Parental control

Because you can't let the kids on YouTube 24/7 and some games are really addictive :)

The router must run OpenWRT or DD-WRT.

The kids devices must be assigned IP's from a certain range, let's say 192.168.1.128/28 by adding some lines similar to the following one into Additional Dnsmasq Options:
dhcp-host=set:red,AA:BB:CC:00:DD:22,kids-tv,192.168.1.130,43200m


A series of scripts must be put in /jffs/ and called by a cron job:

cat add_fw
#!/bin/sh
iptables -I FORWARD 1 -s 192.168.1.128/28 -j DROP
iptables -I FORWARD 2 -s 192.168.1.128/28 -m conntrack -j DROP --ctstate RELATED,ESTABLISHED

cat del_fw

#!/bin/sh

iptables -D FORWARD -s 192.168.1.128/28 -j DROP

iptables -D FORWARD -s 192.168.1.128/28 -m conntrack -j DROP --ctstate RELATED,ESTABLISHED

cat disable_game

#!/bin/sh

# DNS Rules

sed -e 's/^#//' -i /tmp/games-block.conf

sed -e 's/^#//' -i /tmp/yt-block.conf

restart_dns

# Force kids DNS to local
iptables -t nat -A PREROUTING -i br0 -s 192.168.1.128/28 -p udp --dport 53 -j DNAT --to 192.168.1.1

iptables -t nat -A PREROUTING -i br0 -s 192.168.1.128/28 -p tcp --dport 53 -j DNAT --to 192.168.1.1

# Block all ports over :500

iptables -I FORWARD 5 -p tcp --source 192.168.1.128/28 --dport 500:65535 -j DROP

cat allow_game

#!/bin/sh

# Remove DNS rules

sed 's/^\([^#]\)/#\1/g' -i /tmp/games-block.conf

sed 's/^\([^#]\)/#\1/g' -i /tmp/yt-block.conf

restart_dns

# Remove Force kids DNS to local

iptables -t nat -D PREROUTING -i br0 -s 192.168.1.128/28 -p udp --dport 53 -j DNAT --to 192.168.1.1

iptables -t nat -D PREROUTING -i br0 -s 192.168.1.128/28 -p tcp --dport 53 -j DNAT --to 192.168.1.1

# Unblock all ports over :500

iptables -D FORWARD -p tcp --source 192.168.1.128/28 --dport 500:65535 -j DROP

I do have an extra script that allow access to YouTube, without allowing games, this one is called only from a html page that I'll explain in a later post:

cat allow_yt

#!/bin/sh

sed 's/^\([^#]\)/#\1/g' -i /tmp/yt-block.conf

restart_dns

Those scripts are called by cron jobs that makes sure we don't have internet during the sleep hours and games & YouTube are permitted only during the weekend:

00 21 * * 0-4 root /jffs/add_fw

30 22 * * 5,6 root /jffs/add_fw

00 08 * * * root /jffs/del_fw

30 17 * * 5 root /jffs/allow_game

30 17 * * 0 root /jffs/disable_game

In order to block the DNS requests, the following Additional Dnsmasq Options needs to be added:

conf-file=/tmp/yt-block.conf

conf-file=/tmp/games-block.conf

The files /tmp/yt-block.conf and /tmp/games-block.conf are created by the startup script:

