modify AiProtection/Parental Control

[Dan_88H]

Hi

Does anyone know if its possible to apply the category based content filtering for all devices on the network, rather than per device ?

We would like to use this feature for our guest wifi network - and would like it applied to any guest user that connects!

Thanks
Daniel.

 

[ChatmanR]

A very good suggestion. I'm not using PC on the Asus firmware because of this.

 

[Dan_88H]

Thanks for the reply - so it doesn't sound like it is possible with the Asus firmware or Asuswrt-Merlin ?

 

[martinr]

What sort of categories? Would OpenDNS or similar, with the relevant categories excluded, not suit you perfectly, the relevant OpenDNS servers then being placed in the 2 DNS Server boxes on the WAN Page?

 

[Dan_88H]

Thanks Ill take a look - very basic categories that cover most areas. Is OpenDNS free?

 

[martinr]

Thanks Ill take a look - very basic categories that cover most areas. Is OpenDNS free?

They have free home options and There’s one they call Home VIP for $20 a year. You probably know that by now but if not have a look here: https://www.opendns.com/home-internet-security/

I see that the free OpenDNS Home has:
“...over 50 customizable filtering categories, OpenDNS Web content filtering keeps parents in control of what websites children visit at home.“

On the WAN Page you’ll need to make sure that Connect to DNS server automatically is set to No so you can enter the 2 OpenDNS servers. I think that’s the default setting anyway so as long as you didn’t change it you won’t have to think about it.

And welcome to the forum.

 

[Datalink]

Sign up for a freebie account at OpenDNS, which allows you to set various categories to filter. You can also filter countries based on the country code. When that is all done, load the OpenDNS Updater from the site onto one of your computers that runs at home. That updater has an account login built into it. When the updater is running, it will connect your IP address to your account, so that OpenDNS servers respond correctly to DNS requests coming from your IP address and filter the results as you have set them. I've used this for several years now, and it does work. The updater, which runs in the background when the computer is up and running will keep the OpenDNS server aware of the correct IP address for your home in the event that the IP address does change at any point.

One problem however is that OpenDNS does not filter IPV6 requests. That's been a point of discussion for years now and there doesn't seem to be any impetus to make it happen. So, if you use IPV6, OpenDNS filtering won't work, it only provides straight address resolution for IPV6 addresses.

There is a new service that has started for IPV4 and IPV6 however, which is QUAD 9. IP address is 9.9.9.9 or 2620:fe::fe for IPV6. That's an IBM project in conjunction with numerous other companies to provide safe, secure address resolution and filter malicious web addresses at the same time. It doesn't provide the selection that OpenDSN provides via its freebie IPV4 address filtering unfortunately, but, it should keep its users out of malicious web sites.

https://www.quad9.net/

https://www.quad9.net/faq/

From the faq comes the following info:

Is there a service that Quad9 offers that does not have the blocklist or other security?

The primary IP address for Quad9 is 9.9.9.9, which includes the blocklist, DNSSEC validation, and other security features. However, there are alternate IP addresses that the service operates which do not have these security features. These might be useful for testing validation, or to determine if there are false positives in the Quad9 system.

Secure IP: 9.9.9.9 Provides: Security blocklist, DNSSEC, No EDNS Client-Subnet sent. If your DNS software requires a Secondary IP address, please use the secure secondary address of 149.112.112.112

Unsecure IP: 9.9.9.10 Provides: No security blocklist, DNSSEC, sends EDNS Client-Subnet. If your DNS software requires a Secondary IP address, please use the unsecure secondary address of 149.112.112.10

Note: Use only one of these sets of addresses – secure or unsecure. Mixing secure and unsecure IP addresses in your configuration may lead to your system being exposed without the security enhancements, or your privacy data may not be fully protected


Is there IPv6 support for Quad9?

Yes. Quad9 operates identical services on a set of IPv6 addresses, which are on the same infrastructure as the 9.9.9.9 systems.

Secure IPv6: 2620:fe::fe Blocklist, DNSSEC, No EDNS Client-Subnet

Unsecure IPv6: 2620:fe::10 No blocklist, no DNSSEC, send EDNS Client-Subnet

 

[martinr]

........When that is all done, load the OpenDNS Updater from the site onto one of your computers that runs at home. That updater has an account login built into it. When the updater is running, it will connect your IP address to your account, so .....

So if the computer with the OpenDNS updater is shut down when the ISP changes the public IP address, the category filtering would not occur and it defaults to the basic OpenDNS filtering until the updater comes back to life?

 

[Jack Yaz]

So if the computer with the OpenDNS updater is shut down when the ISP changes the public IP address, the category filtering would not occur and it defaults to the basic OpenDNS filtering until the updater comes back to life?

Run DDNS on the router to prevent that scenario

 

[martinr]

Run DDNS on the router to prevent that scenario

Of course, set up DDNS eg with the excellent asuscomm.com DDNS built in on the router and register with OpenDNS using the asuscomm.com address and then there’s no need to run an OpenDNS updater on a computer on the LAN?

 

[Datalink]

I think that your first assumption was correct, that if the home IP address changes while the updater isn't running, that you would end up with the normal filtering that OpenDNS provides, which should protect you against malicious web sites. You would lose the filtering categories and countries that you had set. I think the reality is that the home IP address probably don't change very often. Changing a Gateway modem from Gateway to Bridge mode or vice versa would do that. Changing the assigned MAC address on a router with the modem in Bridge mode would do that as well. Other than that, from a user perspective I can't think of ways to deliberately change the address. So, I think that the IP address should be pretty stable.

