|
|
ID Verified
Moderator ID Verified
Trusted Lifetime subscriber
Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)
Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.
Trusted
CPU: AMD 5900x | RAM: GSKILL Trident Z Neo RGB F4-3600C16D-32GTZNC-32-GB | MB: Asus X570-E | GFX: EVGA FTW3 Ultra RTX 3080Ti| Monitor: LG 27GL850-B 2560x1440
Quic: https://account.quic.nz/refer/473833 R473833EQKIBX
Moderator ID Verified Trusted Lifetime subscriber
Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)
Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.
Trusted
CPU: AMD 5900x | RAM: GSKILL Trident Z Neo RGB F4-3600C16D-32GTZNC-32-GB | MB: Asus X570-E | GFX: EVGA FTW3 Ultra RTX 3080Ti| Monitor: LG 27GL850-B 2560x1440
Quic: https://account.quic.nz/refer/473833 R473833EQKIBX
ID Verified
Moderator ID Verified Trusted Lifetime subscriber
Kiwifruta: Looks like I'll stay with OpenWrt for now and add pi-hole support later on.
What are your recommendations for
i) securing a home network
ii) keeping the kids safe, besides teaching them, which we already do
Sorry what I was getting at was this:
So, with a pi-hole you can add custom lists (including massive ones to block adult sites), but also you're able to put a file in your /etc/dnsmasq.d/ directory to enforce Google Safesearch:
#/etc/dnsmasq.d/safesearch.conf
cname=google.co.nz/forcesafesearch.google.com
cname=google.com/forcesafesearch.google.com
cname=google.com.au/forcesafesearch.google.com
When you redirect your DNS to your pi-hole it'll force all DNS queries to get filtered before passing over to OpenDNS family shield - this will in-term add an extra layer of protection. This doesn't stop a tech-savvy kid from doing something like using a proxy server to access the internet however will filter most queries.
There is no solution that is 100% effective - trust me. SNUP (Network4learning) has this constant problem and yes I've seen kids find ways to get around that to pr0n or obscene imagery - now, the network4learning is a pretty aggressive proxy solution designed for schools. But, with running your own DNS server it means you're able to monitor the DNS queries coming from your families devices and if you don't like it - just add it to the /etc/pihole/blacklist.conf file and run pihole -g to update your lists.
This is the reason I recommended it - it gives you flexibility, is a cheap solution and works really well - plus, enables you to use OpenDNS over dnscrypt.
Lastly, if you really wanted to enforce your actions adding firewall rules on your OpenWRT router to block anything but Port 80 / 443 (and maybe 25565 if they're into Minecraft like most kids) will ensure products like Tunnelbear etc should fail to connect however even such products are savvy at getting past even the most strict firewall solutions.
tl;dr: did work for schools, no solution is going to be 100% but the above will get 99% sorted.
Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)
Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.
ID Verified
michaelmurfy:Kiwifruta: Looks like I'll stay with OpenWrt for now and add pi-hole support later on.
What are your recommendations for
i) securing a home network
ii) keeping the kids safe, besides teaching them, which we already doSorry what I was getting at was this:
So, with a pi-hole you can add custom lists (including massive ones to block adult sites), but also you're able to put a file in your /etc/dnsmasq.d/ directory to enforce Google Safesearch:
#/etc/dnsmasq.d/safesearch.conf
cname=google.co.nz/forcesafesearch.google.com
cname=google.com/forcesafesearch.google.com
cname=google.com.au/forcesafesearch.google.comWhen you redirect your DNS to your pi-hole it'll force all DNS queries to get filtered before passing over to OpenDNS family shield - this will in-term add an extra layer of protection. This doesn't stop a tech-savvy kid from doing something like using a proxy server to access the internet however will filter most queries.
There is no solution that is 100% effective - trust me. SNUP (Network4learning) has this constant problem and yes I've seen kids find ways to get around that to pr0n or obscene imagery - now, the network4learning is a pretty aggressive proxy solution designed for schools. But, with running your own DNS server it means you're able to monitor the DNS queries coming from your families devices and if you don't like it - just add it to the /etc/pihole/blacklist.conf file and run pihole -g to update your lists.
