Solved Need help Enforcing SafeSearch on duckduckgo.com

[macster2075]

Hi I have RT-68P on the latest Merlin firmware 384.19
I currently have a few scripts that forces SafeSearch in Google and Bing which work great...

For Google I am using this
echo address=/www.google.com/216.239.38.120 > /jffs/configs/dnsmasq.conf.add

For Bing...
echo address=/www.bing.com/204.79.197.220 > /jffs/configs/dnsmasq.conf.add

But....
I am stuck with DuckduckGo
I found the safe.duckduckgo.com IP address and I have tried the jffs below, but it doesn't work...

echo address=/www.duckduckgo.com/46.137.218.113 > /jffs/configs/dnsmasq.conf.add

also tried..
echo address=/duckduckgo.com/46.137.218.113 > /jffs/configs/dnsmasq.conf.add
Still nothing....

Any help on this?
Thanks.

 

[Zonkd]

SafeSearch · Cloudflare for Teams documentation

Cloudflare One™ is the culmination of engineering and technical development guided by conversations with thousands of customers about the future of the corporate network. It provides secure, fast, reliable, cost-effective network services, integrated with leading identity management and endpoint...

developers.cloudflare.com

take a look there

I think you would be able to do it by adding a cname record to your dnsmasq.add file like this:

cname=duckduckgo.com,safe.duckduckgo.com

Then I think you’d also need to put the IP address for safe.duckduckgo.com in your hosts.add file. But people have problem with it.

 

[macster2075]

so this can be added in the Asus router through ssh?

 

[Zastoff]

Tested this now and it works fine here with safe search for Google, Bing, Youtube and Duckduckgo
(via SSH)
Added: to /jffs/configs/dnsmasq.conf.add

Spoiler: dnsmasq.conf.add

cname=www.google.com,forcesafesearch.google.com

cname=youtube.com,restrict.youtube.com
cname=www.youtube.com,restrict.youtube.com
cname=m.youtube.com,restrict.youtube.com
cname=youtubei.googleapis.com,restrict.youtube.com
cname=youtube.googleapis.com,restrict.youtube.com
cname=youtube-nocookie.com,restrict.youtube.com
cname=www.youtube-nocookie.com,restrict.youtube.com

cname=bing.com,strict.bing.com
cname=www.bing.com,strict.bing.com

cname=duckduckgo.com,safe.duckduckgo.com
cname=www.duckduckgo.com,safe.duckduckgo.com

And created the file hosts.add in /jffs/configs (touch /jffs/configs/hosts.add)
Added: to /jffs/configs/hosts.add

Spoiler: hosts.add

::ffff:216.239.38.120 forcesafesearch.google.com restrict.youtube.com
216.239.38.120 forcesafesearch.google.com restrict.youtube.com
::ffff:216.239.38.119 restrictmoderate.youtube.com
216.239.38.119 restrictmoderate.youtube.com
::ffff:204.79.197.220 strict.bing.com
204.79.197.220 strict.bing.com
::ffff:46.137.218.113 safe.duckduckgo.com
46.137.218.113 safe.duckduckgo.com

and then

service restart_dnsmasq

And check with for example cmd in windows

nslookup www.google.com (or change to bing.com, youtube.com, duckduckgo.com)

 

[macster2075]

I only need for duckduckgo so the commands I need to add are...(sorry, I am pretty new at this)

1st - /jffs/configs/dnsmasq.conf.add
2nd - cname=duckduckgo.com,safe.duckduckgo.com
3rd -cname=www.duckduckgo.com,safe.duckduckgo.com
4th - hosts.add in /jffs/configs (touch /jffs/configs/hosts.add)
5th - /jffs/configs/hosts.add
then
service restart_dnsmasq

is that correct?

 

[macster2075]

Does it look something like this?
cname=duckduckgo.com,safe.duckduckgo.com >/jffs/configs/dnsmasq.conf.add - ENTER
cname=www.duckduckgo.com,safe.duckduckgo.com >/jffs/configs/dnsmasq.conf.add - ENTER
cname=duckduckgo.com,safe.duckduckgo.com > /jffs/configs (touch /jffs/configs/hosts.add) - ENTER
cname=www.duckduckgo.com,safe.duckduckgo.com > /jffs/configs (touch /jffs/configs/hosts.add) - ENTER
then - service restart_dnsmasq - ENTER?

