle shows a blue badge with the count (e.g., "12/28") indicating partial coverage. Clicking it will add the remaining domains. Creating Custom Lists Domain Bundles cover the most common platforms, but every school is different. You can supplement bundles with individual domains: 1. Add domains one at a time in the Approved List input 2. Import a text file with one domain per line 3. Export your complete list to back it up or share with another school Tips - Start small: Begin with Google Workspace (or M365), Educational Platforms, and Essential Infrastructure - Add Testing bundles during test windows and remove them after - Export your list before making major changes — you can always re-import it - Check activity logs after enabling whitelist mode to find domains you may have missed Related Articles - Approved Sites Only (Whitelist Mode) - Block Page Customization - Configuring School Schedule

Last updated on Jun 09, 2026

Setting Up a Whitelist Pilot Program

Setting Up a Whitelist Pilot Program This guide walks you through planning and executing a pilot deployment of KyberGate's Approved Sites Only (whitelist) mode for a subset of your school before rolling it out broadly. Why Pilot First? Switching from standard blocklist filtering to Approved Sites Only is a significant change. A pilot helps you: - Identify missing domains before they affect the whole school - Get teacher feedback on which educational tools they rely on - Tune the approved list based on real usage data - Build confidence with administration before a school-wide rollout - Minimize disruption to daily instruction Phase 1: Planning (1–2 Days) Choose Your Pilot Group Select a small, manageable group to test with: - 5–10 devices in a single classroom or grade level - Choose an engaged teacher who will report issues quickly - Avoid high-stakes periods — don't start during testing windows or report card time Survey Teachers Before setting up the policy, ask pilot teachers: 1. What websites do you use daily for instruction? 2. What online textbook or curriculum platforms do students access? 3. Do students use any specific apps or tools for projects? 4. Do students need access to Google/Microsoft apps? 5. Are there specific research sites students regularly use? Compile their answers — these become your initial approved list. Gather Domain Requirements Based on teacher input, map their tools to domains. For example: | Teacher Says | Domains to Add | |-------------|---------------| | "We use Google Classroom" | Use the Google Workspace bundle (28 domains) | | "Students do Kahoot quizzes" | kahoot.com, kahoot.it — or use the Educational Platforms bundle | | "We use the Pearson textbook" | pearsonrealize.com, pearsoned.com, savvas.com | | "Kids research on Wikipedia" | Use the Research & Reference bundle | | "We do coding with Scratch" | Use the STEM & Coding bundle | Phase 2: Configuration (30 Minutes) Create the Whitelist Policy 1. Go to Filtering → Policy Manager in the KyberGate dashboard 2. Click Use Template → 🔒 Approved Sites Only (Whitelist) 3. Name it something clear: "Whitelist Pilot — Mrs. Johnson's Class" Add Domain Bundles Based on your teacher survey, add the relevant bundles: 1. Switch to the Filtering tab 2. Click each relevant bundle to add it: - ✅ Google Workspace (or Microsoft 365) — almost always needed - ✅ Educational Platforms — covers Khan Academy, Quizlet, Kahoot, etc. - ✅ Essential Infrastructure — auth, MDM, certificates - ➕ Add LMS, Testing, Research bundles as needed 3. Add any custom domains from your teacher survey Target the Pilot Group 1. In the General tab, go to Targeting 2. Select Specific Devices or Specific Groups 3. Choose only the pilot devices or group 4. This ensures the whitelist only affects the pilot — everyone else keeps standard filtering Set the Schedule For the pilot, consider: - School hours only (8:00 AM – 3:00 PM) so devices work normally at home - Weekdays only — toggle off Saturday and Sunday Save the Policy Click Create. The policy propagates to all proxy servers within 60 seconds. Phase 3: Active Pilot (1–2 Weeks) Day 1: Close Monitoring On the first day, actively monitor: 1. Activity Logs — Go to Activity → Logs, filter by Blocked 2. Watch for blocked requests to educational domains you may have missed 3. Have the pilot teacher report any sites that aren't loading 4. Add missing domains as they're discovered Common Day-1 Issues | Symptom | Likely Cause | Fix | |---------|-------------|-----| | Textbook platform won't load | Missing CDN domains | Check browser console for blocked requests, add the CDN domain | | Google Docs images missing | Need lh3.googleusercontent.com | Already included in Google Workspace bundle | | Login page won't work | Missing auth domain | Add the SSO/auth domain for that service | | YouTube blocked entirely | YouTube not in approved list | Add youtube.com, googlevideo.com, ytimg.com if needed | | Assessment app won't launch | Missing testing domain | Add the platform's domain or use the Testing bundle | Week 1: Monitoring and Adjusting - Check activity logs daily for the first week - Ask the pilot teacher for a daily "thumbs up / issues" report - Add domains as needed — the list stabilizes quickly (usually within 3–5 days) - Document every domain you add and why — this becomes your school's master approved list Week 2: Stability Check By week 2, the approved list should be stable: - Few or no teacher-reported issues - Activity logs show only expected blocks (social media, gaming, etc.) - Students are productively using allowed educational tools Phase 4: Evaluation and Expansion Metrics to Review After the pilot period, assess: 1. How many domains were added after the initial setup? (Fewer = better template coverage) 2. Teacher satisfaction — Did the teacher feel instruction was disrupted? 3. Student behavior — Were students more focused? Less off-task browsing? 4. Support tickets — How many "unblock this site" requests came in? 5. Activity log data — What blocked domains were students trying to access? Decision Points Based on the pilot: - Expand gradually — Add one grade level or department at a time - Adjust the approved list — Your pilot list becomes the foundation for school-wide deployment - Consider scheduling — Maybe whitelist mode during instruction time, standard filtering during free periods - Get admin buy-in — Share the activity data with your head of school or administration Expanding to More Groups 1. Open your pilot policy 2. In Targeting, add more groups or change to All 3. Or duplicate the policy and target different groups (useful if different groups need different approved lists) Sample Timeline | Day | Activity | |-----|----------| | Monday | Survey teachers, plan approved list | | Tuesday | Create policy, add bundles, target pilot group | | Wednesday | Go live — close monitoring, fix missing domains | | Thursday–Friday | Continue monitoring, add missed domains | | Week 2 | Stability check, minimal changes expected | | Week 3 | Evaluate results, decide on expansion | | Week 4+ | Gradual rollout to additional groups | Tips for Success - Communicate with teachers before enabling whitelist mode — surprises cause frustration - Keep a shared doc of approved domains so teachers can suggest additions - Use the Export feature to back up your approved list before making changes - Don't aim for perfection — start with major platforms and iterate - Check the block page — make sure students see a clear message about who to contact for access - Enable Request Access on the block page so students can self-service request new domains Related Articles - Approved Sites Only (Whitelist Mode) - Domain Bundles: Quick-Add Educational Platforms - Block Page Customization - Configuring School Schedule