This is the reason I recommended it - it gives you flexibility, is a cheap solution and works really well - plus, enables you to use OpenDNS over dnscrypt.
Lastly, if you really wanted to enforce your actions adding firewall rules on your OpenWRT router to block anything but Port 80 / 443 (and maybe 25565 if they're into Minecraft like most kids) will ensure products like Tunnelbear etc should fail to connect however even such products are savvy at getting past even the most strict firewall solutions.
tl;dr: did work for schools, no solution is going to be 100% but the above will get 99% sorted.
Moderator ID Verified Trusted Lifetime subscriber
Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)
Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.
ID Verified
Kiwifruta:michaelmurfy:Kiwifruta: Looks like I'll stay with OpenWrt for now and add pi-hole support later on.
What are your recommendations for
i) securing a home network
ii) keeping the kids safe, besides teaching them, which we already doSorry what I was getting at was this:
So, with a pi-hole you can add custom lists (including massive ones to block adult sites), but also you're able to put a file in your /etc/dnsmasq.d/ directory to enforce Google Safesearch:
#/etc/dnsmasq.d/safesearch.conf
cname=google.co.nz/forcesafesearch.google.com
cname=google.com/forcesafesearch.google.com
cname=google.com.au/forcesafesearch.google.comWhen you redirect your DNS to your pi-hole it'll force all DNS queries to get filtered before passing over to OpenDNS family shield - this will in-term add an extra layer of protection. This doesn't stop a tech-savvy kid from doing something like using a proxy server to access the internet however will filter most queries.
There is no solution that is 100% effective - trust me. SNUP (Network4learning) has this constant problem and yes I've seen kids find ways to get around that to pr0n or obscene imagery - now, the network4learning is a pretty aggressive proxy solution designed for schools. But, with running your own DNS server it means you're able to monitor the DNS queries coming from your families devices and if you don't like it - just add it to the /etc/pihole/blacklist.conf file and run pihole -g to update your lists.
This is the reason I recommended it - it gives you flexibility, is a cheap solution and works really well - plus, enables you to use OpenDNS over dnscrypt.
Lastly, if you really wanted to enforce your actions adding firewall rules on your OpenWRT router to block anything but Port 80 / 443 (and maybe 25565 if they're into Minecraft like most kids) will ensure products like Tunnelbear etc should fail to connect however even such products are savvy at getting past even the most strict firewall solutions.
tl;dr: did work for schools, no solution is going to be 100% but the above will get 99% sorted.
Thanks Michael. My name is Dwayne by the way.
My cousin fell victim to ransomware, by clicking on a .zip file purportedly from her ISP. She didn't pay up but reinstalled her OS and lost her files from her studies as a consequence.
I said I'd help her set up her computer (and hopefully router too if it's up to the task) to prevent that and other things happening again. I've googled around and read a few things about securing a home network, most of the key ones I knew already, but I knew there was still more I didn't know. This prompted my starting this thread. I was wondering if pfSense (or OpenWrt) could be used to filter out dodgy emails or email attachments. I imagine the blacklist (or algorithms) for filtering dodgy email attachments would be huge and beyond the hardware capabilities of a non-x86 OpenWrt consumer router, and more suited to router firmware installed on an x86 device. However, maybe a raspberry pi could do this too.
Best practice, obviously, is to not set up users with administrator rights and never open such attachments in the first place. But not everyone knows that, or would even know how to implement it. So I began thinking is there a solution that can be set up on router (or a replacement to the ISP provided modem/router) at home to guard the home network? With IoT here, home networks need to be even more secure.
Putting anti-virus etc software on a PC, smart device etc, impacts the devices' performances and can become expensive when there are many devices, and if a visitor logs on to a friend's wifi network and there is some sort of malware on their device it can still do some damage on the host's network. So a solution located at the gateway would be much more cost effective and a set up once and work forever solution.
Thanks for pointing out the google forced strict search on the router.
Moderator ID Verified Trusted Lifetime subscriber
Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)
Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.
|
|
|
