OPNsense Forum
English Forums => General Discussion => Topic started by: mucflyer on May 31, 2018, 06:27:55 pm
-
Hi All
OPNSense looks cool, very promising. Only two things I'm really missing. AD Blocking realized easy way, implementing black list, without playing with proxy, rules etc.
And second, even more important - parental control. I would like to limit Internet usage for example 4 hours per day. And disable network between let's say 8PM and 6AM.
Will it even be possible ?
-
you can use firewall schedules to make a rule only available at certain time ranges - no problem. But what's the problem with the proxy? It's working pretty well.
-
Not sure right now, I think I was struggling with transparent proxy and https. Due to, no option to install replacement certificate on local machines. And mobile phones. But maybe I will come back to opnsense trying this again. pfblockerng is easier and works for both http and https without additional work on local machines.
-
> Parental control nad AD blocking, will it ever happen ?
It happened.
https://docs.opnsense.org/manual/how-tos/proxywebfilter.html
Cheers,
Franco
-
This looks indeed good.
Any chance, to have Internet budget in the future (to allow, lets say, only 4 hours / PC / day).
-
> Parental control nad AD blocking, will it ever happen ?
It happened.
https://docs.opnsense.org/manual/how-tos/proxywebfilter.html
Cheers,
Franco
Correct me if I'm wrong, but this will restrict access for all devices. This is definitely not parental control. Parental control means implementing access restrictions based on MAC address and, ideally, different rules for each MAC. I have two kids, 7 yro and 14 yro. I definitely can't apply the same restrictions to both. And I don't want any restrictions for me and my wife. And that's only part one of parental control is. The second part is internet budget.
-
you probably want to use a user based acl which the proxy is capable to handle. I am just not sure if that works via the GUI.
-
I'm using a simple add blocker as described here. I edited the list slightly as my wife finds the google add links are sometimes useful, especially when shopping. :)
https://devinstechblog.com/ (https://devinstechblog.com/)
-
Quick note on my message above, if you do edit the list, remember to restart Unbound and you may also need to do a flushdns on your devices.
-
I'm using a simple add blocker as described here. I edited the list slightly as my wife finds the google add links are sometimes useful, especially when shopping. :)
https://devinstechblog.com/ (https://devinstechblog.com/)
How is this linked to a specific MAC?
-
you probably want to use a user based acl which the proxy is capable to handle. I am just not sure if that works via the GUI.
Yeah, good luck with that on Android. I can enter a proxy and a port, but that's as far as it goes. No user/pass there. But that would be the wrong approach anyway. The norm is transparent proxy with MAC based restrictions.
-
I'm using a simple add blocker as described here. I edited the list slightly as my wife finds the google add links are sometimes useful, especially when shopping. :)
https://devinstechblog.com/ (https://devinstechblog.com/)
How is this linked to a specific MAC?
It's not, I missed your bit about the mac address.
-
Imho it must be a mix of captive portal with currently Missing limit per user and something like opendns family shield.
-
Or MAC filtering on a schedule or a VLAN on a schedule. Fixed IP and no dhcp on the VLAN.
Forgot to add the MAC address filtering is pretty easy to bypass.
-
I guess that for your kids an approach based on "hotel" setup, using vouchers, would be a better fit, at least for internet time budgeting.
For the web filtering, I would set a static lease for each PC so that I'd be sure the PCs would always have the same IP, and set appropriate filtering in proxy for each IP, accordingly and respectively. Of course, your kids should not have admin rights on their PC logon users (to not be able to manually change the IP on PCs).
-
The best way to protect your kids is to talk to them. Frequently. And be interested in their life.
-
The best way to protect your kids is to talk to them. Frequently. And be interested in their life.
+1
The only 24/7/365 guardian your kid has is your kid: just train the guardian and prepare him for the actual and complete reality.
To get back on the topic, a few categories like pornography, gambling, grotesque and alike, together with search engines safe search, should do. Set the filtering on your router and without exceptions, such categories should not be an issue if they’re blocked for anyone and everyone.
PS Everyone makes mistakes, kids are no exception. When they eventually will, you’ll want them as friends and partners, and want them to see you as such as well, ready and quite eager to seek out understanding, empathy and maybe good advices from you: the spying app/ tracker app will turn your kids in the opposite direction when they’ll learn about such an app. And they’ll definitely learn about it!
IMO :)
-
I'm don't trust any parental control apps on my child's phone because I tried many of them, and somehow my kids did break the app. After that case, I lost control and didn't know what they're doing on their devices. I read some articles that said that the best way to protect your kid is to put a tracker on their phone.
I understand you. This generation has grown up with a phone in hand and they have a lot to get around almost any obstacle. ::) I also searched for software for a long time that would control the time and traffic on my children's devices. I chosed this work time (https://www.worktime.com/)
-
I would use AdGuardHome and transparent Proxy with shalla list
-
Seconded with respect to AdGuard Home. Awesome piece of software.
-
Also take a look at NextDNS. I have been very happy with it for Ad Blocking by just forwarding from Unbound using DoT and ensuring users can't bypass it easily.
-
Have you tried / seen zenarmor (sensei) ?
You can make multiple policies and with fixed ip for the kids you can make custom (ad) blocking as apps as time limits etc.
-
This is junk, don't click the link
https://urlscan.io/screenshots/11e417ac-afd4-4e47-b0d3-93f342a54e35.png (https://urlscan.io/screenshots/11e417ac-afd4-4e47-b0d3-93f342a54e35.png)
https://urlscan.io/result/11e417ac-afd4-4e47-b0d3-93f342a54e35/compare (https://urlscan.io/result/11e417ac-afd4-4e47-b0d3-93f342a54e35/compare)
One hit so far on VT
https://www.virustotal.com/gui/url/9ea21d6c69b26d65d5a4430e6fe2defe152ec58509f7ad7dd952c8256c669aff (https://www.virustotal.com/gui/url/9ea21d6c69b26d65d5a4430e6fe2defe152ec58509f7ad7dd952c8256c669aff)