Path: csiph.com!usenet.pasdenom.info!news.albasani.net!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: Tim Watts Newsgroups: uk.d-i-y,uk.comp.os.linux,comp.os.linux.misc Subject: Re: Parental guardian - internet (WEB) filtering Date: Sat, 04 Apr 2015 19:35:48 +0100 Lines: 169 Message-ID: <4hn5vb-in4.ln1@squidward.dionic.net> References: <1n35vb-v9c.ln1@squidward.dionic.net> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net Wpdg83D6Hq+L2LHK2ZUVyQwLsjSYBe4oIY2Tdx2s2CR/v1WF3K X-Orig-Path: squidward.dionic.net!not-for-mail Cancel-Lock: sha1:uTwv28WWY2nfgpxzC27Z2eIX38w= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 In-Reply-To: <1n35vb-v9c.ln1@squidward.dionic.net> Xref: csiph.com comp.os.linux.misc:14331 On 04/04/15 13:57, Tim Watts wrote: > On 02/04/15 01:10, Tim Watts wrote: >> >> But there's a little known feature in Google in that if you set your DNS >> to resolve www.google.* to the CNAME forcesafesearch.google.com >> then that does what it says - clever... >> > > OMG that was unexpectedly difficult to do in bind9 (easier in dnsmasq > apparently): > > https://productforums.google.com/d/msg/websearch/srXRvrF1ERg/qtvZfsaWsIQJ > > But it does work - even in a "view" > > So onwards and upwards - now to blend netflix.* and OpenDNS... Right - it works! This is going to get a blog write up - but essentially my logic is: 4 WiFi ESSIDs each mapping to 4 VLANs/netblocks. 2 are protected and Unblock-US enabled for Netflix enjoyment. Basically the magic is thus: named.conf: view "filtered" { match-clients { filter; }; forward only; # # Default forward to OpenDNS # forwarders { 208.67.222.222; 208.67.220.220; }; include "/etc/bind/named.conf.default-zones"; include "/etc/bind/common/inc-internal-tentacleacres.conf"; include "/etc/bind/common/inc-forcegoogle-safesearch.conf"; include "/etc/bind/common/inc-sites-to-unblockus.conf"; }; ## So by default queries from "filter" clients (an ACL that includes the 2 protected netblocks) are forwarded to OpenDNS servers where we have an account. inc-forcegoogle-safesearch.conf looks like: # # Catch google queries and force to safesearch # response-policy { zone "google"; }; # zone "google" IN { type master; file "/etc/bind/master/db.google"; allow-query { none; }; }; No credit to me - I nicked Terry's work in a previously referenced link. Works a treat though - and the zone file looks like: $TTL 1D ; ; overrides for www.google.* to force safesearch ; @ IN SOA localhost. hostmaster.dionic.net. ( 2015040436 ; Serial (YYYYMMDD##) 1H ; Refresh 1H ; Retry 1H ; Expire 1H ) ; Default_ttl @ IN NS localhost. ; ; Google forced Safe Search zone and data ; google.com IN CNAME forcesafesearch.google.com. www.google.com IN CNAME forcesafesearch.google.com. google.ad IN CNAME forcesafesearch.google.com. www.google.ad IN CNAME forcesafesearch.google.com. google.ae IN CNAME forcesafesearch.google.com. www.google.ae IN CNAME forcesafesearch.google.com. ... etc Then the merge in of Unblock-US - this is a bit of a kludge but does work: ### inc-sites-to-unblockus.conf # Declare netflix zones to forward to unblock-us DNS servers # # We need this! zone "unblock-us.com" IN { type forward; forwarders { 208.122.23.22; 208.122.23.23; }; }; # # Netflix domains # zone "netflix.com" IN { type forward; forwarders { 208.122.23.22; 208.122.23.23; }; }; zone "netflix.net" IN { type forward; forwarders { 208.122.23.22; 208.122.23.23; }; }; zone "nflximg.com" IN { type forward; forwarders { 208.122.23.22; 208.122.23.23; }; }; zone "nflximg.net" IN { type forward; forwarders { 208.122.23.22; 208.122.23.23; }; }; # Yes, we do need this. zone "elb.amazonaws.com" IN { type forward; forwarders { 208.122.23.22; 208.122.23.23; }; }; # # End of Netflix # The worst bit there is having to grab elb.amazonaws.com and throw it towards UnblockUS's DNS servers - without it the stream simply will not load. We have some netfilter rules too for force all relevant DNS queries to go to our server and to make sure that queries to OpenDNS consistently originate from one particular IP (because they only let to regsiter (easily) one IP on the free account). However, it works - and it works really well. +100 vote for OpenDNS - they have some lovely category filters that you can tick on/off as required and you can add white and blacklisted domains in. No way is it bompproof - nothing is. But to circumvent it, the kids will either need a VPN or a proxy (eg ssh server or raw SOCKS5 proxy) outside my networks. If they figure that out I will be proud of them. Then I'll fix that too :)