Feature request: Advanced parental controls!

[apenney]

First I want to thank you for all the work you put into your firmware, it's one of the reasons I decided to buy a new asus router to replace my old WDNR3700!

One of the things I plan to do via a series of bad shell scripts might be more broadly applicable and I thought I'd see just how difficult it would be to add to the official web interface (I am a bad programmer and I haven't touched html since html3 but I can try to add this myself).

Use case:

I want to build a separate wifi network for my kids that allows me to create a number of "sub profiles" and apply various filters to them so that I can turn on and off all their internet capable devices.

I then wish to be able to temporarily unblock an individual kids internet use for a set amount of time. (Basically this is a "you show me your homework and you get time online instead of trying to lie to me and play xbox forever" system!)

The key things I want to be able to do are:

Add multiple devices (by MAC) to a kids bucket.
Set a whitelist of IPs to allow access to (say, Khan Academy).
Block all other 80/443 traffic outbound.
Hit up the web interface, click on one of the kids in Parental Control and then give them access to a certain amount of time.

I had basically just planned to statically assign all their devices in DHCP and write a script that I called like # unblock --kid=blah --time=2h and then just constantly maintain the list of ips to block/unblock when running the scripts.

It occured to me however that a slightly more general implementation via the web interface might be appreciated. I debated a bunch of ways to implement it from fancy proxy stuff onwards, but I honestly just think allowing specific ip's outbound for whitelisted sites is "good enough" and then opening the hatches to all outbound 80/443 from time to time.

Is this feasible to build within the framework of what's in the firmware today?

 

[Wisiwyg]

I'd use this too....

 

[RMerlin]

I have no plans to change the way Parental Control works. Such a thing could be a full-time project on its own, which is far beyond the scope of this FW project.

 

[apenney]

I have no plans to change the way Parental Control works. Such a thing could be a full-time project on its own, which is far beyond the scope of this FW project.

Fair enough; will you answer (specific) questions if I take a look at the source code and stumble my way around to see what I can get it to do? I won't bug you until I have something at least semi functional.

Edit: I guess https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/www/ParentalControl.asp is where I start.

 

[RMerlin]

Fair enough; will you answer (specific) questions if I take a look at the source code and stumble my way around to see what I can get it to do? I won't bug you until I have something at least semi functional.

Edit: I guess https://github.com/RMerl/asuswrt-merlin/blob/master/release/src/router/www/ParentalControl.asp is where I start.

You can try, but I never really studied the PControl code in depth.

The firmware contains a LOT of code for one person to assimilate...

 

[kjetilhp]

the html/js are real mess (no fence, just seems very hard to maintain) since no templating are used, I guess the best thing to do is start over, seems that everything is set with the hidden form fields. Not sure about the server code for handling this but I found all the rules marked as PControl in the IPTables configuration. Never seen asp pages being used outside m$ IIS server, so again, not sure what handles the request under the hood. You'll also need somewhere to store the extra information about grouping/buckets. Haven't digged much around the code yet so it maybe easier to extend than I think.

Would be real nice to get this up and running, so much work to change all the rules for all devices one at the time

 

[RMerlin]

the html/js are real mess (no fence, just seems very hard to maintain) since no templating are used, I guess the best thing to do is start over, seems that everything is set with the hidden form fields. Not sure about the server code for handling this but I found all the rules marked as PControl in the IPTables configuration. Never seen asp pages being used outside m$ IIS server, so again, not sure what handles the request under the hood. You'll also need somewhere to store the extra information about grouping/buckets. Haven't digged much around the code yet so it maybe easier to extend than I think.

Would be real nice to get this up and running, so much work to change all the rules for all devices one at the time

This isn't ASP the way you know it, this is just HTML with some Javascript extensions (all those <% tag %> tags get replaced on-the-fly by the httpd daemon).

And yes, the PControl code is a mess. Now you see why I never touched it in the first place Kuddos to Makkie for actually taking the time to understand and rewrite the IPTable generation code.

In related news, Asus says they intend to rework part of PControl. No details as to how extensive the changes would or when that would happen.