DNS filtering Church project
-
@DaddyGo Can I deploy my own DNS server using pfsense and filter content? I'm a Linux guy but I don't want to use Linux for this project I feel Linux has become too popular and I don't trust it's security anymore.
-
@hmijares It sounds like you are attempting more than offering a service to those who want to experience a curated version of the internet. You can throw as much money, people and technology at this as you want and you will not get very far enforcing a subset of available content.
You're not going to be the great firewall of China, even for those who want a curated experience.
Best case outcome is you may be able to restrict some amount of unwanted content. You're still going to have to deal with the content that gets past your block-list.
You will get a much better return on your effort creating materials to help guide the discussions within families concerning online content, responsible use and what to do when you, inevitably, stumble upon some unwanted content.
-
@hmijares said in DNS filtering Church project:
Can I deploy my own DNS server using pfsense and filter content?
Of course yes = Unbound, but this is more we call it a resolver...
The world gets its DNS from the root servers....
(https://www.iana.org/domains/root/servers)Your Unbound (in pfSense package) resolver must also receive DNS data from a higher level depending on the setting, I recommend CloudFlare as it uses DoT with DNSSEC and also has filtered lists specifically for child protection.
f.e.:
https://www.cloudflare.com/learning/access-management/what-is-dns-filtering/ -
@jwj said in DNS filtering Church project:
You're not going to be the great firewall of China, even for those who want a curated experience.
I note, the firewall you are talking about is not perfect either.
It is more restrictive than a filter and thus simpler...Don’t to scare your prospective colleague, let’s experience a little DNS work
Otherwise you’re right, if everything could be clearly filtered, there would be no content to restrict...
Hard....
-
@DaddyGo I'm guessing here, but I think there is a 100% chance that I would not agree with the motivation behind this effort. That said, I still don't want to see good money wasted.
A lot of 10 year olds know how to change the dns server their device uses.
Using the internet in China is not unlike using it at work. You're inside a controlled environment. Church member or not connecting from home is not a controlled environment and trying to control it is a bit ridiculous.
-
How many users do you actually anticipate using this service?
If it's anything even close to 100K you probably want to look at something specialising in DNS and not a router/firewall that happens to include DNS.
Steve
-
@jwj Believe it or not, there are still children with good and old fashion moral values that would not be able to go against their parents' will.
-
@hmijares Agreed! In that case some open, honest, discussion at the dinner table will have a much greater positive result than a DNS server. I want you to be successful, really!
-
@jwj If you want to discuss discuss the moral implications of this project we can take it somewhere else but I'm here to consult about the technical aspects of it.
-
The problem with trying to filter phones is, they have no need of the wifi to surf the net.. Why would some kid bored in church not just use the phones data plan to surf whatever they want.
Are you trying to create a filtering service that works outside your network.. Say for example where the kids parents could select this dns filtering from their home network?
If so you are trying to reinvent the wheel - there are many a service you can already use that do this..
-
@hmijares And the technical aspects of it are you are running uphill against the wind trying to use technology. Teen suicide and eating disorders based on an unhealthy body image are not technology issues.
I'm trying to help you not waste time and money. I do wish you the best. I will say this one last thing: Technology has never been a substitute for personal responsibility.
-
@johnpoz This is more about filtering the content for 5 years old kids conected to their tablet 24X7 when they are at home. But we want to be the one who chose wich content. We are aware that from certain age they are smart enough to overcome any blocking.
-
@johnpoz As you said there are many services that can do this but we want to do it ourself because we have very specific content that is not blocked by any paid service like certain YouTube channels wich promotes bulimia, suicide or those that are sexually suggestive without being pornographic. I am not going to name those channels in this way because it goes beyond the scope we want to deal with but I am sure you have seen the channels where some women perform vibrator or dildo performance tests without showing the device on camera. That kind of content is in YouTube and is legal because if you don't show the "thing" there is no problem for YouTube. That kind of content is what we want to block for children under 7 years old when they are using the wifi at home. There is nothing wrong with using a vibrator or dildo but there is a time in life for every experience.
-
As much as I like to use pfSense everywhere I can
I'm going to suggest that this is not an application for which it's particularly well suited.Steve
-
@stephenw10 Anything you can recomend?
-
@hmijares said in DNS filtering Church project:
There is nothing wrong with using a vibrator or dildo but there is a time in life for every experience.
As the others write, this is really a thread mill fight...
The things described above will help reduce your chances of browsing the wrong content, but it’s definitely primarily a function of human character and a good education.
The pfSense can help a lot in prevention, but currently nothing provides a perfect solution.
At least I don’t know that,......... I say you wouldn’t have that kind of content on the web......if there was a perfect solution to this...Plus, with our new browser horror, we’re going in an even worse direction, like DOH (insanity)
-
@DaddyGo This is exaclty what we are looking for to "reduce your chances of browsing the wrong content," you nail it
-
I would start out looking at Pi-Hole which is designed specifically for this but at a small scale. It may not be suitable directly.
How many users do you expect at any one time? Do you need some sort of filtering so only members can access it?
Steve
-
@DaddyGo And the fact that youtube is youtube. You can't really pick and chose. You get it all or get kids youtube if, and only if, you use that app. I think there is is more harm than good from trying to hide reality than from facing it squarely and developing the skills needed to exist in an imperfect world.
-
@jwj I have to said again I'm not here to discuss the moral but the technical aspect of the project. Moral is out of the scope of this consultation. So I'm going to kindly ask you to stop repliying to my posts as you are no adding any value to the technical aspect. Thanks in advance!