Last updated on Jun 09, 2026

How to Block Social Media on Guest WiFi

KyberGate DNS filtering lets you block social media, gaming, and other unwanted content on any network — including guest WiFi — without installing any software on devices. Just point your network's DNS to KyberGate and every device that connects is automatically filtered. Step 1: Add Your Guest Network's IP 1. Log into your KyberGate dashboard 2. Go to Settings → Network 3. Under Campus IPs, click Add IP 4. Enter the public IP address of your guest WiFi network Tip: Not sure what your public IP is? From a device on the guest network, visit whatismyip.com. This is how KyberGate identifies which DNS queries belong to your school. Step 2: Configure Your DNS Servers On your guest network's router, firewall, or access point, change the DNS settings to: - Primary DNS: 134.209.114.127 - Secondary DNS: 64.23.131.224 Where to find DNS settings (by equipment): - Meraki: Security & SD-WAN → Addressing & VLANs → DNS - Ubiquiti/UniFi: Settings → Networks → [Guest Network] → DHCP DNS Server - Fortinet: Network → DNS - pfSense/OPNsense: System → General Setup → DNS Servers - Cisco: Use the ip name-server command on the interface Step 3: Prevent DNS Bypass Without this step, students can change their device's DNS settings to Google (8.8.8.8) or Cloudflare (1.1.1.1) to bypass filtering. On your firewall, add this rule: Block outbound DNS (UDP and TCP port 53) to all destinations except 134.209.114.127 and 64.23.131.224 This forces all DNS queries through KyberGate, even if a student manually changes their device settings. That's It! Once configured, every device that connects to your guest WiFi will automatically be filtered. Social media, gaming, adult content, and any other categories you've blocked in your KyberGate policies will be enforced — no agents, no enrollment, no MDM required. What Gets Blocked? Whatever categories you've enabled in your KyberGate dashboard under Policies. Common categories for guest networks include: - Social Media (TikTok, Instagram, Snapchat, etc.) - Gaming (Roblox, Steam, browser games) - Streaming (Netflix, YouTube — optional) - Adult Content (always blocked by default) - VPN/Proxy (prevents filter bypass) Frequently Asked Questions Does this work on personal phones and laptops? Yes. DNS filtering works on any device that connects to the network — no software needed. Will students see a block page? Yes. When a blocked site is accessed, students see a KyberGate block page explaining the site is restricted. Can I allow specific sites? Yes. Add them to your Allowed Domains list in the dashboard under Policies.

Last updated on Jul 09, 2026