Google SafeSearch with CNAME

Scenario:

A school would like to have filtered various images from search engines. An easy way to do this is to integrate Google SafeSearch.

Set up Google SafeSearch

While filtering websites through the content filter is easy to implement, removing inappropriate images from search engine results requires much more effort. In the course of "schools to the Internet" the search engines Google and Bing offer a possibility to activate SafeSearch mode on network level. The client has no way to disable this mode in this case. Thus, image queries can be filtered without much effort.

In this example, we'll show how Google SafeSearch can be used at the network level. SafeSearch is activated here for all clients in LAN1.

First, make sure that the LAN1 zone uses the Zywall DNS server:

Configuration> Network> Interface> Ethernet> LAN1

To do this, ZyWALL is selected as First DNS Server:

Next, the necessary redirection is created in the DNS settings.
The CNAME records are used for this:

Configuration> System> DNS> CNAME Record

For each desired country domain, a CNAME record must be recorded.

To block all other countries, an appropriate content filtering profile must be created.

All addresses that should be admitted are recorded here and confirmed with Apply.

Configuration> Security Service> Content Filter> Trusted Web Site

To apply the rule you just created, it must be specified in the content filter profile.

Configuration> Security Service> Content Filter> Content Filter Profile 

- Open the desired profile.

- Enable "SafeSearch" and check the box next to "Search Engine". This will block all search engines except those you added to trusted web sites in the previous step.


Also, check that "Custom Service" and "Check Common Trusted/Forbidden List" are checked.
Click "Ok" to have the changes applied.

The profile has been saved. A profile takes effect only when it is applied to a security policy.

To prevent a DNS server other than the USG from being used,
the DNS service group is blocked from the LAN zone. For this purpose, the predefined
DNS group can be used.Configuration> Security Policy> Policy Control> Add

Google SafeSearch is now enabled on the USG and not registered. Country domains are being blocked:

CNAME also limits Bing and YouTube. At these services the CNAME entry is enough:

KB-00359 Original Version

DISCLAIMER:
Dear customer, please be aware that we use machine translation to provide articles in your local language. Not all text may be translated accurately. If there are questions or discrepancies on the accuracy of information in the translated version, please review the original article here: