Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > comp.os.linux.misc > #14331
| From | Tim Watts <tw_usenet@dionic.net> |
|---|---|
| Newsgroups | uk.d-i-y, uk.comp.os.linux, comp.os.linux.misc |
| Subject | Re: Parental guardian - internet (WEB) filtering |
| Date | 2015-04-04 19:35 +0100 |
| Message-ID | <4hn5vb-in4.ln1@squidward.dionic.net> (permalink) |
| References | <vh2rub-54e.ln1@squidward.dionic.net> <NKydnSdVs5uo64HInZ2dnUVZ8hqdnZ2d@brightview.co.uk> <f1euub-ra9.ln1@squidward.dionic.net> <1n35vb-v9c.ln1@squidward.dionic.net> |
Cross-posted to 3 groups.
On 04/04/15 13:57, Tim Watts wrote:
> On 02/04/15 01:10, Tim Watts wrote:
>>
>> But there's a little known feature in Google in that if you set your DNS
>> to resolve www.google.* to the CNAME forcesafesearch.google.com
>> then that does what it says - clever...
>>
>
> OMG that was unexpectedly difficult to do in bind9 (easier in dnsmasq
> apparently):
>
> https://productforums.google.com/d/msg/websearch/srXRvrF1ERg/qtvZfsaWsIQJ
>
> But it does work - even in a "view"
>
> So onwards and upwards - now to blend netflix.* and OpenDNS...
Right - it works!
This is going to get a blog write up - but essentially my logic is:
4 WiFi ESSIDs each mapping to 4 VLANs/netblocks.
2 are protected and Unblock-US enabled for Netflix enjoyment.
Basically the magic is thus:
named.conf:
view "filtered" {
match-clients { filter; };
forward only;
#
# Default forward to OpenDNS
#
forwarders {
208.67.222.222;
208.67.220.220;
};
include "/etc/bind/named.conf.default-zones";
include "/etc/bind/common/inc-internal-tentacleacres.conf";
include "/etc/bind/common/inc-forcegoogle-safesearch.conf";
include "/etc/bind/common/inc-sites-to-unblockus.conf";
};
## So by default queries from "filter" clients (an ACL that includes the
2 protected netblocks) are forwarded to OpenDNS servers where we have an
account.
inc-forcegoogle-safesearch.conf looks like:
#
# Catch google queries and force to safesearch
#
response-policy { zone "google"; };
#
zone "google" IN {
type master;
file "/etc/bind/master/db.google";
allow-query { none; };
};
No credit to me - I nicked Terry's work in a previously referenced link.
Works a treat though - and the zone file looks like:
$TTL 1D
;
; overrides for www.google.* to force safesearch
;
@ IN SOA localhost. hostmaster.dionic.net. (
2015040436 ; Serial (YYYYMMDD##)
1H ; Refresh
1H ; Retry
1H ; Expire
1H ) ; Default_ttl
@ IN NS localhost.
;
; Google forced Safe Search zone and data
;
google.com IN CNAME forcesafesearch.google.com.
www.google.com IN CNAME forcesafesearch.google.com.
google.ad IN CNAME forcesafesearch.google.com.
www.google.ad IN CNAME forcesafesearch.google.com.
google.ae IN CNAME forcesafesearch.google.com.
www.google.ae IN CNAME forcesafesearch.google.com.
... etc
Then the merge in of Unblock-US - this is a bit of a kludge but does work:
### inc-sites-to-unblockus.conf
# Declare netflix zones to forward to unblock-us DNS servers
#
# We need this!
zone "unblock-us.com" IN {
type forward;
forwarders {
208.122.23.22;
208.122.23.23;
};
};
#
# Netflix domains
#
zone "netflix.com" IN {
type forward;
forwarders {
208.122.23.22;
208.122.23.23;
};
};
zone "netflix.net" IN {
type forward;
forwarders {
208.122.23.22;
208.122.23.23;
};
};
zone "nflximg.com" IN {
type forward;
forwarders {
208.122.23.22;
208.122.23.23;
};
};
zone "nflximg.net" IN {
type forward;
forwarders {
208.122.23.22;
208.122.23.23;
};
};
# Yes, we do need this.
zone "elb.amazonaws.com" IN {
type forward;
forwarders {
208.122.23.22;
208.122.23.23;
};
};
#
# End of Netflix
#
The worst bit there is having to grab elb.amazonaws.com and throw it
towards UnblockUS's DNS servers - without it the stream simply will not
load.
