FREEDOM251

Freedom251 › Internet Filtering Software

webfilter-ng

Free plan LinuxSelf-hosted

Visit webfilter-ng Alternatives

webfilter-ng's own site

What webfilter-ng is

webfilter-ng is free, open-source software for filtering web access on Linux computers, routers, and internet gateways. It filters HTTP by the Host field and HTTPS by reading TLS ClientHello SNI, so it can handle HTTPS without decrypting traffic or installing root certificates on client devices. The project is designed to work transparently, without client proxy settings. Filtering options include squidGuard, a public DNS filtering service, that service with the categorify.org API, or custom whitelists and blacklists. DNS mode compares requested IP addresses with those returned by the filtering service to identify non-filtering DNS routes, local hosts files, DoT, or DoH. Gateway setups can use the categorify.org API, whose current implementation is described as improving reliability only for adult-content filtering. BIND9 RPZ rules can enforce Bing and Google safe search. Installation targets Debian or Ubuntu and requires iptables and libnetfilter_queue. Logs are available at /var/log/webfilter-ng, and the project uses the LGPL-3.0 license.

Who it suits

It suits Linux administrators building filtering on a standalone computer, router, or gateway. It is aimed at setups needing transparent operation, custom lists, safe-search controls, or DNS-bypass checks.

What it does well

  • Filters HTTPS through SNI without decryption
  • Works without client proxy settings
  • Supports whitelists and blacklists
  • Provides safe-search controls through BIND9 RPZ
  • Free and licensed under LGPL-3.0

What to know first

  • IPv6 is not supported
  • Standard IETF QUIC is not filtered
  • Installation targets Debian or Ubuntu
  • Categorify API option is gateway-only

Verdict

webfilter-ng offers several domain-filtering methods while avoiding HTTPS decryption and client proxy configuration. Linux networking requirements and limits around IPv6 and QUIC should be considered before deployment.

Facts from webfilter-ng's own pages

Categorification
The categorify.org API option is gateway-only, and the README says its current implementation adds reliability only to adult-content filtering. · github.com, 5 Oct 2026
Categorification API
The categorify.org API option is available only for gateway filtering, and the README says its current implementation adds reliability only to adult content filtering. · github.com, 11 Oct 2026
Deployment
It is intended to run on a standalone Linux computer or as a router or internet gateway. · github.com, 11 Oct 2026
DNS bypass checks
With DNS filtering, webfilter-ng compares the requested website IP with IPs supplied by the DNS filtering service and blocks requests when they do not match. · github.com, 11 Oct 2026
Filtering methods
The project describes four usage options: squidGuard, a public DNS filtering service, DNS filtering plus the categorify.org API, or a whitelist or blacklist. · github.com, 11 Oct 2026
Filtering modes
The README describes filtering with squidGuard, a public DNS filtering service, that service with the categorify.org API, or a whitelist or blacklist. · github.com, 5 Oct 2026
HTTPS handling
It says HTTPS traffic can be filtered without decrypting it or installing root certificates on client computers. · github.com, 11 Oct 2026
Integrations
The README describes using a local BIND9 DNS resolver and DHCP distribution for gateway DNS filtering, and names CleanBrowsing as a DNS filtering service option. · github.com, 11 Oct 2026
IPv6 limit
The README says IPv6 is not yet supported and instructs users to disable it on the Linux computer or router. · github.com, 5 Oct 2026
License
The repository identifies the project license as LGPL-3.0. · github.com, 11 Oct 2026
Logs
The README gives /var/log/webfilter-ng as the location for logs. · github.com, 11 Oct 2026
Notable limits
The README says IPv6 is not yet supported and should be disabled on the Linux computer or router. · github.com, 11 Oct 2026
Platform requirement
Installation instructions specify Debian or Ubuntu and require Linux networking packages including iptables and libnetfilter_queue. · github.com, 5 Oct 2026
Platform requirements
The documented installation requirements are for Debian or Ubuntu and include build tools, iptables, and netfilter queue libraries. · github.com, 11 Oct 2026
Protocol limit
The README says standard IETF QUIC is not currently filtered; Google-QUIC support is described as work in progress. · github.com, 11 Oct 2026
Purpose
webfilter-ng filters HTTP and HTTPS web access by domain name using the HTTP Host field or TLS SNI. · github.com, 11 Oct 2026
QUIC limit
The README says standard IETF QUIC is not currently filtered; Google-QUIC support is described as experimental or work in progress. · github.com, 5 Oct 2026
Safe search
The README describes an optional gateway setup to enforce safe search on Bing and Google using a BIND9 RPZ zone. · github.com, 11 Oct 2026
TLS filtering
It reads TLS ClientHello SNI to filter HTTPS without decrypting traffic or installing root certificates on client computers. · github.com, 5 Oct 2026
Transparent operation
The README says filtering is transparent and client proxy settings are not needed. · github.com, 11 Oct 2026

Where webfilter-ng stands on Freedom251

Look at these too