Forcing restricted mode for youtube and google search

[TheLyppardMan]

When I was using a DrayTek 2860ac router, I discovered that there was a relatively simple way to enforce safe search in google and restricted/moderate restricted modes in youtube by using something called CNAME. I have seen references to something similar on this forum for ASUS routers, but it looks a whole lot more complicated to set up, so I was wondering if someone could provide me with step by step instructions? The only experience of advanced features I have so far is setting up a custom script in jffs to automatically turn the leds on and off on the RT-AC87U that I'm now using. I want to be able to continue to use OpenDNS as well. Please keep it simple and precise, i.e., assume I know nothing (almost true) when providing any answer to this query.

Many thanks in advance for anyone who can help.

 

[JDB]

This seems what you want https://github.com/RMerl/asuswrt-merlin/wiki/Enforce-Safesearch


Sent from my iPhone using Tapatalk

 

[JDB]

This article references the CNAME address for YouTube https://support.opendns.com/hc/en-u...-Enforcing-Google-SafeSearch-YouTube-and-Bing

You'll need to resolve the restrict.youtube.com IP manually (just ping it or nslookup it) to add the hosts entry per the Google instructions.


Sent from my iPhone using Tapatalk

 

[TheLyppardMan]

This seems what you want https://github.com/RMerl/asuswrt-merlin/wiki/Enforce-Safesearch


Sent from my iPhone using Tapatalk

Yes, I saw that, but didn't get past the first instruction (Put this in your /jffs/configs/dnsmasq.conf.add), hence my comment that I need simple, step by step instructions if I am going to stand any chance of achieving this. I don't even know what dnsmasq is!

 

[JDB]

The jffs/config/dnsmasq.conf.add is just a file like your custom script is.
Open it (or create it if it doesn't exist) and put the line mention into it.


Sent from my iPhone using Tapatalk

 

[Martineau]

Yes, I saw that, but didn't get past the first instruction (Put this in your /jffs/configs/dnsmasq.conf.add), hence my comment that I need simple, step by step instructions if I am going to stand any chance of achieving this. I don't even know what dnsmasq is!

Read the relevant section in the Wiki ?

https://github.com/RMerl/asuswrt-merlin/wiki

e.g.

1. Customizing configuration files

 

[JDB]

And dnsmasq is the dns server on the router that forwards requests to your ISP/OpenDNS servers. All we are doing is putting an entry to hard code requests to Google etc to the safe search version.


Sent from my iPhone using Tapatalk

 

[TheLyppardMan]

The muddy waters are starting to clear now. I'll read up a bit more and have a go at it tomorrow. Thanks.

 

[Martineau]

The muddy waters are starting to clear now. I'll read up a bit more and have a go at it tomorrow. Thanks.

Install WinSCP , click 'New Site', then set the 'File protocol' for the router connection to SCP...do not use the default SFTP.

Then provide your logon credentials etc. and if you successfully connect you should be presented with two panes...

(Excuse my gaudy background colour, but I support several remote routers, so it helps me remember which one I'm on before hacking the wrong configs/scripts )


Left-pane is a local Windows folder.............Right-pane is the remote router folder.


HINT: You can drag'n'drop between panes so you can easily create a backup of the router scripts/config files etc. to your local laptop (or quickly restore files, if the router loses its /jffs/ partition etc.)

NOTE: Once you are in the appropriate folder (right-hand pane!) on the router...
Right click and select 'New->File'' (or Shift+F4) and this will open a new blank file (or simply double click an existing file to view/edit).

So if you are in the /jffs/configs folder, then enter 'dnsmasq.conf.add' into the initial dialog that pops up....then cut'n'paste the appropriate contents

cname=www.google.com,forcesafesearch.google.com

and save it.

Then repeat for the next custom configuration file!

 

[TheLyppardMan]

Install WinSCP , click 'New Site', then set the 'File protocol' for the router connection to SCP...do not use the default SFTP.

Then provide your logon credentials etc. and if you successfully connect you should be presented with two panes...

(Excuse my gaudy background colour, but I support several remote routers, so it helps me remember which one I'm on before hacking the wrong configs/scripts )


Left-pane is a local Windows folder.............Right-pane is the remote router folder.


HINT: You can drag'n'drop between panes so you can easily create a backup of the router scripts/config files etc. to your local laptop (or quickly restore files, if the router loses its /jffs/ partition etc.)

NOTE: Once you are in the appropriate folder (right-hand pane!) on the router...
Right click and select 'New->File'' (or Shift+F4) and this will open a new blank file (or simply double click an existing file to view/edit).

So if you are in the /jffs/configs folder, then enter 'dnsmasq.conf.add' into the initial dialog that pops up....then cut'n'paste the appropriate contents

cname=www.google.com,forcesafesearch.google.com

and save it.

The repeat for the next custom configuration file!

Perfect. This is exactly what I need. I'll report back as to how I get on.

 

[TheLyppardMan]

Just one other thing for now, if I wanted to direct any extra google urls's to forcesafesearch.google.com, would I need to put each variant on its own line, or would I append them like this: cname=google.com, google.co.uk,forcesafesearch.google.com?

 

[JDB]

Each on their own line


Sent from my iPhone using Tapatalk

 

[TheLyppardMan]

Each on their own line


Sent from my iPhone using Tapatalk

Thanks.

 

[TheLyppardMan]

Just noticed this additional information in the link above and wondered if I need to do this as well and if so, how do I restart dnsmasq and what is 216.239.38.120 referring to?

"However, since dnsmasq cannot use upstream DNS to resolve the target hostname (i.e. forcesafesearch.google.com), it must be defined in your hosts file. So, create also a /jffs/configs/hosts.add file with the following:

216.239.38.120 forcesafesearch.google.com

After that, restart dnsmasq to activate your changes:

service restart_dnsmasq"

 

[Martineau]

Just noticed this additional information in the link above and wondered if I need to do this as well and if so, how do I restart dnsmasq

service restart_dnsmasq"

If you have installed WinSCP then click on 'Commands' then click 'Open Terminal' (or CTRL-T)

or SSH to the router and issue the command.

 

[JDB]

The IP it mentions is googles safe search IP.

Yes you also need to add the line to the hosts.add file.

You restart it by typing the command it gives you into SSH (or in winscp you can send a 'remote command). Or you can just reboot the router.


Sent from my iPhone using Tapatalk

 

[TheLyppardMan]

I presume I shall need a similar line for either restrictyoutube.com or restrictmoderate.youtube.com but with the relevant IP (whatever that is) for youtube?

 

[JDB]

I presume I shall need a similar line for either restrictyoutube.com or restrictmoderate.youtube.com but with the relevant IP (whatever that is) for youtube?

Yes, see the link and comments I made already mentioning this.


Sent from my iPhone using Tapatalk

 

[TheLyppardMan]

Do you happen to know what the IPs are for the two youtube restrictions? Also, am I mising something here or is "Method 2" in your link a simpler process as it only appears to require one step instead of two?

"Method 2: Defining a different IP to www.google.com
Put this in your /jffs/configs/dnsmasq.conf.add:

address=/www.google.com/216.239.38.120

Then, restart dnsmasq:

service restart_dnsmasq"

 

[JDB]

Yes, method 2 is technically simpler. I would prefer method 1 personally as it mimics what the real world does more closely.

restrict.youtube.com = 216.239.38.120
restrictmoderate.youtube.com = 216.239.38.119
Note that these may be geographically different so if you are not in the U.K. (where I am) I would advise you to ping them yourself. Just type 'ping restrict.youtube.com' into the console window of winscp Martineau showed you how to get to.


Sent from my iPhone using Tapatalk