Solved Need help Enforcing SafeSearch on duckduckgo.com

[macster2075]

for example when i NSlookup safe.duckduckgo.com , the IP address i get is 52.149.247.1 and not 46.137.218.113

when I nslookup duckduckgo.com IP I get

Server: RT-AC68U-B340
Address: 192.168.1.1

Name: www.duckduckgo.com
Address: 52.149.247.1

but, safesearch is not enforced.

 

[macster2075]

UPDATE...
It is working now... I was going by the duckduckgo.com search settings and it says Safe Search OFF.. so I was assuming it was not being enforced...
But.. anyway.. I restored my router settings as I had it before... and this time only added through ssh

echo address=/duckduckgo.com/ 52.149.247.1 > /jffs/configs/dnsmasq.conf.add

then
service restart_dnsmasq

and it works!!
I was really wondering why it wasn't working with the same command I use with Bing...but now I now that it DOES work.
This is much simpler and easier.

 

[macster2075]

Ok..
I may have spoken too soon haha...
It looks like only one or the other works at one time...
duckuckgo is forced to Safesearch, but now Bing is not...

If I force Bing.. then duckduck safe search goes away...
why can't I have both at the same time...

Im using for Bing and Duckduckgo...but only the last one seems to activate SafeSearch and disabling the previous one...

echo address=/www.bing.com/204.79.197.220 > /jffs/configs/dnsmasq.conf.add
echo address=/duckduckgo.com/ 52.149.247.1 > /jffs/configs/dnsmasq.conf.add

does this mean I can only have one command in dnsmasq?

 

[macster2075]

I've got it... took me a while, but I was able to find how to have multiple scripts in dnsmasq.. found it at https://github.com/RMerl/asuswrt-merlin.ng/wiki/Custom-domains-with-dnsmasq
I followed the instructions... to edit the dnsmasq scripts enter the following in ssh

vi /jffs/configs/dnsmasq.conf.add

while in there you just need to add...

address=/www.bing.com/204.79.197.220
address=/duckduckgo.com/ 52.149.247.1

then press ESC key and type :wq hit ENTER.
then, service restart_dnsmasq

So now both Bing and Duckduckgo are working with SafeSearch enforced.
Just in case someone else wanted to do this.

 

[dave14305]

The original issue with "one or the other" is that your echo commands were using > which will overwrite the existing file. >> will append to a file (or create if it doesn't exist).

 

[macster2075]

The original issue with "one or the other" is that your echo commands were using > which will overwrite the existing file. >> will append to a file (or create if it doesn't exist).

oh ok...so that means I just had to login to the router via ssh and type

address=/www.bing.com/204.79.197.220
address=/duckduckgo.com/ 52.149.247.1

without having enter in ssh
vi /jffs/configs/dnsmasq.conf.add?

 

[SomeWhereOverTheRainBow]

The original issue with "one or the other" is that your echo commands were using > which will overwrite the existing file. >> will append to a file (or create if it doesn't exist).

oh ok...so that means I just had to login to the router via ssh and type

address=/www.bing.com/204.79.197.220
address=/duckduckgo.com/ 52.149.247.1

without having enter in ssh
vi /jffs/configs/dnsmasq.conf.add?

simple solution
inside /jffs/scripts/dnsmasq.postconf

#!/bin/sh
{
    echo 'address=/www.bing.com/204.79.197.220'
    echo 'address=/duckduckgo.com/52.149.247.1'
} >> $1

or simply place

address=/www.bing.com/204.79.197.220
address=/duckduckgo.com/52.149.247.1

inside /jffs/configs/dnsmasq.conf.add

 

[macster2075]

Awesome.. thank you all for your assistance... it seems there are multiple ways of achieving the same thing.. which is probably the reason it makes it more confusing for a simpleton like me hehe.

 

[Zastoff]

I followed Method 1 in Merlin wiki (using the CNAME) in combination with this (the openwrt part)
I use SmarTTY as a SSH client, Easy to edit files on the router (vi and nano are built in editors, or other great SSH clients like Putty can be used)
Have you enabled: In Administration/System/ Enable JFFS custom scripts and configs = Yes (in router gui)?

touch /jffs/configs/hosts.add

Should have worked to create hosts.add file
But hope you got it all working anyway

 

[Zonkd]

Awesome.. thank you all for your assistance... it seems there are multiple ways of achieving the same thing.. which is probably the reason it makes it more confusing for a simpleton like me hehe.