stopservice dnsmasq

echo "#address=/.roblox.com/192.168.1.1

#address=/.rbxcdn.com/192.168.1.1

#address=/.epicgames.com/192.168.1.1

#address=/.fortnitegame.com/192.168.1.1

#address=/.easyanticheat.com/192.168.1.1

#address=/.pixelgunserver.com/192.168.1.1

#address=/.applovin.com/192.168.1.1

#address=/.clashroyaleapp.com/192.168.1.1

#address=/.applifier.com/192.168.1.1

#address=/.chartboost.com/192.168.1.1

#address=/.fyber.com/192.168.1.1

#address=/.twitch.tv/192.168.1.1

#address=/.ttvnw.net/192.168.1.1

#address=/.leagueoflegends.com/192.168.1.1

#address=/.pvp.net/192.168.1.1

#address=/.riotgames.com/192.168.1.1

#address=/.garenanow.com/192.168.1.1

#address=/.ea.com/192.168.1.1

#address=/.respawn.com/192.168.1.1

#address=/.origin.com/192.168.1.1" > /tmp/games-block.conf

echo "#address=/.youtube.com/192.168.1.1

#address=/youtube.googleapis.com/192.168.1.1

#address=/youtubei.googleapis.com/192.168.1.1

#address=/.ytimg.com/192.168.1.1

#address=/ytimg.l.google.com/192.168.1.1

#address=/youtube.l.google.com/192.168.1.1

#address=/.googlevideo.com/192.168.1.1

#address=/.youtube-nocookie.com/192.168.1.1

#address=/.youtu.be/192.168.1.1" > /tmp/yt-block.conf

startservice dnsmasq

An "easy" way to run those scripts besides the scheduled cron jobs, is from the DD-WRT Administration -> Commands page:

DNS Adbock on router

In case you have, like me, a secodary dns on your DD-WRT router, you need a dns adblock on it too. By modifying the excellent tutorial from http://www.howtogeek.com/51477/how-to-remove-advertisements-with-pixelserv-on-dd-wrt/ I came to this script:

#!/bin/sh
########Functions setup#########################
logger_ads()
{
logger -s -p local0.notice -t ad_blocker $1
}

softlink_func()
{
ln -s /tmp/$1 /jffs/dns/$2
if [ "`echo $?`" -eq 0 ] ; then
logger_ads "Created $3 softlink to RAM on JFFS"
else
logger_ads "The attempt to create $3 softlink to RAM on JFFS *FAILED*"
logger_ads "it is obvious something IS *terribly wrong*. Will now exit... bye (ads will not be blocked)"
exit 1
fi
}

note_no_space()
{
logger_ads "I assure you this only takes $1 blocks, but I guess your too close to the edge for JFFSs comfort"
logger_ads "deleting the half witted file, as to not confuse the DNS service and free up the JFFS space for other uses."
}
##################################################
nvram set aviad_changed_nvram=0
logger_ads "########### Ads blocker script starting ###########"

if [[ -z "$1" ]]; then
logger_ads "Sleeping for 30 secs to give time for router boot"
sleep 30
else
logger_ads "override switch given"
[[ $1 = "-h" || $1 = "/?" ]] && echo "use -m to override the 30 seconds delay and -f to force a list refresh" && exit 0
[ $1 = "-f" ] && rm /jffs/dns/dnsmasq.adblock.conf && rm /jffs/dns/dlhosts
fi

while ! ping www.google.com -c 1 > /dev/null ; do
logger_ads "waiting for the internet connection to come up"
sleep 5
done

logger_ads "Adding a refresh cycle by puting the script in cron if it isnt there yet"
if [[ -z "`cat /tmp/crontab | grep "/jffs/dns/disable_adds.sh"`" ]] ; then
echo '0 0 * * * root /jffs/dns/disable_adds.sh -m' > /tmp/crontab
stopservice cron && logger_ads "stopped the cron service" startservice cron && logger_ads "started the cron service"
else
logger_ads "The script is already in cron"
fi

logger_ads "New IP and ports setup. Reserve the IP .100 for pixelserv"
pixel="`ifconfig br0 | grep inet | awk '{ print $2 }' | awk -F ":" '{ print $2 }' | cut -d . -f 1,2,3`.100"
mgmtip="`ifconfig br0 | grep inet | awk '{ print $2 }' | awk -F ":" '{ print $2 }'`"

# In my case, on IP .100 I have an apache serving null.html as error page. Comment
next 3 paragraphs, as I don't need pixelserv
#logger_ads "Move http interface to $mgmtip:88"
#if [[ -z "`ps | grep -v grep | grep "httpd -p 88"`" && `nvram get http_lanport` -ne 88 ]]
; then
# logger_ads "it seems that the http is not setup yet on port :88"
# stopservice httpd
# nvram set http_lanport=88
# nvram set aviad_changed_nvram=1
# startservice httpd
#else
# logger_ads "The http is already setup on $mgmtip:88"
#fi

