Parental Control Time Scheduling not working

[boerlx]

RT-AC68U and 378.55

Hi

Time scheduling does not seem to work for active connexions (wired pc). Skype keeps working after the time is up. Same for games, etc. Only web browsing is blocked or previously closed applications.

Just bought the router especially for this purpose. I had the same problem with the original Asus firmware and was hoping Asuswrt-Merlin might fix this.

Will there be a fix for this problem in a near futur update ?

And if this is hopeless :
Does somebody knows if AdvancedTomato has the same problem with Time Scheduling ?

Thanks

 

[Calisro]

I don't think it'll snipe active connections initiated before scheduling. I think it just adds policy based rules with time constraints. I don't think it would be considered a "bug" but I can see the problem.

Edit: Just thinking of a work around. You *could* restart the wan at the scheduled time causing connections to reconnect whivh would prevent those already connected apps/games from re-connecting. non-blocked connections would also feel the loss of wan for a few seconds however.

edit2: I believe tomato would act the same way btw...

 

[ColinTaylor]

I seem to remember there was some lengthy discussions in the past about this (with suggested solutions). You can probably find them if you search the forum.

 

[snakebite3]

I seem to remember there was some lengthy discussions in the past about this (with suggested solutions). You can probably find them if you search the forum.[/QU

Try the latest offical or beta
http://www.snbforums.com/threads/official-asus-rt-ac68u-3-0-0-4-378-8258-official-release.27139/
http://www.snbforums.com/threads/beta-asus-rt-ac68u_3-0-0-4_378_8956.27244/

- Modified the network map client status. When click the client icon, administrator can bind IP, change host name, change icon, block internet access or set time scheduling.

 

[sfx2000]

I don't think it'll snipe active connections initiated before scheduling. I think it just adds policy based rules with time constraints. I don't think it would be considered a "bug" but I can see the problem.

Edit: Just thinking of a work around. You *could* restart the wan at the scheduled time causing connections to reconnect whivh would prevent those already connected apps/games from re-connecting. non-blocked connections would also feel the loss of wan for a few seconds however.

edit2: I believe tomato would act the same way btw...

You hit the button - time constraints will generally not impact current connections - any new attempts would likely fail...

Not a Tomato or AssuWRT issue...

 

[coldwizard]

RT-AC68U and 378.55

Hi

Time scheduling does not seem to work for active connexions (wired pc). Skype keeps working after the time is up. Same for games, etc. Only web browsing is blocked or previously closed applications.

...

First I want to say that I do NOT use the GUI parental controls.

Second I want to state that it is possible for parental controls to break an existing connection IF the hardware acceleration is disabled and the blocking rules are in the correct order.

Third, I use a script to control the Internet access and it does work to break ALL connections on a N66U model.

What I would would recommend you do is:

After you have all the configuration done and saved, reboot your router because the location of the parental control rules would be critical and by rebooting, you get a clean set of rules and hardware acceleration will be set correctly.
Test that it now works and your done.

If still fails, search my posts, as I have uploaded a working script for the N66U, and see if that works on your device.

 

[snakebite3]

RT-AC68U and 378.55
Will there be a fix for this problem in a near futur update ?
Thanks

I asked this exact question to the one of the FW developer. He said this

It's the known limitation, when the session is created and never reconnects, we can reconnect this automatically.
We have known this issue more than 3 years, recently we have some ways to test but I still work on other project.
We will try to investigate how to fix, but I can't guarantee it can be fixed.

Actually, you can use "rc rc_service restart_net_and_phy" to reconnect all Ethernet clients, and "restart_wireless" to reconnect all wireless clients.
In linux original tool "netfilter" has the way to fix this issue, but it can't support old model of mips or other platform, so we can't use this to fix issue.
If we can't fix this issue in all platform, we won't port into our code base.

 

[sfx2000]

Time scheduling does not seem to work for active connexions (wired pc). Skype keeps working after the time is up. Same for games, etc. Only web browsing is blocked or previously closed applications.

Easy answer - study time, bed time - phones/tablets go into a basket that sits on top of the fridge..

and a good talk about trust and responsibility with the kids...

Parental Controls generally fail - kids are pretty clever these days..

 

[Calisro]

Second I want to state that it is possible for parental controls to break an existing connection IF the hardware acceleration is disabled and the blocking rules are in the correct order.

It seems like this would depend on conntrack timeouts. I believe timeouts are much shorter by default on the n66u. Just wondering if reducing those tineouts on the 68u may help the op.

Edit: I may be wrong. I'll have to play with it and conntrack (netfilters) role here.

 

[sfx2000]

It seems like this would depend on conntrack timeouts. I believe timeouts are much shorter by default on the n66u. Just wondering if reducing those tineouts on the 68u may help the op.

Edit: I may be wrong. I'll have to play with it and conntrack (netfilters) role here.

Might work - and while we ask the kids to give up the phones, etc...

Consoles are... so this is worthwhile to investigate - but generally... tech will never replace good parenting at the end of the day...