Don’t sell yourself short mate! You’re askin all the right questions.

 

[macster2075]

I will create another thread regarding an issue I just noticed when enabling 5hz guest network!

 

[MvW]

Not sure whether anyone else noticed, but I ran the script @SomeWhereOverTheRainBow created here and searches on duckduckgo.com are now nicely redirected to safe.duckduckgo.com, but when looking at the settings at safe.duckduckgo.com for Safe Search they're still set to Moderate (which is the default setting at duckduckgo.com) instead of Strict results.

Running some test searches still show some graphic results which I like to be blocked. This makes me wonder if the effort we're taking to re-route these searches are having the desired effect. I messaged Duckduckgo to ask for clarification.

 

[SomeWhereOverTheRainBow]

Not sure whether anyone else noticed, but I ran the script @SomeWhereOverTheRainBow created here and searches on duckduckgo.com are now nicely redirected to safe.duckduckgo.com, but when looking at the settings at safe.duckduckgo.com for Safe Search they're still set to Moderate (which is the default setting at duckduckgo.com) instead of Strict results.

Running some test searches still show some graphic results which I like to be blocked. This makes me wonder if the effort we're taking to re-route these searches are having the desired effect. I messaged Duckduckgo to ask for clarification.

View attachment 30011

It is not going to directly change your default settings it will only control searches at the DNS level.

 

[macster2075]

It is not going to directly change your default settings it will only control searches at the DNS level.

this is correct.. the setting will say Moderate, but it will actually be Strict.. even if you change the setting to OFF, it will still be strict.. at least this is the way mine works with the script I am using
address=/duckduckgo.com/ 52.149.247.1

 

[MvW]

this is correct.. the setting will say Moderate, but it will actually be Strict.. even if you change the setting to OFF, it will still be strict.. at least this is the way mine works with the script I am using
address=/duckduckgo.com/ 52.149.247.1

Then there are two things I don't understand:

First

By using safe.duckduckgo.com instead. Searches from safe.duckduckgo.com always have safe search set to "strict".

Source: https://help.duckduckgo.com/duckduckgo-help-pages/features/safe-search/

Why, even though I cleaned out both Firefox and Chrome on my laptop, using my network, I'm getting the same explicit results with duckduckgo.com (which now redirects at DNS-level to safe.duckduckgo.com according to dig)

Spoiler

dig www.duckduckgo.com @10.0.12.1

; <<>> DiG 9.16.8 <<>> www.duckduckgo.com @10.0.12.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8917
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;www.duckduckgo.com.            IN      A

;; ANSWER SECTION:
www.duckduckgo.com.     0       IN      CNAME   safe.duckduckgo.com.
safe.duckduckgo.com.    0       IN      A       52.142.126.100

;; Query time: 10 msec
;; SERVER: 10.0.12.1#53(10.0.12.1)
;; WHEN: Sat Jan 30 18:59:58 CET 2021
;; MSG SIZE  rcvd: 96

as when I'm using Firefox Mobile on iOS, connected to 4G, thus bypassing the router entirely?

Any ideas?

 

[macster2075]

Then there are two things I don't understand:

First

Source: https://help.duckduckgo.com/duckduckgo-help-pages/features/safe-search/

Why, even though I cleaned out both Firefox and Chrome on my laptop, using my network, I'm getting the same explicit results with duckduckgo.com (which now redirects at DNS-level to safe.duckduckgo.com according to dig)

Spoiler

dig www.duckduckgo.com @10.0.12.1

; <<>> DiG 9.16.8 <<>> www.duckduckgo.com @10.0.12.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8917
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;www.duckduckgo.com.            IN      A

;; ANSWER SECTION:
www.duckduckgo.com.     0       IN      CNAME   safe.duckduckgo.com.
safe.duckduckgo.com.    0       IN      A       52.142.126.100

;; Query time: 10 msec
;; SERVER: 10.0.12.1#53(10.0.12.1)
;; WHEN: Sat Jan 30 18:59:58 CET 2021
;; MSG SIZE  rcvd: 96

as when I'm using Firefox Mobile on iOS, connected to 4G, thus bypassing the router entirely?

Any ideas?

