I want to block devices for my kids, when they google keywords such as porn, pussy or things like that, it will be blocked or results in safe material. I have turned on safe search in google and the result is blurred, but if you click it, the actual images will appear. Is there a way to do this in pfsense?
To block adult websites you can use 1.1.1.3 (Cloudflare for families) as your external DNS. This blocks the DNS lookup for all (known) adult websites for every device in the network.
This won’t help against proxied photos/Videos for example on reddit or even google image search. For the latter you can configure safe search in the google acocunt settings though
This day and age if they want to see porn, they will see porn. Blocking it on your home network? They have cell phones, right? Have nanny software on their phones? They have friends who don’t.
Without a client on their device and loading certificates to MITM their shit the best you can do is just block dns to known adult sites. It’s not the end of the world if your kid looks at some porn, we were all there once. Have the conversation and be done with it.
You have to force safe search and use filter instead of blur. Look up force safe search with pfSense on google and you’ll find guides on how to do it.
You’ll also want to ensure you have parental controls turned on for your child’s devices too.
It’s a never ending game. Kids will always find a way around filters, you can make your best effort but I find just educating your kids is the correct way to go. I just do the basics for filtering.
Talk to your kids. Educate them. Teach them how to safely navigate the web. Blocking, restrictions and punishment will counteract your goal of their safety. They just get better in not to be caught.
Explain to them, that there is bad and dangerous stuff, that there are ill-intended people. Have their back. Make the comfortable to speak to you, if they encounter sketchy / disturbing stuff.
You can’t protect your kids from the web. If they want, they will find a way around (almost) any restriction. And if they have access to the web outside your filtered home bubble, they might encounter things they are not prepared for and might fall victim to abuse and scam.
As I stated earlier, educate them and explore the web, including porn, harassment/ abuse and scam, together. Then they know that you know and that they can talk to you.
On a side note: porn in itself is nothing you have to worry about. Just put it in perspective and clearly explain that the digital stuff is not the real deal and staged for intend and purpose. If the wanna jerk off, the will. With or without porn.
No. You can block pornsites (via DNS), but you can’t block nudity on ‘normal’ sites like Google, Reddit, etc.
Pfblocker for pfsense can help a lot. But it’s not perfect. I also saw a safe search filter in there, but I haven’t actually tried it, so I don’t know how/if it works. There are ways around most blockers, so your kids will eventually figure it out.
As I get older, I’m starting to think the only way is to not let them use the internet unsupervised, and that’s a tall order.
Within the bounds of your own network, works pretty well on pfSense when running with enough RAM to process the right lists as well as with the right pfBlockerNG and NAT rule configurations. I have a second pfSense/pfBlockerNG vm setup for kids devices. Safesearch enforced by pfBlockerNG for search engines that support it and others that do not support it are blocked with a DNSBL feed list. NAT rules configured similar to Netgate’s guide but more fully furnished to redirect DNS without errors like listed in this blog https://labzilla.io/blog/force-dns-pihole but replacing the term Pihole with pfSense. All DoT/DoH/DoQ dns leaks are blocked with pfBlockerNGs options on the safesearch tab and further improved with Hagezi’s DoH/proxy and NSFW feed lists added. OpenDNS family/custom dns set for the upstream server to catch all else that Cisco filters. UT1 Adult and proxy lists enabled and Shallalist I downloaded from WaybackMachine archives and uploaded to pfSense with its Porn and proxy lists activated. Have IPs for all rogue devices that have MAC addresses labelled on them like switches and access points are blocked from access on each of my DNS resolvers to keep the kids from trying to hijack them to try to bypass. MAC reservations set for known devices with DHCP option Static ARP enabled, remaining DHCP pool for new devices and unused IPs I have all traffic re-routed for with NAT redirected to the sinkhole IP to block any unknown devices from router or internet access. Also have all VPN, hacking, warez, malicious options/lists selected to help prolong how long it takes for them to find a way around it until they have their own data, off your network is a different avenue altogether
NextDNS has apps for their phones and computers that let you control what they can access even when not at hone
You can use the swisscows browser, which blocks adult sites by default, or you can use Adguard’s free dns, “family” filter.
As a sys admin in the education space there are se good filters you can install on the student device. One I hear a lot of parents like is Disney circle meetcircle.com
Check out OpenDNS, it will block access to the content, but its at the site level, so youtube is all or nothing.
Download pfblockerNG and set that sucker up. Go to the dnsbl tab and activate safesearch. Like others said 1.1.1.3 and 1.0.0.3 as dns as well. I’d steer clear of porn blocklists they are all huge and have loads of stale domains. This can crash unbound resolver if you don’t have a lot of memory.
Nothing in the world you can do will block any determined effort by your average kid. There are workarounds for every obstacle you might try and put in the way.
All you can do is have a reasoned, intelligent and adult discussion with them about the subject.
Best firewall for kids is education. I have my home locked down but I have no control over other kids devices that my kids may be watching when not at home.
No, not possible with pfSense. The web traffic is encrypted by the device your child is using and is not readable by the time it reaches pfSense. There are firewall appliances that can do SSL decryption, but that is its own can of worms especially for a home environment.
You would need some sort of software client on the device itself to do the level of filtering you’re looking for. The best you could hope for with pfSense is using a family friendly DNS server like Cloudflare’s DNS servers for families. To be clear, this won’t stop them from searching for those keywords, but it should prevent them from accessing the site hosting that adult content.
this is an attempt to use technical means to solve a family education problem. you should use the internet WITH your children. teach them how to find only what they want to find. every technical solution to this that I have seen, can be overcome by a variety of different means be it using a phone’s internet, switching local dns provider on the client device, using vpn software on a client device (or even something like TOR), if the client’s os is locked down, you can usually still boot from usb on the client device and use a bootable linux install (perhaps also with tor like TAILS for example)… so it’s not a technical problem, it’s a family problem. you should never leave small children alone with an internet enabled computer. if this “kid” is a teen… teens are going to seek out and find adult material no matter what you do… you’re better off teaching them how to avoid advertising and malware doing so than getting them to stop seeking out adult material - and for the most part that’s generally considered reasonably healthy.
i use nextdns for this.
Just buy NETNANNY, it’s like $80 for 5 devices, approved by numerous Parenting groups and Religious groups alike, and is next to impossible for even clever kids to bypass. You install it on PCs, Phones, Laptops, and Tablets. It’s been around since AOL days.