Synology -- trying to use parental controls but without putting Youtube in restricted mode

[Whit Wye]

Just got a Synology 2600, which is a decent device once the software is brought up to date (was a bit flakey out of the box). My only big complaint is they've set it up so that if Parental Controls are on for a device at all, it puts Youtube into restricted mode. Probably using dnsmasq for that, although for most of that it's using iptables rules. However it's doing it, I can't find yet what file to alter to defeat it. I totally trust Youtube to my kid. I just don't want him getting to the really sleazy corners of the Net -- which fortunately he's not looking for yet. But he notices right away if he can't follow innocuous Youtube stars.

I assume with some revision Synology will fix this "feature" by giving it an on/off switch. Meanwhile, if anyone has found where to alter their configuration to leave it out, then I can turn the controls on for the bad stuff.

 

[TheManFromUncle]

You can set your own settings, include/exclude sites. Just have a look around.

 

[Whit Wye]

I should have mentioned that putting youtube.com in the excluded sites list does not fix this problem. It's not that Youtube is being blocked; it's that it's being translated to a different URL that lands a person on the Restricted Mode version of Youtube's site. It's arguably a bug that the whitelisting of the main URL doesn't fix this. But it doesn't, as other users have also found and reported in Synology's forums.

 

[TheManFromUncle]

Have you looked through the settings as I suggested earlier?

 

[Whit Wye]

Have you looked through the settings as I suggested earlier?

Yes. Of course. That's what I responded to. Did you read my response?

 

[TheManFromUncle]

I can only presume you block other streaming services. You don't need to use the presets. You can do your own blocklist. If you do, as I have, Youtube isn't blocked at all.

 

[Whit Wye]

You misunderstand. This is not about blocking Youtube. It is about having Youtube refuse to provide access to leave comments, and to view some videos it categorizes as Restricted. This, as I and other users of Synology routers have seen, happens if any level of protection is set, and happens even if Youtube is explicitly whitelisted, as well as left off the custom list being used. This is something that was introduced with a software update from Synology a couple of months ago. If you're not seeing this effect, either your software isn't current, or you haven't tried to leave comments on Youtube, or watch videos in its Restricted catagory -- many of which are entirely kid-friendly; it's hard to see what they use to categorize these.

There's a discussion elsewhere here about Youtube Restricted Mode with another brand of routers, which can provide some useful background if you want to understand the issue. Unfortunately Synology has taken a different course to achieve this restriction, so that discussion doesn't directly apply to undoing it. Youtube also has some docs online about it. It's basically about taking requests for "youtube.com" and the like and replacing them with something like "restricted.youtube.com" (that's not exactly the domain -- just the idea here), which results in the Restricted feature set being applied. So it's not a redirection to a local "Blocked" webpage, but a redirection to a different front-end site for Youtube, which is set up with restrictions not on the regular site.

 

[TheManFromUncle]

I'm using current firmware, with all my Synology routers. I've never come across this problem. I'm not saying it doesn't exist though. Before I forget to mention... have you tried to use DNS's other than provided by your ISP?

 

[Whit Wye]

I've never used my ISP's DNS. I run my own. In my day job I'm a network engineer. Some routers do use the dnsmasq utility -- which is running on Synology -- to handle the translation of the Youtube addresses to their Restricted version. I suspect Synlogy does too. But I haven't worked out where they keep the configuration for that. In any case if Parental Controls are invoked even at the "Basic" level on the Synology, Youtube is presented in its Restricted variation, even when whitelisted on the "Allow List."

 

[TheManFromUncle]

If you run your own DNS, wouldn't it be easier to disable all such settings on the router and concentrate on using DNS-filters?

 

[Whit Wye]

No. My home configuration is ISP Router - > Firewall/DNS -> Several servers and workstations and also the Synology. The Synology is between wifi-connected systems and the Net. On wifi we have myself (when on a laptop rather than the servers and workstation), my wife, and my kid. I only want to limit the kid's exposure. While my bind9 DNS can be set up with zones giving different results, that's a lot of work to maintain, and is nowhere near as simple as just using the Synology menus to put his devices behind the iptables rules and (apparently) dns-masq settings it uses for Parental Controls. Bind9 is not designed to provide parental controls. Also, the kid's smart enough to reset his systems to use Google's 8.8.8.8 and 8.8.4.4 addresses for DNS if the local DNS starts giving him results which block him. The Synology device is harder to work around. How some of their iptables rules work in this context is masterful.

Once Synology provides an option to turn off the Youtube redirection, it will be a good fit with what I need. In their rush to add new features, they put it in without providing a switch in the GUI to turn it off.

 

[TheManFromUncle]

To me, it would seem you're complicating matters, but far be it for me to dispute a network engineer. I am personally unaware of any problems concerning Youtube. As I've said before, I think things could be done simpler.