We have some netfilter rules too for force all relevant DNS queries to
go to our server and to make sure that queries to OpenDNS consistently
originate from one particular IP (because they only let to regsiter
(easily) one IP on the free account).
However, it works - and it works really well. +100 vote for OpenDNS -
they have some lovely category filters that you can tick on/off as
required and you can add white and blacklisted domains in.
No way is it bompproof - nothing is. But to circumvent it, the kids will
either need a VPN or a proxy (eg ssh server or raw SOCKS5 proxy) outside
my networks. If they figure that out I will be proud of them. Then I'll
fix that too :)
Back to comp.os.linux.misc | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-03-31 18:36 +0100
Re: Parental guardian - internet (WEB) filtering Andy Cap <snruwfpgbizo@trashmail.net> - 2015-03-31 18:44 +0100
Re: Parental guardian - internet (WEB) filtering "Dave Liquorice" <allsortsnotthisbit@howhill.com> - 2015-03-31 19:25 +0000
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-03-31 22:13 +0100
Re: Parental guardian - internet (WEB) filtering "Dave Liquorice" <allsortsnotthisbit@howhill.com> - 2015-04-02 00:03 +0000
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-02 01:14 +0100
Re: Parental guardian - internet (WEB) filtering Bill <Billaboard@gmail.com> - 2015-03-31 20:14 +0100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-03-31 22:07 +0100
Re: Parental guardian - internet (WEB) filtering Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-03-31 15:18 -0700
Re: Parental guardian - internet (WEB) filtering The Real Doctor <ian.groups@btinternet.com> - 2015-04-01 23:10 +0100
Re: Parental guardian - internet (WEB) filtering Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-04-01 17:01 -0700
Re: Parental guardian - internet (WEB) filtering "Rod Speed" <rod.speed.aaa@gmail.com> - 2015-04-02 11:38 +1100
Re: Parental guardian - internet (WEB) filtering "john james" <jj9801@nospam.com> - 2015-04-01 06:59 +1100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-03-31 22:13 +0100
Re: Parental guardian - internet (WEB) filtering Capitol <spam@wher.eva.co.uk> - 2015-03-31 22:19 +0100
Re: Parental guardian - internet (WEB) filtering "john james" <jj9801@nospam.com> - 2015-04-01 09:46 +1100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-01 00:19 +0100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-01 16:30 +0100
Re: Parental guardian - internet (WEB) filtering John Rumm <see.my.signature@nowhere.null> - 2015-04-01 23:50 +0100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-02 01:10 +0100
Re: Parental guardian - internet (WEB) filtering Bobbie Sellers <bliss-sf4ever@dslextreme.com> - 2015-04-03 17:52 -0700
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 09:09 +0100
Re: Parental guardian - internet (WEB) filtering Martin Gregorie <martin@address-in-sig.invalid> - 2015-04-04 12:24 +0000
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 19:25 +0100
Re: Parental guardian - internet (WEB) filtering Martin Gregorie <martin@address-in-sig.invalid> - 2015-04-04 19:29 +0000
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 20:53 +0100
Re: Parental guardian - internet (WEB) filtering Martin Gregorie <martin@address-in-sig.invalid> - 2015-04-04 21:58 +0000
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 23:18 +0100
Re: Parental guardian - internet (WEB) filtering Richard Kettlewell <rjk@greenend.org.uk> - 2015-04-04 21:28 +0100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 21:37 +0100
Re: Parental guardian - internet (WEB) filtering Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2015-04-05 02:50 +0100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-05 10:58 +0100
Re: Parental guardian - internet (WEB) filtering Andy Burns <usenet.feb2014@adslpipe.co.uk> - 2015-04-05 11:27 +0100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 13:57 +0100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 19:35 +0100
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-04 21:39 +0100
Re: Parental guardian - internet (WEB) filtering usenet@cucumber.me.uk (Andrew Gabriel) - 2015-04-09 09:29 +0000
Re: Parental guardian - internet (WEB) filtering Tim Watts <tw_usenet@dionic.net> - 2015-04-09 13:35 +0100
csiph-web