Force Google SafeSearch

[sam]

Okay, the log:

Spoiler: System Log

May 3 00:46:03 rc_service: service 867:notify_rc restart_dnsmasq
May 3 00:46:03 dnsmasq[31005]: exiting on receipt of SIGTERM
May 3 00:46:03 custom config: Appending content of /jffs/configs/hosts.add.
May 3 00:46:03 custom config: Appending content of /jffs/configs/dnsmasq.conf.add.
May 3 00:46:03 dnsmasq[872]: started, version 2.73rc1 cachesize 1500
May 3 00:46:03 dnsmasq[872]: warning: interface ppp1* does not currently exist
May 3 00:46:03 dnsmasq[872]: asynchronous logging enabled, queue limit is 5 messages
May 3 00:46:03 dnsmasq-dhcp[872]: DHCP, IP range 192.168.1.2 -- 192.168.1.254, lease time 1d
May 3 00:46:03 dnsmasq[872]: read /etc/hosts - 6 addresses
May 3 00:46:03 dnsmasq[872]: using nameserver 8.8.4.4#53 for domain local
May 3 00:46:03 dnsmasq[872]: using nameserver 8.8.8.8#53 for domain local
May 3 00:46:03 dnsmasq[872]: using nameserver 8.8.8.8#53
May 3 00:46:03 dnsmasq[872]: using nameserver 8.8.4.4#53

 

[RMerlin]

Okay, the log:

This confirms that the additions do get added to dnsmasq's configuration. All I can assume then is either you use DNSFilter to bypass it, you didn't flush the browser's DNS cache (browsers have their own caches, on top of Windows' caches), or your clients aren't using the router's IP as their DNS (and they are directly querying external nameservers).

 

[sam]

This confirms that the additions do get added to dnsmasq's configuration. All I can assume then is either you use DNSFilter to bypass it, you didn't flush the browser's DNS cache (browsers have their own caches, on top of Windows' caches), or your clients aren't using the router's IP as their DNS (and they are directly querying external nameservers).

I got it, thanks!

I had to change the /jffs/configs/dnsmasq.conf.add file for other domain endings in this way:

cname=www.google.es,forcesafesearch.google.com

and not

cname=www.google.es,forcesafesearch.google.es



The hosts.add file is still the same:

216.239.38.120 forcesafesearch.google.com

 

[snevah admin]

Ok, been trying to get this to work at my place. I have followed all of the steps above, but not having much luck.

When I do an nslookup from my shell in the router it comes back with the right address. but when I do it from my Mac that is getting all of its network settings from the router via DHCP, I do not get the right IP address when doing nslookup on www.google.com. Any tips? I flushed my cache on the mac, and on the browser and rebooted.

 

[snevah admin]

Ok, on a whim, I turned off parental controls and dns filtering via my asus router with merlin FW, and now google forcesafesearch appears to be working. but I have lost opendns filtering... sigh

 

[snevah admin]

And, just re-enabled dns filtering, and it clobbers the forcesafesearch setting. Brilliant.

 

[snevah admin]

And, just re-enabled dns filtering, and it clobbers the forcesafesearch setting. Brilliant.

Any advice for forcing safe search and enabling opendns filtering?

 

[L&LD]

Any advice for forcing safe search and enabling opendns filtering?

Since they are both using DNS type controls, seems they are mutually exclusive.

 

[snevah admin]

I thought the local CNAME would be enforced on the local network over what the opendns is setting...

Opendns describes how to setup this up here: https://support.opendns.com/entries/57304954-How-to-Enforcing-Google-SafeSearch

seems like they think it should work...

 

[snevah admin]

Oh and @L&LD, thanks for the quick reply, and apologies for the new thread / cross post. Happy to delete one or the other.

 

[ColinTaylor]

I thought the local CNAME would be enforced on the local network over what the opendns is setting...

No. DNS Filtering forces clients to go straight to the specified DNS server bypassing the routers DNS server (where the CNAME is).

The best you can do is turn off DNS Filtering and specify the routers WAN DNS as OpenDNS.

 

[snevah admin]

Ok. I imagine that would have the desired effect, except it wouldn't force filtering. Meaning if someone wanted to change their DNS server to something else, they could bypass the filter?

 

[snevah admin]

Interesting. That seemed to do it. I turned of DNS filtering, but set the WAN DNS to the opendns servers and that seemed to work in conjunction with the safe search settings. Awesome, and thanks for the great advice.

 

[ColinTaylor]

except it wouldn't force filtering. Meaning if someone wanted to change their DNS server to something else, they could bypass the filter?

Correct. You could use the DNS Filter and set the Filter Mode to "Router". That would force clients to use the routers DNS, which in turn is using OpenDNS.

 

[Tanner Harman]

Correct. You could use the DNS Filter and set the Filter Mode to "Router". That would force clients to use the routers DNS, which in turn is using OpenDNS.

This is basically what I've done. Works like a charm, selecting Router forces all clients to check against the DNSMasq & then lookup via the WAN DNS settings you input. Incidentally you can also force Google, YouTube, & now Bing all into safe search mode.

address=/www.youtube.com/216.239.38.119
address=/m.youtube.com/216.239.38.119
address=/youtubei.googleapis.com/216.239.38.119
address=/youtube.googleapis.com/216.239.38.119
address=/www.youtube-nocookie.com/216.239.38.119
address=/www.google.com/216.239.38.120
address=/www.bing.com/204.79.197.220