Overview

This FAQ addresses the technical implementation of URL keyword filtering on Optical Network Terminals (ONTs) to block adult content access in enterprise and carrier-grade deployments. The focus is on CLI-based configuration, integration with existing firewall ACLs, and the operational realities of filtering encrypted traffic at the CPE level.

Frequently Asked Questions

Q1: What is the basic CLI command syntax to enable URL keyword filtering on an ONT?

The basic CLI workflow requires entering the firewall or security configuration context and applying a URL filter rule to the target interface. The exact syntax varies by ONT vendor and chipset. A representative workflow involves entering privileged exec mode, accessing the firewall context, and issuing a command similar to firewall url-filter add deny [keyword] or url-filter apply policy [policy-name] . Most carrier-grade ONTs apply these rules at the firewall layer, intercepting HTTP requests before they are forwarded to the WAN interface. Always verify the specific command reference for your ONT model, as unsupported syntax can disrupt management plane connectivity.

Q2: How does URL keyword filtering differ from domain-based blocking on an ONT?

URL keyword filtering matches any request containing the specified string anywhere in the URL path, whereas domain-based blocking only matches the hostname. This means a keyword filter for a term like "adult" would block example.com/adult/content even if the domain itself is not on a blocklist . Domain blocking is more precise and resource-efficient, while keyword filtering offers broader coverage at the cost of potential false positives. For adult content prevention, a hybrid approach (domain blocklist plus keyword filters for known evasion patterns) provides the best balance of coverage and accuracy.

Q3: Does URL keyword filtering work on HTTPS traffic without SSL inspection?

No, URL keyword filtering cannot inspect the path or content of HTTPS requests without SSL/TLS interception, because the URL path is encrypted within the TLS tunnel. The ONT can only see the destination IP address and, in some cases, the SNI (Server Name Indication) hostname during the TLS handshake . To block adult content over HTTPS, operators must rely on domain-level blocking using SNI inspection, DNS-based filtering, or deploy a proxy with SSL bump capability. Keyword-based path filtering is only effective for plaintext HTTP traffic unless the ONT is configured with a trusted intercept certificate on client devices.

Q4: How do I integrate URL filtering rules with existing ACLs on the ONT?

URL filtering policies are typically applied to interfaces or subscriber profiles after ACLs have been evaluated. The standard order of operations is: ACL (Layer 3/4 match) → URL filter (Layer 7 match) → forwarding decision. On CLI-based systems, you apply the URL filter policy to the same interface or DPI application profile where the ACL is attached . For example, a configuration might bind an ACL to the WAN interface for basic traffic control, then apply a URL filter policy to the same interface for content restrictions. Verify that your ONT supports policy chaining, as some low-end models process URL filters only after ACLs have already permitted the flow.

Q5: What happens to URL filtering when the ONT fails over to a redundant power supply?

URL filtering configuration and runtime state are preserved across power supply failover on enterprise-grade ONTs because the configuration is stored in non-volatile memory and the forwarding plane remains active during the transition. A well-designed ONT with dual AC/DC power supplies maintains uninterrupted URL filtering operation during a single PSU failure, with failover occurring in milliseconds without dropping established filter sessions . However, if the failover triggers a full system reload (which should not occur in proper redundant configurations), URL filter caches may be cleared and must be repopulated from the filter list source. Always verify that your ONT's power redundancy is configured for hot standby rather than load-sharing with failover reload.

Q6: Can I apply URL keyword filters only to specific subscriber VLANs or SSIDs?

Yes, URL filter policies can be scoped to specific interfaces, VLANs, or subscriber profiles rather than applied globally. On carrier-grade ONTs, the URL filter policy is typically attached to a DPI application profile or a subscriber service profile that is referenced by the target VLAN or SSID . This allows operators to enforce adult content filtering only for guest networks, K-12 education VLANs, or public Wi-Fi SSIDs while leaving administrative or trusted networks unfiltered. The granularity of scoping depends on the ONT's policy engine; some models support per-subscriber filtering via RADIUS attributes or local service profiles.

Q7: How do I troubleshoot URL filtering rules that are not blocking adult content?

First, verify that the filter policy is actually bound to the correct interface or subscriber profile, as an unbound policy has no effect. Second, check whether the traffic is HTTP or HTTPS; keyword filters will not match HTTPS paths without SSL inspection. Third, confirm the URL filter cache has been populated and the policy engine has committed the configuration (some ONTs require an explicit engine configuration commit or policy activation command) . Finally, review the ONT logs for URL filter hit counters or drop statistics to determine whether the rule is being evaluated at all; if counters are not incrementing, the traffic may be bypassing the filter due to ACL precedence or offloading to hardware acceleration paths that skip Layer 7 inspection.