Parental guardian - internet (WEB) filtering

[Tim Watts]

Please, no debates about the merits of this -

I'm having trouble trying to find anything that might work.

DNS based: ========== OpenDNS

is going to be tricky trying to make that work alongside Unblock-US which is also DNS based. I might be able to track down the relevant Netflix zones and declared them in my local DNS server and refer those to UnblockUS whilst the default is to OpenDNS. In many ways though this is the easiest solution, except that it has to work along side UnblockUS.

No worries about the kids setting their own DNS servers, I'll deal with that in the firewall :)

Proxy ===== eg Squidguard - It will not work with SSL traffic. Well, it might, but then all my browsers will throw up man-in-the-middle warnings. Seems like a non starter.

Bloody big blacklist of IPs =========================== Assuming I can load several million into iptables without blowing up the router (see below), this could work.

Any approaches I've missed? Does not need to be perfect - just good enough to mostly keep them off rotten.com, jihadist beheading vids and hard core p*rn. And if they hack their way around it, good for them - at least they are working for it - no illusions that they will be defeated for ever.

Cheers

Tim

Equipment I have:

Nice linux router running Debian 7 (this is are full blown nano system with lots of RAM, not embedded). It is my PPPoE endpoint, firewall, router, DNS, DHCP NAT and kerberos box.

So I'd like to put 2 of my VLANs onto a filtered feed whilst leaving the main VLANs unfiltered. My VLANs are like this:

1) Public IP /27 block 2) Private "Golden" 10.0.0.0/24 block 3) Media 10.0.1.0/24 block for Netflix etc - Chromecast, Roku and phones/pads will use this 4) Guest net 10.0.2.0/24

Each maps to a separate WIFI ESSID.

1+2 unfiltered 3+4 filtered all the time.

Only difference between 3 and 4 is 4 can get a new password every few weeks, without having to change Chromecast, Roku and other stuff.

Assume the kids do not ever get to access 1+2.

[Bill]

In message , Tim Watts writes

It might be worth mentioning that my brother-in-law had something installed on his Windows PC. It was about 3 years ago, his first machine and his first experience of computers and the internet, so he wanted to keep visiting family safe.

His granddaughter visited, accessed it and managed to lock him out. When he discovered this, she was back at her home, and claimed innocence, no knowledge of password etc.

I think he ended up having to have the machine rebuilt from scratch.

[Dave Liquorice]

Never bothered with our two but the computer they used was in the breakfast room and anyone passing through could see what was on screen. We also took the time to try and make 'em Web Wise. As some one else has said stop 'em at home they'll just find it at a mates house...

Surely you just do it with blocks and masks?

[Tim Watts]

That's why we're doing it at the router :)

[Bobbie Sellers]

That is pathetic as a password on a Windows machine could replaced or totally removed by use of Linux tool.

Not so easily done since Windows 8 but still possible. You don't say which Linux distribution you are using but on the Mandriva derived Mageia, PCLOS and Open Mandriva there are plenty of places to control access. If you were to set up separate guest accounts for adults and for children you could easily manage this. Of course you have to have a place to lock up your Linux tools which could circumvent the limits on the accounts.

bliss

[David]

I refer you to

and

David

[Tim Watts]

Lol!

[leenowell]

Have you looked at ClearOS? They do a free "community" version for home use .

I have an initial setup of this but have not configured the content filteri ng yet. I am using it partly for this but also to have a central DNS, prin t server, intrusion prevention/ detection etc. etc. I have it set up in "ga teway" mode with internal and external subnets. If you are interested I ca n post more details of my setup.

One word of caution about any solution you come up with is to try to ensure there are designed workarounds for problems when they happen. I had a few hardware orientated issues when I set this whole thing up and they resulte d in a full network outage in the house. Family losing access to the intern et for any period of time whilst I was at work caused lots of angst! Also, time to fix it becomes an issue if it fails during the week and you only h ave a few hours at night to get it up and running.

thanks

Lee.

[Tim Watts]

It's interesting - obviously I am not going to deploy it as I've spent sometime polishing Debian 7 into my standard setup - but I could boot it up on the laptop and see how they do the content filtering.

Thansk for that - I had not heard of it.

The obvious answer there is to keep my original router in a box ready configured to provide a minimal WIFI connection to the internet with no bells and whistles.

[Huge]

That's what I do. I have a Smoothwall where I do all the clever stuff inboard from the router . The generally available wifi is a dumb AP on a separate interface on the Smoothwall. I don't tell anyone the password for the router's own Wifi in case I need unfiltered access to the Internet for troubleshooting.

[The Real Doctor]

If she managed to set the BIOS password on a ThinkPad or ThinkCentre the only solution would be to solder in a new security chip. Those babies are tough.

Ian

[Bobbie Sellers]

Yes but there was no mention of BIOS password changes, to the time when I replied. Recovering from such a problem could be done by exchanging main boards where, I presume, the BIOS/(U)EFI lives. It could be prevented by setting a password on the BIOS before little "crackers" come to visit.

bliss

[Dave Liquorice]

Always have a spare and configured/tested/working modem/router available. If only so you can say to tech support "Yes I have tried another modem/router and it's still bust." Keep with the wired POTS phone so you can tell the line provider that a phone in the test socket doesn't work.

Also means if the modem gets zapped by nearby lightning or WHY down time is minimal rather than days as you make a distress purchase.

Or if it has a brain storm like mine did last week, over a few minutes it quickly went to 98 to 100% packet loss, good sync speed, normal level of errors, reset the ADSL, power cycled etc, all to no avail. Decided it must be a BT fibre backhaul fault again. Called ISP they couldn't see anything wrong with the BT side. Digs out spare modem, works fine, swaps back rubbish, repeat same result. Leaves spare in circuit (family getting twitchy about being offline for more than a couple of hours..). Next day swap again, just to make sure... still crap, factory reset, reconfigure, still crap, reflash the firm ware, reconfigure, works...