 

[Zastoff]

These 2lines needs to be added to the file dnsmasq.conf.add located in /jffs/configs
cname=duckduckgo.com,safe.duckduckgo.com
cname=www.duckduckgo.com,safe.duckduckgo.com

These 2lines needs to be added in the file hosts.add located in /jffs/configs
(if it's not there it can be created with touch /jffs/configs/hosts.add)
::ffff:46.137.218.113 safe.duckduckgo.com
46.137.218.113 safe.duckduckgo.com

Then
service restart_dnsmasq

 

[macster2075]

These 2lines needs to be added to the file dnsmasq.conf.add located in /jffs/configs
cname=duckduckgo.com,safe.duckduckgo.com
cname=www.duckduckgo.com,safe.duckduckgo.com

These 2lines needs to be added in the file hosts.add located in /jffs/configs
(if it's not there it can be created with touch /jffs/configs/hosts.add)
::ffff:46.137.218.113 safe.duckduckgo.com
46.137.218.113 safe.duckduckgo.com

Then
service restart_dnsmasq

So like this?
cname=duckduckgo.com,safe.duckduckgo.com > /jffs/configs/dnsmasq.conf.add - ENTER
cname=www.duckduckgo.com,safe.duckduckgo.com > /jffs/configs/dnsmasq.conf.add - ENTER
::ffff:46.137.218.113 safe.duckduckgo.com > /jffs/configs/hosts.add - ENTER
46.137.218.113 safe.duckduckgo.com > /jffs/configs/hosts.add - ENTER

then
service restart_dnsmasq

 

[SomeWhereOverTheRainBow]

Hi I have RT-68P on the latest Merlin firmware 384.19
I currently have a few scripts that forces SafeSearch in Google and Bing which work great...

For Google I am using this
echo address=/www.google.com/216.239.38.120 > /jffs/configs/dnsmasq.conf.add

For Bing...
echo address=/www.bing.com/204.79.197.220 > /jffs/configs/dnsmasq.conf.add

But....
I am stuck with DuckduckGo
I found the safe.duckduckgo.com IP address and I have tried the jffs below, but it doesn't work...

echo address=/www.duckduckgo.com/46.137.218.113 > /jffs/configs/dnsmasq.conf.add

also tried..
echo address=/duckduckgo.com/46.137.218.113 > /jffs/configs/dnsmasq.conf.add
Still nothing....

Any help on this?
Thanks.

the biggest problem with duckduckgo is that they use infrequently ip address endpoints based on geolocation, the only way to keep duckduckgo safe search active is to periodically update the IP address of safe search for your area. Or use a resolver such as unbound where it can truly enforce with CNAME entries OR use Cloaking options with a resolver such as DNScrypt-Proxy 2. (CNAME cloaking). To properly do this with DNSMASQ, You need to first use NSlookup to determine the appropriate IP address for your duckduckgo safesearch before attempting to redirect regular duckduckgo to the corresponding addresses.

If any one is interested in taking the unbound approach, here is a mock script I devised for generating a .conf for unbound.

Unbound - SafeSearchEnforcement with unbound.

For those who want to enforce safe search with unbound..... #!/bin/sh URL="https://www.google.com/supported_domains" FILE="/etc/unbound/unbound.conf.d/safesearch.conf" #this can be where-ever your unbound config storage is. You will have to use include: option inside the main unbound.conf...

www.snbforums.com

 

[macster2075]

the first two commands wen through
cname=duckduckgo.com,safe.duckduckgo.com > /jffs/configs/dnsmasq.conf.add
cname=www.duckduckgo.com,safe.duckduckgo.com > /jffs/configs/dnsmasq.conf.add

but these.. I get not found..
::ffff:46.137.218.113 safe.duckduckgo.com > /jffs/configs/hosts.add
46.137.218.113 safe.duckduckgo.com > /jffs/configs/hosts.add

