Web/URL filtering and the Acceptable Use Policy portal
The SC//Reliant™ platform can run a web proxy directly on the node to control what internet destinations are reachable from each network at the store, and to require an Acceptable Use Policy (AUP) to be accepted before a device can browse. Both capabilities run on the same underlying proxy service.
Internet Content Control (URL and category filtering)
Internet Content Control (ICC) filters outbound web traffic by domain or content category. It's managed from its own page in RPM, under Services > Internet Content Control, alongside Firewall Policies — it's a standing platform feature, not a one-off or per-customer build. The policy list shows, for each ICC policy: Policy Name, Whitelisted URLs, Blacklisted URLs, Active Categories, and where it's enabled.
Policies, networks, and node groups
An ICC policy can be scoped by network and/or by fleet placement:
- Enabled in — a policy can be rolled out to whole Node Groups, individual Nodes, or a mix of both at once (a policy's "Enabled in" list commonly shows several node groups alongside several individual nodes).
- Network Name / IP Address / Network Segment — set at creation time to scope a policy to a specific network at those nodes (so a store's guest WiFi and its backoffice network can run different ICC policies). These fields are optional — a policy scoped purely by node group/node, with no network segment set, simply won't show that field on its detail page.
One policy can be flagged as the Default policy, which applies to networks that aren't otherwise matched by a more specific policy. ("Default" is also a common naming convention for policies in practice — a policy's actual behavior is controlled by the Default checkbox, not by having "default" in its name.)
Building a policy
| Field | Description |
|---|---|
| Policy Name | Required label for the policy. |
| Default | Marks this policy as the fallback applied when no more specific policy matches. |
| Network Name | A descriptive label for the network this policy applies to (optional). |
| IP Address / Network Segment | The network this policy filters, if scoped that way (with an Advanced Settings option for finer targeting; optional). |
| Enabled in / Node Groups | Which node groups and/or individual nodes this policy is rolled out to. |
| Redirect location | Where a user is sent when a request is blocked — for example http://my_2nd_pay_container_ip. Like other RPM fields, this accepts either a literal address or a reference to an existing RPM property. This is the landing page shown instead of a bare connection error. |
| Allow IP Addresses access | When checked, allows users on this network segment to browse directly to raw IP addresses rather than only named domains — since category and list matching is based on hostname, direct-IP requests would otherwise bypass or fail those checks. |
| Whitelist | Domains and/or URLs to always allow, one per line. |
| Blacklist | Domains and/or URLs to always deny, one per line. |
| Content Categories | A checkbox list of content categories to deny, chosen from a maintained set of 107 categories (for example, Adult, Alcohol, Malware). A policy's detail page shows how many of the 107 are active (for example, "1 of 107"). For the full current list, see the URL Blacklist reference in the product. |
| All Other Traffic | Allow or Deny — the default action applied to any request that doesn't match the whitelist, blacklist, or a denied category. |
Whitelist and blacklist entries take priority over category-based rules. Since most of the web is HTTPS, category and list matching works by reading the destination hostname from the TLS handshake rather than by decrypting page content.
Acceptable Use Policy (AUP) portal
The AUP portal is a captive-portal, or "splash page," experience: before a device on a covered network can reach the internet, it's shown a policy page and must actively accept it. This is most common on guest WiFi, but can also apply to backoffice or staff networks.
How it works for the end user:
- A device connects to a covered network and tries to browse to any site.
- Since the device has no active session yet, it's redirected to the store's AUP page instead of the site it requested.
- The AUP content shown can differ by network — for example, a guest-network AUP and a separate backoffice-network AUP.
- After the user accepts, a time-limited session opens for that device (commonly on the order of an hour, and configurable), and normal browsing resumes without further interruption until the session expires.
Because the AUP page is served locally by the node rather than fetched from the internet, this flow keeps working even during a degraded WAN connection, as long as the page content is already deployed to the site.
Other uses of the same proxy service
The same underlying caching proxy also supports two behind-the-scenes functions customers don't interact with directly:
- Platform package caching — caching software update packages locally at the site so repeated downloads don't consume WAN bandwidth.
- General web caching — caching frequently requested web content to reduce repeat downloads and improve perceived browsing speed.
Related articles
- Networking overview — VLAN segmentation and guest WiFi
- Firewall Rules & Policies in RPM