Filtering at home

[mattlynch]

How do you manage your children's portable devices especially iPad's from accessing inappropriate content?

[Arthur]

I don't have children, but OpenDNS would be a good solution. All you have to do is add their DNS servers to your broadband router and every device on your home network can then be filtered (from iPad's and smartphones connected via WiFi to games consoles and PCs).

 

Blocking inappropriate websites or categories is done centrally through the dashboard on their website.

 

http://i.imgur.com/wOXACYo.png

 

Talk Talk also offer a similar service, although I haven't used it myself.

[Gatt]

I'm using Sophos UTM at home, which is a great proxy to use but I've noticed that the vast majority of apps on Androids don't work via a proxy

Specifically the Play Store making it one to avoid if you are wanting to use it exclusively for Tablets

 

The only apps I've found to work are browsers and email with a few others ( I think Dropbox)

Also, if using a Windows 8 Tablet (or god forbid a windows 8 PC/Laptop) then 90 % of TIFKAM* Apps don't work either

Not sure about Apple's kit though

 

*The Interface Formerly Known As Metro

[SchoolsBroadband]

How do you manage your children's portable devices especially iPad's from accessing inappropriate content?

 

I was actually at the UK Internet Service Providers Association seminar on child safety and filtering yesterday in London so this is quite a hot topic at the moment.

 

There are a number of large ISP's that already have a service included for free. These are currently Talk Talk and Sky. I believe BT and Virgin will be joining suit soon.

 

Microsoft were also demonstrating their inbuilt filtering into Windows 8 which looked pretty good.

 

If a school gives Ipads / Laptops / other devices to students or teachers then we can do filtering onsite (at school) / offsite (at home) and give them the same access rights wherever they are by using our hosted Lightspeed MDM and content filtering service. This essentially puts a global proxy payload which points to our Lightspeed content filtering servers.

 

The OpenDNS solution which @Arthur mentions sounds like quite a good way of doing it too.

 

Dave

[SchoolsBroadband]

How do you manage your children's portable devices especially iPad's from accessing inappropriate content?

 

I was actually at the UK Internet Service Providers Association seminar on child safety and filtering yesterday in London so this is quite a hot topic at the moment.

 

There are a number of large ISP's that already have a service included for free. These are currently Talk Talk and Sky. I believe BT and Virgin will be joining suit soon.

 

Microsoft were also demonstrating their inbuilt filtering into Windows 8 which looked pretty good.

 

If a school gives Ipads / Laptops / other devices to students or teachers then we can do filtering onsite (at school) / offsite (at home) and give them the same access rights wherever they are by using our hosted Lightspeed MDM and content filtering service. This essentially puts a global proxy payload which points to our Lightspeed content filtering servers.

 

The OpenDNS solution which @Arthur mentions sounds like quite a good way of doing it too.

 

Dave

[Danp]

I use OpenDNS for my daughter's iPods and laptops. It's very easy to setup, took less than an hour on 4 devices.

[zag]

Talk Talk home safe is awesome!

 

TalkTalk HomeSafe

 

Its completely IP based so works on all devices and is standard with all their broadband packages.

 

Wish BT would do something similar!!

[featured_spectre]

Not had the need yet, my daughter knows not to press any adverts or go onto the internet on our phones/tablets/laptops. She is fully aware if she does she has to tell us and ask for help, she is 4, and she is quite capable. She has her own tablet (nothing fancy, an old windows touch screen which I juiced up with droid), and turned the wireless off, so we install apps via APK files

 

She is happy, we are happy.

[cpjitservices]

At home, I use pfsense with Captive portal and squid/dansguardian for proxying/filtering. Anything that connects via the captive portal is filtered. Its unsecured wifi and the amount of people that try to connect is bonkers, but with it being captive portal all they get is a login page and can go no further unless they authenticate.

 

It's a good trick especially if ya call it free wi-fi lol .

[nicholab]

If you got a speedtouch router you can use opendns and block all other servers. Also you can use Dns-o-matic if your on a dynamic ip. You set the router to only give out the right servers via dhcp.

[m25man]

Whilst Open DNS is fine what happens when your kids start changing the DNS on the devices themselves or using the anonymous proxies that they are always trying at school!

 

Unless you have the advantage of owning your own Sonicwall or PaloAlto at home, without help from your ISP or a half decent firewall your snookered!

You need to be able to restrict all DNS lookups to your specific chosen host and block access to anonymous proxies.

Make the most of it whilst they are small, it gets a lot harder when they become 13 yr old hackers....

 

Whilst most of us here can probably lockdown a windows box it's not that easy with so many platforms and BYODs at home.

I had the whole family for a BBQ the other week and had over 30 devices on the Internet!

 

Like managing a class full of monsters sometimes... but even then those that don't like the filtering simply switched to using the nearby BT Openzone... No win

All ISPs should be locked down with an opt out like mobile networks.

