HOWTO: A parent's guide to Linux Web filtering

[AmosMutke]

Table of Contents

• 1.0 - Introduction
  
• 2.0 - Requirements
  
• 3.0 - The Process
  • install
    
  • configure
    
  • startup
    
• 4.0 - Notes
  • working configurations
    
  • url references
• 5.0 - Credits
  
• 6.0 - Changelog
  

1.0 - Introduction
Before I begin, I want to note that 90% of this howto was taken from linux.com article called "A parent's guide to Linux Web filtering". I'm sorry that I even took the same name for this article, but I feel that it draws attention to those who most likely to benefit from this howto, parents.

A Web filter is software that can filter the type of content a Web browser displays. The filter checks the content of a Web page against a set of rules and replaces any unwanted content with an alternative Web page, usually an "Access Denied" page. The type of content to be filtered is usually controlled by a systems administrator or a parent. Web filters are used in schools, libraries, and homes to safeguard children from obscene content on the Internet.

While the setup discussed in this article is intended for use on a single computer, this method of Web filtering can be applied to a wide range of scenarios. These tools can be easily and successfully implemented on a small home network, a large business infrastructure, or any environment that needs to comply with the Children's Internet Protection Act.

Bear in mind that Web filtering software of any kind is not 100% failsafe, nor is it a substitute for parental supervision. Along with installing filtering software, educate yourself and your children about the Internet.

Before you begin, you should be familiar with some basic networking concepts:

• A server, as in "Web server," is nothing more than an application that runs on a computer and listens for incoming requests. It sends back, or serves, information to the source that requested the information. This information can be anything from Web pages to databases. Each server communicates through the use of an IP address and a port number.
  
• Ports are logical addresses that applications on a computer use in a way similar to how we use phone numbers. Each server program must have a unique port that it uses for communications.
  
• Every computer connected to the Internet has both an external IP (Internet Protocol) address, usually assigned by an Internet service provider, and an internal address of 127.0.0.1. The internal address allows the computer to "listen" and "talk" to itself and is referred to as the loopback address. Normally a server is set up to accept requests from other computers on the Internet by listening on its external address. Since this can present a security risk for our single computer, we will use the loopback address instead. This will cause our server to only listen for requests from the computer that the server resides on.
  
• A firewall is an application that controls the types of communication your computer can send and receive. GNU/Linux has an excellent firewall called netfilter/iptables, or simply iptables, built right into the kernel, which we will make use of to redirect users' Web surfing through our Web filter.
  

I will attempt to keep it simple enough that anyone who was able to install Gentoo should be able to follow this.

2.0 - Requirements
I'm limiting this howto to using squid because it integrates easily and it's what I chose to use. Read the dansguardian faq for more info.
If you would like to contribute instructions for using a web proxy other than squid, please send them to me and I'll add them to this howto.

The only software you need to set up parental filters under GNU/Linux is iptables, DansGuardian, and Squid.

DansGuardian is the actual filtering software. It supports phrase matching, which allow you to block out Web sites that contain certain phrases or words; PICS filtering, which blocks content that's been labeled as possibly objectionable material by the creator of the Web site; URL filtering, to block content from specific sites that are known to contain offensive material; and blacklists, or lists of sites that contain content you want to block. Blacklists usually come from third parties, though you can create and maintain your own.

Squid is a Web proxy server that acts as a middleman between your computer and the Internet. You need a proxy server because DansGuardian isn't able to fetch Web pages by itself. We'll configure Squid as a transparent proxy, meaning we'll hijack network traffic and redirect it to a new destination -- our filter program, in this case -- without the need for the user to know that it is happening.

Iptables is the firewall management tool used with the 2.4.x and higher kernels. Let's check to see if iptables is already built into your kernel,

[bemis]

good writeup - a few ideas:
- since you can't be sure that /usr/src/linux/.config is actually the config of the kernel being used, either

[AmosMutke]

[alexlm78]

Excelent guide, tonight i implement it.
_________________
"This is a different kind of world, you need a different kind of software"

Linux User# 315201
100% Chapin hecho en Guatemala

[rev138]

As an FYI, dansguardian-dgav (~x86) has built in virus scanning as well. The set up is more or less the same.