I can't see any way around the requirement to run the Updater. There is no entry in the OpenDNS filtering settings to enter your IP address, so that has to be supplied at some point and it looks to me like OpenDNS has designed that to run in a small application at the user end. I have the updater running on a computer that I use for web surfing / email, so the updater is running for a good majority of time. I'm not worried about the times or days that this pc isn't started as the IP address will probably not change unless I do something to force it to change.

Here's the instructions for running the Updater. There's not much to it, in terms of what you have to do:

https://support.opendns.com/hc/en-u...figure-the-OpenDNS-Dynamic-IP-updater-Client-

Here's the intro to the address filtering which shows the broad categories that can be applied:

https://support.opendns.com/hc/en-us/articles/227988047-Web-Content-Filtering-and-Security

And here's the custom list that you can use to select specific filtering categories:

https://community.opendns.com/domaintagging/categories

 

[martinr]

I think that your first assumption was correct, that if the home IP address changes while the updater isn't running, that you would end up with the normal filtering that OpenDNS provides, which should protect you against malicious web sites. You would lose the filtering categories and countries that you had set. I think the reality is that the home IP address probably don't change very often. Changing a Gateway modem from Gateway to Bridge mode or vice versa would do that. Changing the assigned MAC address on a router with the modem in Bridge mode would do that as well. Other than that, from a user perspective I can't think of ways to deliberately change the address. So, I think that the IP address should be pretty stable.

I can't see any way around the requirement to run the Updater. There is no entry in the OpenDNS filtering settings to enter your IP address, so that has to be supplied at some point and it looks to me like OpenDNS has designed that to run in a small application at the user end. I have the updater running on a computer that I use for web surfing / email, so the updater is running for a good majority of time. I'm not worried about the times or days that this pc isn't started as the IP address will probably not change unless I do something to force it to change.

Here's the instructions for running the Updater. There's not much to it, in terms of what you have to do:

https://support.opendns.com/hc/en-u...figure-the-OpenDNS-Dynamic-IP-updater-Client-

Here's the intro to the address filtering which shows the broad categories that can be applied:

https://support.opendns.com/hc/en-us/articles/227988047-Web-Content-Filtering-and-Security

And here's the custom list that you can use to select specific filtering categories:

https://community.opendns.com/domaintagging/categories

Thanks for that. In my case I use the very basic OpenDNS (server 208.67.222.222) with no special categories, and so it doesn’t matter that my ISP changes my public IP address twice a week or so. I had supposed that when opening an OpenDNS account through which you could set your own categories, you’d be given the option to enter a static IP address or DDNS address. Hence the benefit of an IP address that rarely changes.

 

[Dan_88H]

Thanks all

As this will be our guest wifi solution at work it looks like its going to be a tough one to solve. If it was for home, then this might work

Looks like I'll need to find another router

 

[Nebulaz]

On the WAN Page you’ll need to make sure that Connect to DNS server automatically is set to No so you can enter the 2 OpenDNS servers.

Setting up the DNS info under the AiProtection, DNS Filtering tab is not enough to set your user defined choice?

Right now under those conditions I have each of my devices under the client list with a user specified filtering mode. I have the child devices set to open DNS family and the adult devices set to quad 9.

Do I have to go further than that and set the specific DNS servers under the WAN setting as well?


Sent from my LG-H830 using Tapatalk

 

[Datalink]

I think that as long as you have one of the children's pc's or laptops running the OpenDNS Updater, you should be fine. Without the Updater running, there's no way to connect the account and its preferences to the IP address, unless of course the OpenDNS Family account has an IP address input.

 

[martinr]

.....,

Do I have to go further than that and set the specific DNS servers under the WAN setting as well?

As long as you have directed every client to your specified DNS Server under DNS Filtering (and not invoked No Filtering for any client), the WAN DNS settings won’t be looked at, but suppose you were to add a new client and forget to specify a DNS server for it under DNS Filtering?

So it makes sense to put your fallback OpenDNS server as a “safety net” on the WAN DNS Page, (bearing in mind that, the comments above regarding the updater). But so long as you remember to assign a DNS Server to every client in DNS Filtering that safety net won’t be used.

 

[Dan_88H]

If you are using OpenDNS, I'm assuming browsing to the web address' IP will still work ?

Also if clients that connect to the network that has OpenDNS running, what if they set their own DNS server to point to 8.8.8.8 as an example ?

 

[Nebulaz]

As long as you have directed every client to your specified DNS Server under DNS Filtering (and not invoked No Filtering for any client), the WAN DNS settings won’t be looked at, but suppose you were to add a new client and forget to specify a DNS server for it under DNS Filtering?

So it makes sense to put your fallback OpenDNS server as a “safety net” on the WAN DNS Page, (bearing in mind that, the comments above regarding the updater). But so long as you remember to assign a DNS Server to every client in DNS Filtering that safety net won’t be used.

So I did have a few devices, Nintendo 2DS devices that I did not set up with Open DNS Family routing. That got me thinking, because I want to filter out adult content and keep the kiddos off the main frequencies.

So if I keep their devices on a guest network, is there any way to just have that entire guest network accessing Open DNS Family? This way it would limit access for any of their friends that jump on and bum our WiFi?

I could as each of their devices logs in, I could just force that IP to use my custom DNS, but it would be easier for it to be SSID specific.

Sent from my LG-H830 using Tapatalk

 

[ColinTaylor]

So if I keep their devices on a guest network, is there any way to just have that entire guest network accessing Open DNS Family? This way it would limit access for any of their friends that jump on and bum our WiFi?

This is the same question that @Dan_88H asked in post #1. The answer is, no there isn't a way of doing it through the web interface. That's not to say that it's impossible, but it requires running some quite complicated custom scripts that reconfigure the router's internal interfaces (look for those elsewhere in these forums). I wouldn't recommend that option in @Dan_88H's case because he wants to use it in a business environment, where running unsupported hobbyist code is not a good idea.