#logger_ads "Redirect setup IP/Port from $mgmtip:80 to $mgmtip:88"
#[[ -z "`iptables -L -n -t nat | grep $mgmtip | grep 80`" ]] && logger_ads "did NOT find an active redirect rule with the iptable command, injecting it now." && /usr/sbin/iptables -t nat -I PREROUTING 1 -d $mgmtip -p tcp --dport 80 -j DNAT --to $mgmtip:88
#nvram get rc_firewall > /tmp/fw.tmp
#if [[ -z "`cat /tmp/fw.tmp | grep "/usr/sbin/iptables -t nat -I PREROUTING 1 -d $mgmtip  p tcp --dport 80 -j DNAT --to $mgmtip:88"`" ]] ; then
# echo "/usr/sbin/iptables -t nat -I PREROUTING 1 -d $mgmtip -p tcp --dport 80 -j DNAT --to $mgmtip:88" >> /tmp/fw.tmp
# nvram set rc_firewall="`cat /tmp/fw.tmp`"
# logger_ads "DONE appending forwarding to FW script"
# nvram set aviad_changed_nvram=1
#else
# logger_ads "The redirection $mgmtip:80 -> $mgmtip:88 in FW script is already in place"
#fi
#rm /tmp/fw.tmp

#logger_ads "Starting or ReSpawning pixelsrv on $pixel IP :80"
#/sbin/ifconfig br0:1 $pixel netmask "`ifconfig br0 | grep inet | awk '{ print $4 }' | awk -F ":" '{ print $2 }'`" broadcast "`ifconfig br0 | grep inet | awk '{ print $3 }' | awk -F ":" '{print $2 }'`" up
#if [[ -n "`ps | grep -v grep | grep /jffs/dns/pixelserv`" ]]; then
# logger_ads "the pixelserv is already up"
#else
# logger_ads "it seems that the pixelserv isnt up. starting it now"# /jffs/dns/pixelserv $pixel -p 80
#fi

logger_ads "Get the online dns blocking lists"
[ ! -e /jffs/dns/whitelist ] && echo google-analytics > /jffs/dns/whitelist && echo toma.guru >> /jffs/dns/whitelist
if [[ -n "$(find /jffs/dns/dlhosts -mtime +7)" || -n "$(find /jffs/dns/dnsmasq.adblock.conf mtime +7)" || ! -e /jffs/dns/dlhosts || ! -e /jffs/dns/dnsmasq.adblock.conf ]]; then
logger_ads "The lists are NOT setup at all yet, or more then 7 days old, will now retrieve them from the web"
logger_ads "Retrieving the MVPS hosts list..."
wget -q -O - http://www.mvps.org/winhelp2002/hosts.txt | grep "^127.0.0.1"
| grep -v localhost | tr -d '\015' >/tmp/dlhosts.tmp
logger_ads "adjusting the MVPS hosts list for our use"
cat /jffs/dns/whitelist | while read line; do sed -i /${line}/d /tmp/dlhosts.tmp
; done
sed -i s/127.0.0.1/$pixel/g /tmp/dlhosts.tmp
logger_ads "done adjusting the MVPS hosts list."
logger_ads "Retrieving the Yoyo domain list..."
wget -q
"http://pgl.yoyo.org/adservers/serverlist.php?hostformat=dnsmasq&showintro=0&mietype=plaintext" -O /tmp/adblock.tmp
logger_ads "adjusting the Yoyo domain list for our use"
cat /jffs/dns/whitelist | while read line; do sed -i /${line}/d /tmp/adblock.tmp
; done
sed -i s/127.0.0.1/$pixel/g /tmp/adblock.tmp
if [ "`df| grep /jffs | awk '{ print $4 }'`" -ge 65 ] ; then
logger_ads "Moving the Yoyo list to JFFS (as it looks that there is enough space for it)"
mv /tmp/adblock.tmp /jffs/dns/dnsmasq.adblock.conf
if [ "`echo $?`" -eq 0 ] ; then
logger_ads "Moving the YoYo domain list to JFFS operation was successful"
else
note_no_space 20
rm /jffs/dns/dnsmasq.adblock.conf
softlink_func adblock.tmp dnsmasq.adblock.conf YoYo
fi
else
logger_ads "*NOT* Moving the Yoyo list to JFFS (as it looks that there is *NOT* enough space for it)"
softlink_func adblock.tmp dnsmasq.adblock.conf YoYo
fi
if [ "`df| grep /jffs | awk '{ print $4 }'`" -ge 100 ] ; then
logger_ads "Moving the MVPS hosts list to JFFS (as it looks like there is enough space for it)"
mv /tmp/dlhosts.tmp /jffs/dns/dlhosts
if [ "`echo $?`" -eq 0 ] ; then
logger_ads "Moving the MVPS hosts list to JFFSoperation was successful"
else
note_no_space 72
rm /jffs/dns/dlhosts
softlink_func dlhosts.tmp dlhosts MVPS
fi
else
logger_ads "*NOT* Moving the MVPS list to JFFS (as it looks that there is *NOT* enough space for it)"
softlink_func dlhosts.tmp dlhosts MVPS
fi
else
logger_ads "The lists are less then 7 days old, saving on flash erosion and NOT refreshing them."
fi