Then there are two things I don't understand:

First

Source: https://help.duckduckgo.com/duckduckgo-help-pages/features/safe-search/

Why, even though I cleaned out both Firefox and Chrome on my laptop, using my network, I'm getting the same explicit results with duckduckgo.com (which now redirects at DNS-level to safe.duckduckgo.com according to dig)

Spoiler

dig www.duckduckgo.com @10.0.12.1

; <<>> DiG 9.16.8 <<>> www.duckduckgo.com @10.0.12.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8917
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;www.duckduckgo.com.            IN      A

;; ANSWER SECTION:
www.duckduckgo.com.     0       IN      CNAME   safe.duckduckgo.com.
safe.duckduckgo.com.    0       IN      A       52.142.126.100

;; Query time: 10 msec
;; SERVER: 10.0.12.1#53(10.0.12.1)
;; WHEN: Sat Jan 30 18:59:58 CET 2021
;; MSG SIZE  rcvd: 96

as when I'm using Firefox Mobile on iOS, connected to 4G, thus bypassing the router entirely?

Any ideas?

When you say you cleaned out your browsers using you network.. are you referring to deleting history/cookies?
did you try flushing dns in CMD?

CMD
ipconfig /flushdns

 

[SomeWhereOverTheRainBow]

Then there are two things I don't understand:

First

Source: https://help.duckduckgo.com/duckduckgo-help-pages/features/safe-search/

Why, even though I cleaned out both Firefox and Chrome on my laptop, using my network, I'm getting the same explicit results with duckduckgo.com (which now redirects at DNS-level to safe.duckduckgo.com according to dig)

Spoiler

dig www.duckduckgo.com @10.0.12.1

; <<>> DiG 9.16.8 <<>> www.duckduckgo.com @10.0.12.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 8917
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1280
;; QUESTION SECTION:
;www.duckduckgo.com.            IN      A

;; ANSWER SECTION:
www.duckduckgo.com.     0       IN      CNAME   safe.duckduckgo.com.
safe.duckduckgo.com.    0       IN      A       52.142.126.100

;; Query time: 10 msec
;; SERVER: 10.0.12.1#53(10.0.12.1)
;; WHEN: Sat Jan 30 18:59:58 CET 2021
;; MSG SIZE  rcvd: 96

as when I'm using Firefox Mobile on iOS, connected to 4G, thus bypassing the router entirely?

Any ideas?

Because you are bypassing the router key words..

 

[MvW]

When you say you cleaned out your browsers using you network.. are you referring to deleting history/cookies?
did you try flushing dns in CMD?

CMD
ipconfig /flushdns

Thanks, that seems to helped. Duckduckgo returns no explicit search results anymore now.

 

[macster2075]

I know this is an old thread I created a long time ago, but I wanted to add something in case someone else ran into this issue with forcing SafeSearch in Duckduckgo.
Since safe.duckduckgo.com IP keeps changing and adding a CNAME hasn't worked for me, I found an easier solution for those who like simplicity.

Just go to the WAN DNS and select CleanBrowsing as the DNS server. It blocks porn and forces SafeSearch on Google, Bing and Duckduckgo.

185.228.168.10
185.228.169.11

Make sure to use this DNS as there are 3 DNS options for CleanBrowsing. One of them makes Youtube strict as well, which blocks comments, which I don't like.

CleanBrowsing takes care of the IP for safe.duckduckgo.com if it ever changes, so you won't have to worry about it.
Also, according to their privacy guidelines, they keep no logs of your queries

 

[SomeWhereOverTheRainBow]

I know this is an old thread I created a long time ago, but I wanted to add something in case someone else ran into this issue with forcing SafeSearch in Duckduckgo.
Since safe.duckduckgo.com IP keeps changing and adding a CNAME hasn't worked for me, I found an easier solution for those who like simplicity.

Just go to the WAN DNS and select CleanBrowsing as the DNS server. It blocks porn and forces SafeSearch on Google, Bing and Duckduckgo.

185.228.168.10
185.228.169.11

Make sure to use this DNS as there are 3 DNS options for CleanBrowsing. One of them makes Youtube strict as well, which blocks comments, which I don't like.

View attachment 46184

CleanBrowsing takes care of the IP for safe.duckduckgo.com if it ever changes, so you won't have to worry about it.
Also, according to their privacy guidelines, the keep no logs of your queries

I just use my script as a dnsmasq.postconf extension so anytime dnsmasq restarts it generates the new ip addresses.