[AmosMutke]

as a status update.. this has been running on my mothers computer for 3 days and appears to be working very well.. Only snag so far was that it blocked the kids from downloading pokemon and dragonball videos. by default it blocks many video types, but you can change it by commenting them out with a preceding "#" character in /etc/dansguardian/blockedmimetypes

[EDIT]

And I should have also mentioned that if you currently run iptables as a firewall, you will need too manually add the new iptable rules in the appropriate places or it may not work...

And if your computer connects directly to the internet (ie not behind some type of firewall) it will be fairly exposed. The iptable rules given are not meant to protect you from hacking attack... that's an entirely different problem..

[LinuxJoe]

At my house, we have the same thing implemented, only it uses IPcop and cop+
Took my dad and I about half a day to set up, now we don't need to mess with it, but when we do there is a web interface. Cop+ is basically the dansguardian, but alredy configured for IPcop.[/url]
_________________
3E Ghz Prescott + 1GB RAM + ATI 9700 Pro + Gentoo...
What else do you need?

[AmosMutke]

[rev138]

[Sheepdogj15]

This guide is fairly easy to redact for use on a dedicated, Gentoo based, firewall/router box. i know, because i just got done setting it up and already got my first Access Denied page

I'll just note some changes i had to make:

• I'm using Shorewall as an interface for IPTables. now, i'm not sure if my configuration is quite right... in fact it's probably wrong (instead of using 127.0.0.1[loopback], i had to keep using the computers LAN IP [10.0.0.1]). however it works so 'tis all good
  
  
• Here are my custom settings in squid.conf:
  

  Code:

  httpd_accel_host virtual httpd_accel_port 80 httpd_accel_with_proxy on httpd_accel_uses_host_header on http_port 10.0.0.1:3128 cache_effective_user squid cache_effective_group squid acl my_network src 10.0.0.0/24 http_access allow my_network

  
  the last bit will set your proxy to only respond to requests from your LAN (be sure to set the appropriate IP subnet).
  
  Also, i hope to tweak the cache settings in a bit, if i find any neat settings or tricks, i'll comment on them here
  
  
• My dansguardian.conf only has a couple of differences: filterip has to be left blank, and proxyip is set to the IP on the LAN interface (10.0.0.1)
  
  
• Dansguardian nagged the first time it started up because it couldn't write a log file. (You may need to comment on this in your howto, AmosMutke.) The fix is to change the folderpermissions:
  

  Code:

  chown squid:squid /var/log/dansguardian

  
  
  
• The setup seems to work fine with these shorewall rules... I would assume the iptables equivalent commands would be a similar to those in AmosMutke's howto. here's the changes to my /etc/shorewall/rules: (and there would be a lot of carry over too if you are just using shorewall on your PC... just change the loc zone to $FW)
  
  

  Code:

  REDIRECT        loc     3128    tcp     8080 REDIRECT        loc     8080    tcp     80     -     !10.0.0.1,127.0.0.1 ACCEPT          loc     net     tcp     443 # remember, squid doesn't proxy for secure http AllowWeb        $FW     net

  
  
  And for added security, disable direct http (port 80) access from the loc zone to the net.
  

I think that's about it. works fine for me. my only other suggestion is to set it up first without transparency to make sure it works (that is, actually configure your web browser with the appropriate proxy address and port -- headache insurance ). then do the redirects and such.
_________________
Sheepdog
Why Risk It? | Samba Howto

[Sheepdogj15]

anyone know a good site for white lists for dansguardian? i already am annoyed trying to get spybot and other Windows tools to update.
_________________
Sheepdog
Why Risk It? | Samba Howto

[mdeininger]

