1/2
Youtube Blocking

xonivre Lv1Posted 2026-Sep-17 13:14

Hi all

I am using a Sangfor NSF-1100A-I running firmware version 8.0.95.

I would like to know the recommended and most reliable way to block YouTube and Facebook for users on specific VLANs or IP addresses.

My requirements are:

Block YouTube and Facebook completely for selected users/VLANs.
Allow YouTube and Facebook only for specific registered IP addresses.
Prevent users from bypassing the restriction by using HTTPS, mobile applications, or alternative domains.
If possible, automatically block or enforce the restriction using Application Control, URL Filtering, or another built-in security feature.
I would also like to know if there are any limitations or known issues with YouTube/Facebook blocking on firmware 8.0.95.

Could you please provide the exact configuration steps for firmware 8.0.95 and recommend which feature should be used?

Thank you.

By solving this question, you may help 86 user(s).

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

youssef Lv1Posted 2026-Sep-17 13:51
  
Hi,

Here's the recommended approach:

URL Filtering — configuration steps:

Object > Content Identification Database > URL Category — add a self-defined URL category with your domains (youtube.com, facebook.com).
Objects > Security Policy Template > Content Security — create a new template, select your custom category under URL Filtering.
Policy > Network Security > Policies — create a policy: LAN zone/subnet as source, WAN zone as destination, apply the Content Security template from step 2.

Precautions:

Single-arm/mirror mode does not support URL filtering — interface must be route or bridge mode.
Filtering works via domain checking (HTTP Host header / HTTPS SNI field), so it catches HTTPS without needing full decryption — but only at domain level.
Keep the URL database updated for best accuracy.

For your allow-list requirement:
Create a separate policy scoped to your registered IPs, placed above the block policy in the policy order, with the same URL category set to Allow.

For app-based bypass (mobile apps, non-browser traffic):
Layer Application Control alongside URL Filtering — it matches on app signatures rather than domain, catching cases plain URL filtering misses.

If bypass persists after this setup, I'd recommend opening a support ticket to check against known issues for your firmware build.

Hope this helps!
Humayun Ahmed Lv4Posted 2026-Sep-17 14:16
  
              INTERNET
                  │
                  ▼
        ┌───────────────────┐
        │ Sangfor NSF-1100A │
        │     8.0.95        │
        └─────────┬─────────┘
                  │
        ┌─────────┴──────────┐
        │                    │
   Approved IPs        Restricted VLAN
        │                    │
        ▼                    ▼
  ALLOW YouTube/FB      DENY YouTube/FB
                              │
                              ▼
                    URL Filter / HTTPS
                              │
                              ▼
                    VPN/Proxy Control

I Can Help:

Change

Board Leaders