Limiting your childrens’ internet access effectively using OpenDNS

There comes a time in a nerdy parent’s life when you happen to have kids that are old enough to get interested in using the internet. In my opinion there’s nothing wrong with digging through your pile of old hardware and assemble a reasonably good PC from it for your 10 year-old. But how do you avoid that your kids inadvertently find their ways into the less-desirable 90% of the internet? Read on about how to get the best results with adequate effort.

---

The Why of filtering

Recently my son (5th grade) claimed that other kids in his class were already allowed to use the internet. He would be the only one left out. Do the other parent really not care at all? And at the last parent teacher conference the class teacher told me that he announces everything class-related through his Facebook page. Yes – those are the people who are responsible for teaching our children media competency. He completely lost me when he claimed that getting a Facebook account is no big deal – it’s completely free. Excuse me? It appears that most people have no idea what’s going on on the internet. They occassionally get spam emails. They heard that there are porn sites. But what could possibly happen?

What to control?

There are essentially three different things that your kids may want from the internet: web surfing, email and installing software. Each of them pose different threats. Porn sites are not for 10 year-olds. Neither are social media sites that make children ruin their lives by posting inconsiderate content. Phishing emails may trick them to unwanted behavior. And installing random software thoughtlessly will easily get tons of adware, spyware and malware on their computers. So all three areas should be dealt with.

Web filtering

There is a reason why decent web filtering usually requires commercial solutions that are not affordable to anyone but large companies: it is hard. Why is it hard?

• Filtering HTTP requires at least a piece of extra software that intercepts HTTP requests and checks them if they are desired (e.g. Squid)
• Filtering HTTPS (which increasingly many web sites use) requires heavily invasive actions that are either unsuccessful or even harm the intended safety of the encrypted HTTP connection (deliberate man-in-the-middle-attack pattern with incomplete or no certificate validity checks)
• Commercial products do that with a mixture of automated scans and manual moderation with multiple employees categorizing web sites. If you start managing a whitelist (block everything except a list of known web sites) then you will spend countless hours adding entries to that list because common web sites load their information from various other sources and CDNs (content delivery networks). If you instead try to manage a blacklist you would have to get a complete list of bad web sites – not just the dozen sites that come to your mind but the literally over a billion existing domains. Every second 1.5 new domains are registered. Don’t even try to catch up with that.

Fortunately there is a good approach for filtering web sites that is less intrusive and at the same time easier to implement: DNS filtering. Every time you run a request for a web site you need to find out the IP address for the host name that you are requesting. For example for http://workaround.org/ your operating system needs to get the IP address for the “workaround.org” host name. If you get the actual IP address of my web server then you can reach my web site. However if the response you get leads you somewhere else then that other server gets the HTTP request. And if that other server sends you a web page that contains an error message instead it gets you content filtering one step even before HTTP filtering can occur. And it doesn’t even matter if you intended to do an HTTP request. It will even work for any other protocol like HTTPS.

DNS-based filtering

My first idea was to use a local name server (I’m running bind here anyway for my local domain) and use a blacklist like MESD. But on second thoughts I didn’t trust such a list to be maintained well enough. Fortunately there are services that offer exactly such DNS servers that let you configure which kinds of sites you want to reach. One of them is OpenDNS. They do not publish their software nor their blacklists – so “open” is a bit misleading – but at least their service is free (beer) for personal use. Now if you can make your children’s PC use that DNS server then you wouldn’t need any other kind of URL filter.

Pros:

• does not require maintaining any lists – you just have to make up your mind which categories of web sites you find inacceptable
• easy to implement

Cons:

• privacy: the external DNS filtering service gets to know which web sites you tried to access
• tampering: this kind of filtering only works as long as the user can’t use another name server or manage their /etc/hosts entries

So in the simplest case you get a free (beer) account at OpenDNS, configure the forbidden categories of web sites in their dashboard and just use their DNS in your internet router’s settings to use the OpenDNS settings for everyone in your network from now on. But that way you would apply the same filtering policy for all users. If you don’t mind that you are done.

Filtering only on certain computers

However you may want to apply the filtering policy to only your childrens’ computers. So you need to change their network settings. On an Ubuntu workstation you can still use DHCP to get an IP address in your network but override the DNS servers like this:

Caveat: Your children may locate that setting and use the usual DNS server again but let’s not worry about that for the moment.

Optional: Assigning the OpenDNS name server from your DHCP server

If you are like me then you are running your own DHCP server in your network. I’m using the isc-dhcp-server package on a Debian server. So instead of changing the network settings on the PC you can assign the OpenDNS name servers by sending your children’s PCs a special DNS setting if they use DHCP. Edit your /etc/dhcp/dhcpd.conf file and add a section for each children’s host:

host kid1 {
    hardware ethernet 9a:d1:83:d2:50:e4;
    option domain-name-servers 208.67.222.222, 208.67.220.220;
    }

Of course you will have to find out the computer’s hardware address of the network card and use it instead of the one that I’m using. Now you won’t need any further settings at the PC.