[ConradJones]

Whilst Open DNS is fine what happens when your kids start changing the DNS on the devices themselves or using the anonymous proxies that they are always trying at school!.

 

you configure your router to use OpenDNS as its dns server and then block port 53 from any device on your network outwards. Your router has to support that, my o2wirelessbox did so does my new bebox.

[Arthur]

Whilst OpenDNS is fine what happens when your kids start changing the DNS on the devices themselves or using the anonymous proxies that they are always trying at school!

With the number of Internet connected devices there are at home these days you really need a network-level solution. Other than OpenDNS, I'm not sure what you would use?

 

Unless you have the advantage of owning your own Sonicwall or PaloAlto at home, without help from your ISP or a half decent firewall you're snookered!

Any Linux-powered router that enables you to create iptables rules should do. e.g. an Asus RT-N66U with the TomatoUSB firmware.

 

iptables -t nat -A PREROUTING -i br0 -p udp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)
iptables -t nat -A PREROUTING -i br0 -p tcp --dport 53 -j DNAT --to $(nvram get lan_ipaddr)

 

All DNS queries are now intercepted (TCP/UDP port 53) by the iptable rules and forced to use the DNS servers configured on the router. (Source)

Edited May 26, 2013 by Arthur

[elsiegee40]

The UK Safer Internet Centre has got the big 4 UK ISPs to put their parental control instructions in one place

 

http://www.saferinternet.org.uk/advice-and-resources/parents-and-carers/parental-controls

 

Also K9 web protection , for example, works across many platforms and can be used to control devices not on the home wifi

Edited May 26, 2013 by elsiegee40

[MatthewL]

I have used K9 in the past on machines that needed filtering and have also used I think it was NetNanny type product.

[nicholab]

I only allow out 208.67.222.222 and 208.67.220.220 from my router for DNS. No problem changing them the Internet would stop working. Proxys should be blocked by opendns. Pfsence is the best firewall you can run on low powered hardware.

[catshilllearning]

I agree with the suggestion that you find out if your ISP offers this service. Many do. It is the advice I give to parents who ask about filtering software following my Online Safety for Parents presentations.

[jmak]

Article in PC Pro a few days ago covered what the ISPs are doing.

 

BT Homehubs won't let you change the DNS, so until BT get their network level solution live, the only solutions I can recommend to parents with BT at home who ask me involves buying and configuring more kit.

[Fatherof9]

"[Any Linux-powered router that enables you to create iptables rules should do. e.g. an Asus RT-N66U with the TomatoUSB firmware."

 

I have the Asus RT-N66 router with the factory software installed. Is there a way to accomplish with the factory load? I'm not sure I'm up to loading that.

[Arthur]

I have the Asus RT-N66 router with the factory software installed. Is there a way to accomplish with the factory load? I'm not sure I'm up to loading that.

Not sure, but you could try the AsusWRT-Merlin firmware instead. It's a bit easier to install. Simply download the latest .zip, extract the contents, then go to Administration » Firmware Upgrade on the router, browse for the .trx file and click Upload.

 

According to this webpage, you can use the following iptables rule on your RT-N66U (once you have installed the 'Merlin' firmware above and enabled JFFS) to redirect all DNS queries to the server(s) defined on the router (e.g. OpenDNS).

 

iptables -I PREROUTING -t nat -p udp -s `nvram get lan_ipaddr`/`nvram get lan_netmask` ! -d `nvram get lan_ipaddr`/`nvram get lan_netmask` --dport 53 -j DNAT --to-destination `nvram get lan_ipaddr`

 

If you decide to install the Tomato (64k) firmware in the future, it's probably a good idea to update the routers bootloader to v1.0.1.3 (if it is v1.0.1.2) to prevent it from being bricked. Details below (although I wouldn't attempt this if you are unsure of things).

 

• CFE bootloader update « SmallNetBuilder Forums
  
• Here’s how I upgraded a new RT-N66U to the latest DD-WRT build
  

[cpjitservices]

I have a pfsense box, with Dansguardian attached which does all my filtering but to be honest I only really filter things like pop-ups.

[seawolf]

OpenDNS is good, but only if it is set at the router level in not on the devices themselves or it can be easily overridden. OpenDNS also doesn't help at all with filtering google image searches.

 

I think the best solution is to use the iBoss Home combined with OpenDNS configured as a second layer filter for the really bad stuff in case either is circumvented. The iBoss is an awesome device in the granularity of filtering and reporting. It enables you to block social media sites very granularly (view but not post to Facebook, etc,) and has clean image searching redirects to lock in safe search on any browser on any device.

 

http://www.iboss.com/home_overview.html

 

Of course, this does nothing to stop someone from using 3G/4G to circumvent filtering at home, school, or work. This is why some level of ISP based filtering would be a good thing.