RT-AC3100 Build: 380.65 -- Parental Controls Web & Apps Filter Not Working

[BigManz]

Hello All,

Merlin, great work as always. I've been using your builds since my RT-AC66U

I have Web & Apps Filters enabled and testing it on my device and it hasn't blocked a site yet. Even with Streaming enabled, you'd think it would block youtube.com, but it doesn't.

Hardware acceleration is on since my connection is 1Gbps down and turning that off does impact my speeds by more than half. Hardware acceleration doesn't seem to apply to Web & Apps Filtering and only to Time Scheduling.

I don't DNS filtering on since that's easy to bypass and I have my own internal DNS servers that the router and clients are pointing to.

Time Scheduling even with hardware acceleration on works...

Suggestions welcomed

 

[BigManz]

*bump*
Anyone? I'd love to block my daughter from the router level instead of DNS if at all possible. (don't like settings that can be changed)

 

[Wutikorn]

I don't know why it is not working for you, the last time I tried, it worked perfectly blocking torrent traffics, but I will test mine tmr and let you know. Btw, have you tried DNS filtering? It forces each device you set to use only specified DNS servers for that specific device. It will be harder to bypass. Web & Apps filtering may be bypassed by using VPN, so running both might be better(when you get it working).

 

[BigManz]

I don't know why it is not working for you, the last time I tried, it worked perfectly blocking torrent traffics, but I will test mine tmr and let you know. Btw, have you tried DNS filtering? It forces each device you set to use only specified DNS servers for that specific device. It will be harder to bypass. Web & Apps filtering may be bypassed by using VPN, so running both might be better(when you get it working).

Thanks for the reply. I wanted the router to be doing it because it's easy to change the DNS server on the client. (Lets say change to google) Not that it matters my daughter is to young to do that anyways.
I have my own internal primary and secondary DNS servers that the router is pointing to. I tested it on my phone again and it didn't block any content

 

[Wutikorn]

Thanks for the reply. I wanted the router to be doing it because it's easy to change the DNS server on the client. (Lets say change to google) Not that it matters my daughter is to young to do that anyways.
I have my own internal primary and secondary DNS servers that the router is pointing to. I tested it on my phone again and it didn't block any content

Parental Control does work on my DSL-AC68U stock firmware with 1.146 engine signature. But I have hardware hardware acceleration completely off. I don't have time to try it on router with RMerlin's firmware yet, but the result should be the same. Do you have NAT Acceleration set to auto? Auto will only turn on either FA or CTF(I don't remember the name) that AiProtection engine should works with.

For DNS filtering, you can't change DNS servers on client when you have this set. Go to AiProtection->DNS Filtering->and specify your daughter's device DNS servers, and if she attempts to change it, she won't be able to use internet at all(I think that's how it work).

 

[BigManz]

Parental Control does work on my DSL-AC68U stock firmware with 1.146 engine signature. But I have hardware hardware acceleration completely off. I don't have time to try it on router with RMerlin's firmware yet, but the result should be the same. Do you have NAT Acceleration set to auto? Auto will only turn on either FA or CTF(I don't remember the name) that AiProtection engine should works with.

For DNS filtering, you can't change DNS servers on client when you have this set. Go to AiProtection->DNS Filtering->and specify your daughter's device DNS servers, and if she attempts to change it, she won't be able to use internet at all(I think that's how it work).

Thanks Wutikorn!

I have NAT set to auto and it doesn't work. Hasn't worked from the get go so maybe I have the same issue as you. Not sure how the DNS filtering can stop a user from changing their DNS servers to something like 8.8.8.8

Thanks again, wish Merlin could chime in... I'll wait for the next release of the firmware.

 

[PoloNes]

*bump*
Anyone? I'd love to block my daughter from the router level instead of DNS if at all possible. (don't like settings that can be changed)

Use yandex family.

https://dns.yandex.com/advanced/

 

[BigManz]

Ok.. did the DNS server and that didn't take... Even did an release and renew on the clients. I'm still getting my local 192.168.1.* DNS servers passed to the clients.

 

[BigManz]

Figured it out... You have to push only the routers DNS server and not the internal ones. Sadly that doesn't work for me, but I can statically assign my daughter to the routers DNS instead of my internal ones...

That'll work for now.

 

[Wutikorn]

Figured it out... You have to push only the routers DNS server and not the internal ones. Sadly that doesn't work for me, but I can statically assign my daughter to the routers DNS instead of my internal ones...

That'll work for now.

Have you looked at DNS Filtering in AiProtection part? In that page, you can set your daughter to use specific DNS servers(like Norton DNS Servers), regardless of what other devices use. If someone manually set your daughter's device to use other DNS servers, your daughter's device will simply can't access internet.

For example, if I set my phone DNS servers in router's DNS Filtering to 8.8.8.8, and 8.8.4.4 and I manually set my phone DNS to 4.4.2.2 and 4.4.4.4(random IP), my phone won't be able to use internet at all. In short, DNS Filtering means either my phone connect to 8.8.8.8 and 8.8.4.4 or doesn't connect to any DNS server.

 

[Wutikorn]

My suggestion to AiProtection is to do factory reset(save config, but do not use it), do minimal setting, update Trend Micro signature and test parental control. If it works, then add all your setting manually. If it doesn't, restore your config. Note that I suspect AiProtection engine to be stored in saved config as well, and that's why I recommend not to restore setting.