I'd like to point out that web content *filtering* is something you really shouldn't be doing as a *parent* -- ever!
Now, before you start flaming, hear me out!
As a parent, you will probably want to protect your child from something that you think to be inappropriate content. That's fine -- that's your job. It's your responsibility to do it. Your kids need to use the internet for all sorts of things -- from doing research for homework to chatting with friends. Since there's a lot of inappropriate content on the internet, you thus need to make sure they don't get there. The only way to really do this is *sitting next to your kids while they surf*. Automatic filtering software like Dansguardian will never work properly for two simple reasons:

a) The software is a very stupid bugger. It doesn't know what's appropriate, so it basically does word counting and some heuristics to figure out if content is appropriate (unless the content is marked with certain tags, which isn't very likely). Word counting will never really work properly. You get a lot of false positives -- you get a lot of false negatives. Right now I work at a state school as a systems administrator, and we do use dansguardian because some laws require us to make sure the kids are supervised while surfing and we can't afford to have 4 or more teachers in one computer room along with the classes to make sure they don't pull odd moves. As one of the network administrators, my job -- among other things -- is rereading the logfiles of Dansguardian and finding out if some of the kids are looking for porn or DIY bombing kit instructions. Now guess what 99.9% of the time gets stuck in the filter? Educational articles on biology and chemistry, sites that contain news articles on things like homosexual marriage laws, and the like. Once I even found hits on of our more liberal political parties' website, which was completely okay and appropriate! Is that the type of things you want to protect your kids from? I don't think so. You will likely try to protect them from badbad movies and picture galleries. I took the test, that doesn't work. You can't ban video files, and the filter isn't likely to detect picture galleries as bad unless they contain a lot of pornographic advertisements. Not that this would be of any use, since you mostly need a credit card to enter sites like that in the first place! Now, thinking of something like "webpagesthatsuck.com", I come to my other point...

b) ..., which is that your kids are likely smarter than you with computers and it's fairly easy to circumvent lousy protections like these. I know you really don't want to hear things like that, but I can tell you from experience that kids get very creative when it comes to trying to get somewhere they're not supposed to. When I was still going to grammar school, being a 13 year old smartypants, we were allowed to surf the net whenever we felt like it. There was one room with a handful of computers for us pupils and you could borrow the key whenever you had nothing to do and wanted to surf the net. At first, we had only some very cheap firewall, with everything except port 80 being locked so we couldn't chat on Jabber/IRC/ICQ/AIM/Yahoo/MSN/whatever. Well, that was unless you knew one of the many thousand public proxies to use that were on port 80, then it was easy to get around that... Then some teacher complained that he wasn't able to get material off an FTP server, and our computer guy decided to drop the firewall completely, leaving us with access to everything. Then another guy came along and wanted some sort of adult-material-filter, which meant everything was free, except for ports 80, 3128 and 8080 which all went to a local transparent proxy that checked the content, much like this one. Well, kids like me that had a computer at home didn't find it very difficult to just set up a proxy at home on some port like 8000 instead of 8080. Then you just use something like dyndns and add your home-router-thing as your local proxy, and once again you were able to surf everything without getting annoying "access denied"-pages. Then our teacher did something inherently stupid: he blocked access to every access to the outside world unless it went through the proxy. I noticed that because it ever so much annoyed me that I couldn't SSH home. But, guess what, the proxy allowed CONNECTs! You could do everything you wanted through the local proxy, like using SSH, if you just did some fancy routing/tunnelling (I wrote a Howto on something similar somewhere in this forum. you really only need one free port to do nat through an outside box and circumvent any type of filter inbetween).
Well, you might of course prevent your child from aquiring these skills with all the false positives going off at random (that Howto/technical document on networking might be on a server that uses adult advertisements to stay afloat after all... or just plain sites like the one I mentioned earlier that gets banned rather often because of words like "sucker"), but since I was able to do all this with 13, your child might as well be, and then you wouldn't even have a chance.