Mandatory: Do you have a dynamic IP address?

Most internet providers just assign a dynamic IP address to you that is changing frequently. Unfortunately OpenDNS would not be able to identify who you are if your IP address changes. So you need to tell them your new IP address to make the old policy work for the new address. That requires two steps.

First you have to give your network (actually just your public IP address that you probably hide behind using network address translation (NAT)) a unique label. Log into your OpenDNS dashboard and locate the network settings. Then edit your network and give it a name. You will need that name again in a minute.

OpenDNS uses a DynDNS-style update mechanism that you can use to tell them your current IP address. The configuration is explained in one of their support articles. All you need to do is install the ddclient package and use the configuration as described in their configuration example. Now whenever your IP address changes OpenDNS will get to know that and apply your desired filtering policy to every request coming from your new IP address.

Make tampering harder by using a firewall

Your children may realize that you changed their DNS server to block web sites and try to change back the IP. To prevent that any other DNS server is used you would have to use appropriate rules in your firewall. For example if you are using Shorewall (which I can totally recommend on any Linux server) then these rules will do:

# Allow DNS requests to the OpenDNS servers
ACCEPT  lan  inet:208.67.222.222,208.67.220.220  tcp,udp 53
# Forbid using any other name servers for the chidren's PC having the IP address 10.7.0.42
REJECT  lan:10.7.0.42  inet   tcp,udp 53

# Otherwise allow any access to the internet...
ACCEPT  lan    inet
# ...and the server itself
ACCEPT  lan    $FW

Caveat: Your children could just disable DHCP and use a fixed IP address in your network that is not restricted. But unless you intend to introduce VLANs and IEEE 802.1x-based network authentication you may even live with that risk. A family therapist may be a more adequate solution if you are having parental problems that require such extreme security measures. If you just want to notice such attempts you may run arpwatch in your network.

Browser plugins

So far you have prevented access to unwanted web sites. But you may still want to keep the internet less distracting and confusing by using the mandatory set of browser plugins:

• Adblock or Adblock Edge will get rid of any advertisements
  (I have no mercy with web sites that earn their money by showing so many ads that even an experienced internet user can hardly spot the actual content)
• Ghostery will block all the trackers from commercial nosey big-data voyeurs

Filtering email

At the beginning of this article I also mentioned email as a potential threat. Why does spam, phishing and malware (viruses, trojans) work so well? Because even many adults can’t identify them and fall for it. If nobody would pay attention to it then the spam problem would be long gone. But if adults can’t tell good from bad then how are your kids expected to do that?

As a nerdy and worrying parent I strongly recommend that you don’t use a freemail service like Google, GMX, 1&1 or whatever. Those services are free (beer) for a reason – think about it. If you haven’t already then set up your own mail service by using my ISPmail tutorial. That way you have full control over incoming emails and can set server-based filtering rules. I have configured rules that only allow emails to my children from trusted sender addresses. All other emails end up in my inbox and I will forward it if appropriate. (Of course I won’t keep doing that indefinitely while my kids grow up.)

Installing software

As a sysadmin I find it unbelievable how many people fell for malware like browser bars. Of course I know how easy it is to get infected. You need to install Java… you forget to disable the checkbox that installs McAfee crap or an Ask.com browser disenhancement… there you go. (One more reason why I think people should stop using Oracle Java. A company that is in dire need of winding up their users like that should face a boycott.) And on a common PC magazine-style download web site I’d like to see you figure out which of the dozen download links actually gets you where you wanted (hint: it’s the tiny one two screens down that just consists of barely readable text – not the huge blinking button at the top).

What is my suggestion? Simple: use Linux – e.g. Ubuntu on your workstation. If you are using Windows you need to get all kinds of common applications from third-party sources. Your Firefox browser may be a hoax if you get it from the wrong source. Oracle pollutes your computer with browser bars. You inadvertently get dozens of pointless “download helpers”. On a modern Linux distribution you get most of your software packages from the built-in software manager. No need to dig through the internet to find trusted applications. You can’t really go wrong with Ubuntu’s “software center” application.

Conclusion

Now that we have dealt with technical measures it’s time to spend time with your children and explore the internet together. Don’t let them do that on their own. And don’t count on schools to teach them any kind of media competency because most of the teachers are as helpless as the pupils. But above all: let your kids explore IT. Compared to my generation today’s kids have become overly ignorant of the underlying technologies that power the internet. We really need to change that.

I hope you found this article helpful. Let me know what your experiences are with children and the internet in the comments below.