Parental guardian - internet (WEB) filtering

Path	csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!newsfeed.fsmpi.rwth-aachen.de!newsfeed.straub-nv.de!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail
From	Tim Watts <tw_usenet@dionic.net>
Newsgroups	uk.d-i-y, uk.comp.os.linux, comp.os.linux.misc
Subject	Parental guardian - internet (WEB) filtering
Date	Tue, 31 Mar 2015 18:36:31 +0100
Lines	69
Message-ID	<vh2rub-54e.ln1@squidward.dionic.net> (permalink)
Mime-Version	1.0
Content-Type	text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding	7bit
X-Trace	individual.net 19M4xGqF6kdZswBtbfkwTAp5HV2/9y20UT/LAUs23Evk9NXUQh
X-Orig-Path	squidward.dionic.net!not-for-mail
Cancel-Lock	sha1:wDcFZhfKo6o7p+5I8srWI0sz3f8=
User-Agent	Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0
Xref	csiph.com comp.os.linux.misc:14284

Cross-posted to 3 groups.

Show key headers only | View raw

Please, no debates about the merits of this -

I'm having trouble trying to find anything that might work.


DNS based:
==========
OpenDNS https://www.opendns.com/home-internet-security/
is going to be tricky trying to make that work alongside Unblock-US 
which is also DNS based. I might be able to track down the relevant 
Netflix zones and declared them in my local DNS server and refer those 
to UnblockUS whilst the default is to OpenDNS. In many ways though this 
is the easiest solution, except that it has to work along side UnblockUS.

No worries about the kids setting their own DNS servers, I'll deal with 
that in the firewall :)



Proxy
=====
eg Squidguard - It will not work with SSL traffic. Well, it might, but 
then all my browsers will throw up man-in-the-middle warnings. Seems 
like a non starter.

Bloody big blacklist of IPs
===========================
Assuming I can load several million into iptables without blowing up the 
router (see below), this could work.


Any approaches I've missed? Does not need to be perfect - just good 
enough to mostly keep them off rotten.com, jihadist beheading vids and 
hard core porn. And if they hack their way around it, good for them - at 
least they are working for it - no illusions that they will be defeated 
for ever.


Cheers

Tim



Equipment I have:

Nice linux router running Debian 7 (this is are full blown nano system 
with lots of RAM, not embedded). It is my PPPoE endpoint, firewall, 
router, DNS, DHCP NAT and kerberos box.


So I'd like to put 2 of my VLANs onto a filtered feed whilst leaving the 
main VLANs unfiltered. My VLANs are like this:

1) Public IP /27 block
2) Private "Golden" 10.0.0.0/24 block
3) Media 10.0.1.0/24 block for Netflix etc - Chromecast, Roku and 
phones/pads will use this
4) Guest net 10.0.2.0/24

Each maps to a separate WIFI ESSID.

1+2 unfiltered
3+4 filtered all the time.

Only difference between 3 and 4 is 4 can get a new password every few 
weeks, without having to change Chromecast, Roku and other stuff.

Assume the kids do not ever get to access 1+2.

Back to comp.os.linux.misc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-03-31 18:36 +0100
  Re: Parental guardian - internet (WEB) filtering Andy Cap <snruwfpgbizo@trashmail.net> - 2015-03-31 18:44 +0100
  Re: Parental guardian - internet (WEB) filtering "Dave Liquorice" <allsortsnotthisbit@howhill.com> - 2015-03-31 19:25 +0000
    Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-03-31 22:13 +0100
      Re: Parental guardian - internet (WEB) filtering "Dave Liquorice" <allsortsnotthisbit@howhill.com> - 2015-04-02 00:03 +0000
        Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-02 01:14 +0100
  Re: Parental guardian - internet (WEB) filtering Bill <Billaboard@gmail.com> - 2015-03-31 20:14 +0100
    Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-03-31 22:07 +0100
    Re: Parental guardian - internet (WEB) filtering Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-03-31 15:18 -0700
      Re: Parental guardian - internet (WEB) filtering The Real Doctor <ian.groups@btinternet.com> - 2015-04-01 23:10 +0100
        Re: Parental guardian - internet (WEB) filtering Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-04-01 17:01 -0700
          Re: Parental guardian - internet (WEB) filtering "Rod Speed" <rod.speed.aaa@gmail.com> - 2015-04-02 11:38 +1100
  Re: Parental guardian - internet (WEB) filtering "john james" <jj9801@nospam.com> - 2015-04-01 06:59 +1100
    Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-03-31 22:13 +0100
      Re: Parental guardian - internet (WEB) filtering Capitol <spam@wher.eva.co.uk> - 2015-03-31 22:19 +0100
      Re: Parental guardian - internet (WEB) filtering "john james" <jj9801@nospam.com> - 2015-04-01 09:46 +1100
        Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-01 00:19 +0100
          Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-01 16:30 +0100
  Re: Parental guardian - internet (WEB) filtering John Rumm <see.my.signature@nowhere.null> - 2015-04-01 23:50 +0100
    Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-02 01:10 +0100
      Re: Parental guardian - internet (WEB) filtering Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-04-03 17:52 -0700
        Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 09:09 +0100
          Re: Parental guardian - internet (WEB) filtering Martin Gregorie <martin@address-in-sig.invalid> - 2015-04-04 12:24 +0000
            Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 19:25 +0100
              Re: Parental guardian - internet (WEB) filtering Martin Gregorie <martin@address-in-sig.invalid> - 2015-04-04 19:29 +0000
                Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 20:53 +0100
                Re: Parental guardian - internet (WEB) filtering Martin Gregorie <martin@address-in-sig.invalid> - 2015-04-04 21:58 +0000
                Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 23:18 +0100
              Re: Parental guardian - internet (WEB) filtering Richard Kettlewell <rjk@greenend.org.uk> - 2015-04-04 21:28 +0100
                Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 21:37 +0100
              Re: Parental guardian - internet (WEB) filtering Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2015-04-05 02:50 +0100
                Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-05 10:58 +0100
                Re: Parental guardian - internet (WEB) filtering Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2015-04-05 11:27 +0100
      Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 13:57 +0100
        Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 19:35 +0100
          Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 21:39 +0100
  Re: Parental guardian - internet (WEB) filtering usenet@cucumber.me.uk (Andrew Gabriel) - 2015-04-09 09:29 +0000
    Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-09 13:35 +0100

csiph-web