I don't know how to add them as you said.. i've tried
::ffff:46.137.218.113 safe.duckduckgo.com > /jffs/configs (touch /jffs/configs/hosts.add)
46.137.218.113 safe.duckduckgo.com > /jffs/configs (touch /jffs/configs/hosts.add)
but I get a message that says... -sh: can't create /touch: Read-only file system

 

[macster2075]

:ffff:46.137.218.113 safe.duckduckgo.com > /jffs/configs (touch /jffs/configs/hosts.add)
-sh: syntax error: unexpected "("

 

[SomeWhereOverTheRainBow]

Here is an example for DNSMASQ.
I made a script called /jffs/scripts/force-safe.sh

Then I added a line to /jffs/scripts/dnsmasq.postconf
to add the lines to dnsmasq.conf.


the attached files are good examples.

don't mind the .txt names the appropriate names should be force-safe.sh and dnsmasq.postconf

 

[macster2075]

Here is an example for DNSMASQ.
I made a script called /jffs/scripts/force-safe.sh

Then I added a line to /jffs/scripts/dnsmasq.postconf
to add the lines to dnsmasq.conf.


the attached files are good examples.

don't mind the .txt names the appropriate names should be force-safe.sh and dnsmasq.postconf

Thanks for that.. I only need for duckduckgo.com - i have google and bing covered.
I just need to know how to add these two lines
::ffff:46.137.218.113 safe.duckduckgo.com > /jffs/configs/hosts.add
46.137.218.113 safe.duckduckgo.com > /jffs/configs/hosts.add

I keep getting a message that says... -sh: ::ffff:46.137.218.113: not found

I was told by Zastoff if it's not found I can add it using touch... but I don't know that touch is or how to use it.
What is the command line to "add" this using touch?

 

[SomeWhereOverTheRainBow]

so the instructions are
- in ssh terminal do type
nano /jffs/scripts/force-safe.sh

copy and paste the content of force-safe.txt .

ctrl x and enter to save

then the same with /jffs/scripts/dnsmasq.postconf

nano /jffs/scripts/dnsmasq.postconf

copy and paste the content of the dnsmasq-postconf.txt .

ctrl x and enter to save

then
chmod 755 /jffs/scripts/dnsmasq.postconf

service restart_dnsmasq

as for zastoffs instructions you may need to PING or wait for him to clarify about his methods.

Touch command should be used within the SSH terminal to create the file if it does not exist, you type that in before trying to use echo.

echo "::ffff:46.137.218.113 safe.duckduckgo.com" > /jffs/configs/hosts.add
echo "46.137.218.113 safe.duckduckgo.com" >> /jffs/configs/hosts.add

 

[macster2075]

ok.. did what you said... but nothing... safesearch in duckduckgo.com is disabled... do I need to reboot the router?

 

[SomeWhereOverTheRainBow]

ok.. did what you said... but nothing... safesearch in duckduckgo.com is disabled... do I need to reboot the router?

service restart_dnsmasq

 

[macster2075]

service restart_dnsmasq

yes.. did that.. but nothing... still the same.

 

[SomeWhereOverTheRainBow]

ok.. did what you said... but nothing... safesearch in duckduckgo.com is disabled... do I need to reboot the router?

if you chose to use my method change the IP address in the force-safe.sh using nano editor for safesearch duckduckgo.com try the ip address you were using 46.137.218.113

 

[SomeWhereOverTheRainBow]

for example when i NSlookup safe.duckduckgo.com , the IP address i get is 52.149.247.1 and not 46.137.218.113

 

[macster2075]

What I don't understand is.. why I can use
echo address=/www.bing.com/204.79.197.220 > /jffs/configs/dnsmasq.conf.add
- to force safesearch on bing..

but I can't use
echo address=/www.duckduckgo.com/ 46.137.218.113 (or whatever the IP is) > /jffs/configs/dnsmasq.conf.add
- to force safesearch in Duckduckgo.com