Now, if you also remember that most adult material -- like porn, or songs with badbad lyrics that were on CDs with a "parental advisory"-sticker -- aren't even gotten off the web (ugh, I hate that word, it sounds so wrong), but instead off networks like eDonkey, GNUtella, BitTorrent or good old Usenet and IRC -- maybe even via instant messenger services (I had a buddy on AIM that would always send me odd pictures every other day), and that you can almost always connect to services like that with a little bit of skill in networks and either a rented rootbox or some friend that's willing to run a proxy for you, then you will hopefully give up futile attempts like content filtering. The best they can do is annoy the kids if they got some smarts at all -- or *you*. Imagine you want to do research on the net and then get a completely legitimate site banned because the writer of the article doesn't share your idea of what's appropriate and what isn't and didn't mind "four-letter-words", or his webspace provider placed porn ads on the poor guy's site. You might even end up not being able to read your eMail via webmail because of spam mail with explicit subject lines being listed in your inbox overview!

*Don't do it*! Either only let your kids browse the web while you're sitting next to them or don't overprotect them from "inappropriate content". It's futile, really, unless your filter has it's own AI that really understands your goals!

(sorry for that long post, but sissy stuff like that really gets me started)

P.S.: still a good howto, honestly, and the bits on setting up a transparent proxy and the possiblity to make dansguardian check for virii on the fly along with squid being able to decrease your consumed bandwidth make it rather useful a thing to do, just don't be naive and use it to "protect" your kids.
_________________
"Confident, lazy, cocky, dead." -- Felix Jongleur, Otherland

( Twitter | Blog | GitHub )

[rev138]

[mdeininger]

[slam633]

In high school, I had to take a bus across town, to the local college, just to take computer classes.
_________________
"Beer is proof God loves us, and wants us to be happy. Ben Franklin"

[Sheepdogj15]

[GoofballJM1]

Um, these are good points and all, but shouldn't this be posted in the OTW section instead of this Howto?
_________________
"Great spirits have often encountered violent opposition from weak minds." - Albert Einstein

[mdeininger]

[AmosMutke]

[mdeininger]

[Headrush]

I agree with you AmosMutke in regards to mdeininger response.

Sure no system is perfect, but as a system administrator you know you have to continually refine the process. I would rather err on the cautious side and then whitelist sites as needed rather than just scrap the idea.

Even if you remove 80% of questionable material it still is a tremendous help and that it can be bypassed doesn't really matter. Why do porn spammers send so much to your email... the more you think about it or see it, they greater chance you will click a link or look for that stuff on the Internet. Even as an adult, the less I am reminded, the less I think about it.

I think this always be over your child's shoulder when surfing premise is unrealistic. Whoever said they shouldn't have a computer in their room was bang on, TVs too.

I don't block specific sites on my firewall or use any filtering other than preventing popups on my browsers which helps tremendously even when surfing as an adult.
(Gotta love when using IE and a porn add pops up and when you hit close it opened 10 more windows. Good old ALT-F4)

[thecooptoo]

As a parent of late teenage children I wish I had used some filtering when they were a bit younger. Its easier as a parent to have tight rules which you relax as they get older as opposed to discivering they are accessing stuff and trying to reign it back again.

ive got squid & danguardian and shorewall

So I didnt have to go round changing browsers configs
I added

[batistuta]

Hi guys. I have a silly question. I mean silly, because I don't know anything about routing tables and stuff. But my problems is similar to that of many people. I have an integrated DSL modem+wireless router with a few computers behind. I would like to set up the proxy on my box, but to filter traffic going to all other machines in my small LAN. Is it possible to direct all traffic to my computer, and then from there to the other machines? Would this require turning off DHCP in the router and putting it on my machine? Would the W-LAN work after that?

This is such a typical setup, that I'm sure someone has already come up with a solution...
the only one that I can think of is putting the router as a client behind my machine and another between my machine and the net

[thecooptoo]

make/model of router ?
_________________
join the optout - http://nhsconfidentiality.org

[batistuta]

I have a FRITZ!Box Fon WLAN 7050 (connecting to the internet). Alternatively, I have a Linksys WRT54G functioning as a repeater. Both run linux so I could tweak some stuff in them if needed although I really don't want to. However, both support port forwarding.