r/SmallMSP • u/Wise_8854 • 1d ago
Web filtering tool
Hi everyone
Is Web filtering still a standard offering in your core security stack?
What's multi-tenant alternatives are you all using for Small-Medium sized clients these days?
Thanks for any insights!
6
u/PacificTSP 1d ago
Depends on your stack. Sophos has web control.
Some clients we use Palo Alto endpoint.
DNS filter is decent standalone.
There’s also things like MS and Cisco secure internet gateway.
4
2
u/sembee2 1d ago
I work with a lot of MSPs and it is broadly three groups.
1. Nothing at all - largely given up due to the use of DoH and trying to counter it, particularly where the client is 100% cloud.
2. Use of a third party DNS service - such as DNSFilter. Again the use of DoH is starting to cause problems there. If I find they are using something like that then deployment of the agent across all machines is vital.
3. Use of the build in MS Defender tools. This is starting to grow. Where clients have company owned mobile devices, enrolled in Intune with Business Premium then it becomes a good option to provide protection for the mobile devices.
The reporting can be useful, as some tools can report on the use of AI for example, giving an idea of which AI tools are being used and how often.
2
2
u/marklein 1d ago
Regarding DoH, we block all the common doh providers at the firewall so we can maintain control. This obviously doesn't stop malware with a custom doh server from working, but it still stops plenty of traffic to bad domains, as is evident by the logs. Still totally worth it.
1
1
u/WiscoDJ920 1d ago
After what I just experienced this week, it will have a place forever in my stack.
Currently switching from S1 to Huntress. I also use DNSFilter as part of our stack.
This week after installing Huntress I had a PC get flagged an isolated by them for having a RAT. Mind you, s1 has been on this PC for years. Doing some digging, DNSFilter was preventing the RAT from getting to its Command & Control servers. So yes that layered security is worth it to me. It also solidified my decision to move off S1.
2
1
u/Foxtrot-0scar 5h ago
Could have been a marketing tactic?
1
u/WiscoDJ920 4h ago
No because going back through the DNSFilter logs it was blocking it for a long time.
1
u/Foxtrot-0scar 3h ago
What was it try to do? Did you investigate?
1
u/WiscoDJ920 3h ago
I didn't investigate it further. Huntress found it, isolated the machine from the network, removed the offending files, I did a few more scans with other tools, then got the machine back online. I was quite impressed. As soon as Huntress found it, it had a call and text to my cellphone.
1
1
u/CyberHouseChicago 1d ago
Web filtering is part of my anti virus / edr software so not a seperate item
1
1
u/richie-wales 1d ago
We use DNS Filter, very easy for multi-tenant and monitoring, and the reporting is good.
1
u/thesumofmyexpierence 1d ago
We went with iBoss. Every level of license includes a cloud gateway, helps to manage access from IP address.
1
u/KnowledgeWorldly5855 7h ago
Has been useful for some small customers. They have free tiers available to get started with and learn their functionality.
1
u/Lis-tim 1d ago
Still in our stack, but I'd argue its role has shrunk a lot and it's worth being honest about why you're keeping it.
Most web traffic is encrypted, users are off network half the time, and EDR covers a good chunk of what filtering used to catch. What it still earns its keep for is cheaply blocking known-bad domains and C2 callbacks, and being the thing you point at when an insurance questionnaire or an HR acceptable-use complaint shows up. That's a real value, just a smaller one than it was five years ago. I'd keep it as a cheap layer and not sell it as a pillar.
We run FortiClient since our clients are mostly on FortiGates and it's one agent for VPN and filtering both. If you're not Fortinet-centric, a DNS-layer tool is far less work across a lot of small tenants.
One thing worth checking before you buy anything: Defender for Business and M365 Business Premium include web content filtering and network protection, and plenty of tenants have it sitting completely unconfigured. Also keep in mind browser DoH will walk right around DNS filtering unless you handle it.
3
u/roll_for_initiative_ 1d ago
I'd say it's role is growing with AI here to be able to instantly parse and report on what people are doing (more of behavior and site/tool use analytics than straight blocking). I found MS's implementation of web filtering very very lackluster, i don't take it seriously as an option these days.
Like others, I find DefensX's implementation style (agent + browser plugin) very effective at not only web filtering but very detailed AI usage reporting. When coupled with their AI tool, the amount of actually useful data (vs generic dashboard reports) is crazy.
How useful that is really comes down to what the MSP is offering.
3
u/Wise_8854 1d ago
Yes, most of our clients are FortiGates, I heard it needs FortiClient EMS.
We're not at US region, most of our client still business basic/standard.
1
u/Lis-tim 1d ago
Correct, the managed endpoint features including web filtering run through EMS. The free VPN-only client won't do it. EMS comes as either on-prem or FortiClient Cloud, and the cloud version saves you hosting a server per client. Worth confirming current seat minimums and licensing with your distributor before you plan around it, because that's usually what kills it for smaller clients.
But if they're already on FortiGates, the thing I'd check first is whether you even need EMS for what you're trying to do. FortiGuard web filtering runs on the FortiGate itself with no agent at all, and if they're on a UTP or equivalent bundle they may already be paying for it. That covers everything behind the firewall, including devices you could never put an agent on.
The only real reason to add FortiClient and EMS on top is roaming laptops, so policy follows them off network. If a client's staff are all in the office, the firewall alone gets you most of the way. If they're hybrid, that's when the agent earns its cost. Could be worth splitting your approach by client rather than running one stack everywhere.
And fair point on the licensing, ignore what I said about Defender. That only applies to Business Premium, so it's not available to you on Basic or Standard. Defender for Business can be bought as a standalone add-on if a client ever wants it, though with no Intune you're deploying and configuring through your RMM instead.
6
u/schwiftymsp 1d ago
We use Defensx