logger_ads "Injecting the DNSMasq nvram options with the dynamic block lists"
nvram get dnsmasq_options > /tmp/dns-options.tmp
if [[ -z "`cat /tmp/dns-options.tmp | grep "/jffs/dns/dnsmasq.adblock.conf"`" || -z "`cat /tmp/dns-options.tmp | grep "/jffs/dns/dlhosts"`" && -e /jffs/dns/dnsmasq.adblock.conf ]] ; then
logger_ads "Did not find DNSMsaq options in nvram, adding them now"
echo "conf-file=/jffs/dns/dnsmasq.adblock.conf" >> /tmp/dns-options.tmp
echo "addn-hosts=/jffs/dns/dlhosts" >> /tmp/dns-options.tmp
nvram set aviad_changed_nvram=1
logger_ads "Added options to nvram DNSMasq options"
else
logger_ads "The DNSMaq options are already in place"
fi

logger_ads "Checking if the personal list is a file"
if [[ -z "`cat /tmp/dnsmasq.conf | grep conf-file=/jffs/dns/personal-ads-list.conf`" && -z "`nvram get dnsmasq_options | grep "/jffs/dns/personal-ads-list.conf"`" && -e /jffs/dns/personal-ads-list.conf ]] ; then
logger_ads "Yes the personal list is in the form of a file"
logger_ads "Removing whitelist from the personal file"
cat /jffs/dns/whitelist | while read line; do sed -i /${line}/d /jffs/dns/personal ads-list.conf ; done
echo "conf-file=/jffs/dns/personal-ads-list.conf" >> /tmp/dns-options.tmp
nvram set aviad_changed_nvram=1
else
[ ! -e /jffs/dns/personal-ads-list.conf ] && logger_ads "The personal list (assuming there is one) is not in a file"
[ -n "`nvram get dnsmasq_options | grep "/jffs/dns/personal-ads-list.conf"`" ] && logger_ads "The personal list is a file, and... it is already in place according to the NVRAM options readout"
[ "$1" = "-f" ] && cat /jffs/dns/whitelist | while read line; do sed -i /${line}/d /jffs/dns/personal-ads-list.conf ; done && logger_ads "overide switch given so removed whitelist from personal file"
fi
logger_ads "Final settings implementer"
if [ "`nvram get aviad_changed_nvram`" -eq 1 ] ; then
nvram set dnsmasq_options="`cat /tmp/dns-options.tmp`"
logger_ads "Found that NVRAM was changed and committing changes
now"
nvram commit
nvram set aviad_changed_nvram=0
logger_ads "Refreshing DNS settings"
stopservice dnsmasq && logger_ads "stopped the dnsmasq service"
startservice dnsmasq && logger_ads "started the dnsmasq service"
else
logger_ads "Nothing to commit"
fi
rm /tmp/dns-options.tmp
logger_ads "######### Ads blocker script has finished and you should be up and running ##########