Why phones in the basket? AP/Hotspot mode, lol, negates everything one does on the router, and the kids think they're cool getting one over on us (parents)... in some cases they're doing it anyways as AP/Hotspot mode on ATT LTE handsets is a zero-NAT (NAT Level 1 in PS speak)...

kids these days

 

[snakebite3]

Easy answer - study time, bed time - phones/tablets go into a basket that sits on top of the fridge..

and a good talk about trust and responsibility with the kids...

Parental Controls generally fail - kids are pretty clever these days..

This is the best way to go about things. Get them while they're young and still respect your authority.

 

[RMerlin]

Try disabling NAT acceleration, it's possible it's causing established connections to bypass iptables.

 

[boerlx]

hey thanks for all the replies.

actually the suggestion of shutting off the internet during certain hours came from from the kid after a talk about the problem.

I turned off NAT acceleration and now everything is working as expected !

I'm not sure exactly what purpose does serve NAT acceleration.
What do I miss if disable this feature ?

 

[Calisro]

I turned off NAT acceleration and now everything is working as expected !

I'm not sure exactly what purpose does serve NAT acceleration.
What do I miss if disable this feature ?

Interesting. Now i'm intriqued. But anyway, nat acceleration improves performance and reduces router workload. You should be fine with it off.

 

[snakebite3]

Interesting. Now i'm intriqued. But anyway, nat acceleration improves performance and reduces router workload. You should be fine with it off.

It seems NAT accel reduces CPU usage by 50~70% on a core. I did a speed test on my 100Mbps connection. The other CPU core was 90% free. I guess it's fine for most people with it off.

 

[coldwizard]

hey thanks for all the replies.

actually the suggestion of shutting off the internet during certain hours came from from the kid after a talk about the problem.

I turned off NAT acceleration and now everything is working as expected !

I'm not sure exactly what purpose does serve NAT acceleration.
What do I miss if disable this feature ?

Interesting - I would have thought that Merlin/Asus would have turned the NAT aceleration off when you enabled the parental controls. Could even be a feature = "Do you want to terminate active connections (Y/N)?"

The other problem is with IPV6 which, on the version of ip6tables on my router, does not support time based rules. So you will need to ensure IP Version 6 is turned off or at least check that the parental control works for IPV6 on your machine. I use a script to control IPV6 access to the internet with crontab.

And as others have said, this is just a step in controlling Internet access. They can still download and play the games locally. The Internet off simply reminds them that it is time to stop. You will need to gather the devices at bedtime and turn them OFF. My angels resorted to using bluetooth to access the devices I had gathered but left turned on.

 

[l0ddify]

Hi!
I have been trying to find some good answers, alternative firmware's for my ac-rt66u routers lately. When I first bought my first 66u router I was running stock, but with 3 children the bed time/access to internet times are a bit different I had to use the parental control on their devices to try and limit their online time. (To physically collect all the devices every time was not an option). They have weekdays access, from after the homework has been done, until bedtime. Weekends they have can have online time in the morning and in the evening until bedtime. Each child has from 3 to 6 devices (desktop,laptop,ps3,ps4,tablet,phone). When I found out the children was still able to access youtube/facebook/skype after the parental controls kicked in I had to look for a new firmware. I tried dd-wrt, merlin, and tomato, and it was tomato I chose. I have used Shibby Tomato/Advanced Tomato for a over a of year now, just because the parent control/access restrictions work flawless on those firmware's. My problem at the moment is that i have a 500 mbit/500 mbit connection at home. And tomato on the ac-rt66u do not support hardware acceleration, making my speed around 150-180 mbit-ish. (I should not complain, but when I pay for a 500 mbit connection I would like to get a 500 mbit connection)

The last week I have tried the merlin fork by john9527. My internet speed is now 500 mbit, and everything else is ok. But the parental control is still buggy.. I have tried coldwizard's script. And it looks like it kills some of the active connection when the time kicks in. But it is really hard to maintain, if some of the kids get extended online time, or if i would like to add other devices to the restrictions.

I know rt-ac68u and some of the newer routers work with CTF on advanced tomato. But if it is the hardware acceleration that breaks the parental control it is stupid to use money on something that will not work.

Anyone here that has some thoughts on what is the best solution? or should I just be happy with the situation?

 

[boerlx]

Hi
I have a 20/2 mbps connection so disabling the hardware acceleration is ok with me. (until I upgrade)
but
I just noticed today that Time Scheduling is not in sync with the router system time after the daylight saving time change ???
I did setup the router to change time and the router did change time but Time Scheduling weirdly seems to stick to the previous time prior to DST change.
Therefore in order to make my Time Schedules work I have to shift everything one hour later !!

another thing about system time and slight saving
I'm still wondering why I have go through all this DST start and stop setup when my computer just syncs time on a server that seems to do this by itself ?

Good to know that Shibby Tomato/Advanced actually works for this.

 

[RMerlin]

Just configure the correct start/end DST for your timezone on the System page.

 

[boerlx]

Just configure the correct start/end DST for your timezone on the System page.

Well I actually did configure the start/end DST for my timezone.
System time is correct but my Time Schedules start/stop 1h early now?