I've been looking everywhere for this. Does anyone know how to block a specific URL on a DD-WRT router? For example, I want to block website.com/whatever but not website.com, blah.website.com, or website.com/blah. Is there a way to do this, or can you only block the whole domain?

I tried adding the URL in question under Access Restrictions in the DD-WRT configuration but it doesn't seem to have any effect. Here are my settings:

enter image description here

and here is the list of clients:

enter image description here

I can still easily browse to google.com/imghp and google.com/images (which redirects to google.com/imghp) on my main PC with IP address

On this page of the DD-WRT wiki, it says "Under Website Blocking by URL Address, enter in the domain name(s) you wish to block (if any)." This, in addition to posts on the DD-WRT forums, gives me the impression that you can only block domains under Access Restrictions in the DD-WRT setup.

I'm starting to wonder if this problem must be solved using iptables, or possibly by installing a proxy server on the router itself.


User goli on the DD-WRT forums had this to say on the matter (link):

There's a Privoxy version that runs on DD-WRT quite well. I just installed it.

Privoxy has a parameter "accept-intercepted-requests 1" that allows to use it as a transparent proxy.

I added a single iptables rule that passes some web traffic requests to the proxy instead of directly routing it:

iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -s -j DNAT --to    

Privoxy has so called "actionfiles." Those define what to do when a request URL matches a given regular expression. One of the possible actions is "block."

Since then, I've been working on figuring out how to install Privoxy on the router. It's rather complicated, especially since I don't have enough spare flash memory to install it via SSH using ipkg. (See this question on Super User.)

My second approach is to use the Firmware Modification Kit, which you can read about here. I've had some difficulty flashing a custom build, but once I get it all sorted out I'll post my results here.

  • The url request path is part of the encrypted portion of an https request, which shouldn't be visible to the router. Dec 26, 2018 at 2:41

4 Answers 4


Unfortunately, the impression I get (from the DD-WRT forums) is that you can only block domains under Access Restrictions in the DD-WRT setup.

I've decided instead to set up a dedicated proxy server with DansGuardian installed on it, which will allow me a fine level of control, and block any requests that don't go through the proxy on the router using iptables in OpenWrt.


Perhaps I'm answering too late, but I have found a way to do what you want. Instead of adding the URL you wish to block in the "URL" category, add it to the "Keyword" category. This works fine for me.


Follow these steps:

  • Go to the "Access Restrictions" tab in the dd-wrt web interface
  • Enable the policy
  • Set the name (e.g. "Block Youtube")
  • Edit the list of clients to specify which machines should be blocked from accessing YouTube

    To block all machines, use the "IP Range" at the bottom to specify all IPs except the router's (typically .1) and broadcast (.255)

  • Set the days/hours you want blocked, or "Everyday" to block it all the time
  • Under "Website Blocking by URL Address", enter facebook.com
  • Click "Save", and then "Apply Settings"

There's a YouTube video that shows each step if you need it.

  • 1
    Doh! I didn't realize I had to ENABLE the policy. I'd be happy to mark your answer as the correct one if you don't mind filling in the details. Sep 9, 2012 at 19:34
  • A mere link to a video is definitely not acceptable as an answer. It may be a basis for an answer, but you must explain in words. Sep 9, 2012 at 20:46
  • @davidkennedy85 Should be good now Sep 9, 2012 at 21:40
  • 2
    Hold on... I set policy 1 to enabled, named it, every day, 24 hours, IP range, added google.com/images and google.com/imghp, but they still aren't blocked. Sep 9, 2012 at 23:57
  • I was missing both "enable" and the IP Address range. Non-beardy-geeks would just assume these would be the default, and that all you need is enter the URLs and hit 'Apply'. But that would be too easy!
    – Greg Woods
    Oct 9, 2021 at 10:08

These things did not work for my router WRT3200ACM, even though I am able to put the information into the boxes. I even specified the IP addresses, still able to browse to youtube from anything on the network. It's like it is a dead part of the application that shows in my dd-wrt application, but nothing happens. Even selecting all port ranges does not work.

I had to use OpenDNS, and that works, but on entire network. Firewall rules are supposed to work, but do not, so I can assume that this firmware upgrade is not complete or has not been truly tested.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.