Blocksi On-Premises Appliance
The Blocksi On-Premises Appliance filters and secures internet access for devices that cannot run the Blocksi agent. It combines a captive portal that establishes user identity with a DNS-based filtering engine that enforces filtering policy.
Dedicated hardware server - The Blocksi 1U physical appliance.
Virtual appliance - Deployed as a virtual machine on VMware (ESXi/vSphere) or Microsoft Hyper-V, on the district's existing virtualization infrastructure.
Managed Devices - Managed Chromebooks, Windows, iOS, and macOS devices run the Blocksi agent, which provides user-bound, URL-level filtering, along with granular YouTube controls.
Unmanaged, BYOD, and Guest Devices - Devices that cannot run the agent are covered by the On-Premises Appliance, which provides user- and group-based DNS filtering.
Note
The appliance enforces DNS-level filtering. It filters by domain and category; URL-path granularity remains with the Blocksi agent.
Both enforcement points are unified under the cloud-based Blocksi Manager Education Everywhere, which acts as a single control and reporting dashboard.
Policies are authored once on the Admin Dashboard and pushed to the appliance, and SSO, RADIUS, and SAML domain whitelists, as well as visitor-portal settings, are managed centrally on the dashboard in the same way. Appliance activity is reported alongside agent activity, providing a single view of the network. Because policy follows the user rather than the IP address, user-group-specific rule sets can coexist on one network, while identity-bound logging supports accountability, audit, and incident review.
Refer to the DNS On-Premises section for more information.
The Blocksi Appliance combines identity verification with policy enforcement and applies a fixed admission model to every device on a protected network.
What a user experiences on the network depends on how their device is admitted. Devices running the Blocksi agent, devices whose MAC address is whitelisted, and devices in a subnet with an assigned DNS policy are all admitted without seeing the captive portal. Everyone else must authenticate, and a device that does not is blocked by default.
The captive portal establishes a verified user identity before granting filtered access. It intercepts unauthenticated devices, verifies identity via single sign-on (SSO) or a visitor one-time passcode (OTP), and binds the authenticated user to the device.
Google SSO - Federated sign-in for Google Workspace, restricted to whitelisted domains.
Microsoft 365 SSO - Federated sign-in for Microsoft 365 / Entra ID, restricted to whitelisted domains.
SAML Active Directory - SAML federation against the district identity provider.
RADIUS Server - Authenticates users against a RADIUS server.
Visitor OTP - Self-registration with a one-time passcode delivered to the visitor's mobile device.
The appliance uses a fixed order of precedence to decide how to treat a device connected to the network. The conditions are evaluated from top to bottom, and the first match is applied.
Order | Condition | Result | Captive Portal |
|---|---|---|---|
1 | The Blocksi agent is present on the device | Pass through - user-bound policy assigned by agent | No |
2 | The device MAC address is whitelisted | Allow - full access, not filtered | No |
3 | The device is in a subnet that is added under Subnet Policies | Allow - subnet policy | No |
4 | The user authenticates via SSO | Allow - user-group policy | Yes |
5 | A guest self-registers | Allow - guest policy | Yes (OTP) |
6 | None of the above | Blocked | - |
Users on unmanaged devices that are not whitelisted and are not in a subnet with an assigned DNS policy must authenticate through the captive portal before they receive filtered internet access.
Unauthenticated traffic from the device is redirected to the captive portal.
The user authenticates with SSO, or a visitor completes one-time passcode (OTP) self-registration.
The verified identity is matched to a user-group policy.
The device receives filtered internet access under the matched policy.
When access expires, the device returns to the captive portal to authenticate again.
The appliance operates in one of two network modes. The admission model is the same in both; the enforcement mechanism differs.
Non-inline (out-of-path) - The appliance is the DNS resolver and captive portal off to the side of the data path. Clients are pointed at it for DNS via DHCP, the district firewall remains the default gateway, and the firewall prevents DNS bypass. This mode favors availability and low-risk operation, and one resolver can serve many VLANs.
Inline (in-path) - The appliance sits in the data path as the default route to the internet. All client traffic transits it, so enforcement is intrinsic and applied by the appliance's built-in default-deny behavior. This mode favors assured enforcement and requires high-availability planning, since the appliance is in the data path.
Network preparation and the deployment steps that precede Admin Dashboard configuration are carried out with the Blocksi team. This includes assigning the appliance as the DNS server for your client subnets, redirecting unauthenticated clients to the captive portal on your firewall, and deploying the appliance itself.
Contact our sales team at sales@blocksi.net for more information and deployment.
The appliance has its own configuration page, separate from the Blocksi Admin Dashboard. Use it during deployment to connect the appliance to Blocksi Manager and to confirm that the appliance is online before configuring filtering on the dashboard.
In a browser, go to
http://<appliance-ip>/config/auth-settings, replacing<appliance-ip>with the static IP address assigned to the appliance.Sign in with Google Login or M365 Login, using an account that has access to the Blocksi Admin Dashboard.
The Connection Status panel reports two indicators. Both must be green before the appliance can enforce cloud-managed policy.
Indicator | What it confirms | If it is red |
|---|---|---|
Blocksi DB | The Company ID and Access Token are recognized by Blocksi Manager. | Confirm the Company ID is correct and re-save the settings to reissue the Access Token. |
DNS Resolver | The appliance can reach the internet to resolve external lookups. | Confirm that the default gateway for the appliance's subnet is present and reachable. |
Click Retry connection next to an indicator to test it again.
The Blocksi Configuration panel binds the appliance to your organization. The Company ID is your organization identifier, and the Access Token is issued automatically when you sign in to the page with your SSO account.
Under Blocksi Configuration, confirm that the Company ID matches your organization.
Click Save Settings.
Confirm that the Blocksi DB indicator in Connection Status is green.
Note
The same connection is reported on the DNS On-Premises page of the Admin Dashboard, as Connection Status and Last Seen.
The Local IPs Configuration panel holds a list of local IP addresses. Enter an address in Add New IP Address and click Add New IP, or click Add Current Page IP to add the address you are browsing from. Each entry in the Local IP Addresses table can be edited or deleted.