dns_adblock

#!/bin/bash 
#dns_adblock.sh - poor man's adblock 
# (c)2015 sorin@toXX.guru                                                                                       
#replace add servers with a local blank page 
#this script works faster/better/cleaner if you have apache httpd configured to serve a null page in case of page not found 
#just create an empty file 'touch /var/www/html/null.html', then in /etc/httpd/httpd.conf add/modify the line 'ErrorDocument 404 /null.html'  


#define local variables 
target=/var/named/data/blacklist
nullzone=/var/named/null.zone.file 
namedconf=/etc/named.conf  
whitelisted=/var/named/data/whitelisted.personal 
blacklisted=/var/named/data/blacklisted.personal 
namesrv=192.168.18.100                                                                           
# if it's the first time we run this, add the right info into bind's configuration   
if [ ! -f $nullzone ]; then  
echo "\$TTL    86400   ; one day  
@       IN      SOA     ads.nodomain. root. (  
             2015021505 ; serial              
                  28800 ; refresh                  
                   7200 ; retry                        
                 864000 ; expiry                        
                86400 ) ; minimum                          
            NS      nameserver     
               A       $namesrv              
@       IN      A       $namesrv                    
*       IN      A       $namesrv" > $nullzone    
fi                                                                                
if ! grep -q $target $namedconf ; then                                             
echo "conf not found"  
echo " include \"$target\";" >> $namedconf 
fi           
                                               
# get the list of known adservers from yoyo.org, sanitize it and make it compatible with bind9   
wget -q -O - 'http://pgl.yoyo.org/as/serverlist.php?hostformat=bindconfig&showintro=0' | tail -n+29 | head -n -6 | sed -e 's/{/IN {/g' -e '/_/d' > $target-new 
                                  
# get a second list from mvps.org, sanitize it and add only the hostnames that were not given by yoyo.org 
while read adhost; do                                                              
if ! grep -q $adhost $target-new ; then  
echo "zone \"$adhost\" IN { type master; notify no; file \"null.zone.file\"; };" >> $target-new   
fi          
done < <(wget -q -O - http://www.mvps.org/winhelp2002/hosts.txt | sed -e '/^ *#/d;s/#.*//' -e '/^[[:space:]]*$/d' -e '/localhost/d' -e '/_/d' -e '/[\r\n]/d' | cut -d" " -f2 )          
             
# add personal blacklist    
blhost="nothing"  
sed '/^ *#/d;s/#.*//' $blacklisted | while read blhost; do  
if ! grep -q $blhost $target-new ; then                    
echo "zone \"$blhost\" IN { type master; notify no; file \"null.zone.file\"; };" >> $target-new  
fi        
done   
       
# remove whitelisted domains. ($wlisted variable have to be defined, otherwise sed might remove everything) 
wlisted="nothingatall"               
sed '/^ *#/d;s/#.*//' $whitelisted | while read wlisted; do 
sed -i /"$wlisted"'/d' $target-new                                                  done  
       
#remove duplicates, named is intolerant to multiple definitions for the same host  
cat  $target-new | sort -u > $target 

#cleanup line containing "empty" domain                                            
sed -i '/\"\"/d' $target 

# cleanup the last remanents of bad lines reported by named-checkconf  
if [ ! $(/usr/sbin/named-checkconf -t /var/lib/named -z /etc/named.conf >/dev/null 2>&1; echo $?) = 0 ]; then 
badlines=$(/usr/sbin/named-checkconf -t /var/lib/named -z /etc/named.conf | cut -d: -f2 | sed -e 's/$/d;/' | tr -d '\n')  
sed -i "$badlines" $target  
fi                                                                                    
rm -f $target-new                                                                                     
# reload bind  
/bin/systemctl reload named.service