Parental Control Limits- iptable cron job.

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking
Author Message
jwbtx
DD-WRT Novice


Joined: 17 Sep 2012
Posts: 28

PostPosted: Mon Sep 17, 2012 17:39    Post subject: Parental Control Limits- iptable cron job. Reply with quote
All,

I’m new to the DDWRT group and just installed DD-WRT V24-sp2 (08/12/10) Mega (SVN Revision 14929) on a Linksys WRT-600N for more options on parental controls, among others. I moved from a Netgear Prosafe F336G VPN Router. I’ve spent about 15 hours researching parental controls and have found that DDWRT will do pretty much what I want it to do. Yes, for those interested, I’ve looked at all the software installed filters out there, but you can also youtube on how to get around them as well, and my kids have. What I am looking to accomplish is blocking access specific times of the day and week for all ports other than web to still allow for research for homework, etc., but taking away the ability to play games.

What drove me to DDWRT was the ability to utilize iptables and cron. Below is what I am thinking of putting in place, and am looking for feedback; good or bad. If there is a better way of accomplishing this or if you have other suggestions, I would love to hear them.

CRON Entry
0 19 * * 0,1,2,3,4 /PATH/drewfilterON.sh
00 21 * * 0,1,2,3,4 /PATH/drewfilterOFF.sh
15 22 * * 0,1,2,3,4 /PATH/drewfilterON.sh
0 07 * * 0,1,2,3,4 /PATH/drewfilterOFF.sh
15 1 * * 5,6 /PATH/drewfilterON.sh
15 8 * * 5,6 /PATH/drewfilterOFF.sh

#drewfilterON.sh
#Drew Filter On
#!/bin/sh
iptables -I FORWARD 1 -p tcp -m multiport --dports 21,80,443 -d 192.169.0.68 -j ACCEPT
iptables -I FORWARD 2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD 3 -j DROP

#drewfilterOFF.sh
#Drew Filter OFF
#!/bin/sh
iptables -D FORWARD 1 -p tcp -m multiport --dports 21,80,443 -d 192.169.0.68 -j ACCEPT
iptables -D FORWARD 2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -D FORWARD 3 -j DROP

Also from my reading, I am understanding that crontabs are deleted when the device is rebooted, so I would have to insert the commands and create my files each time the device is restarted. I’ve also read about using busybox’s crond which would store everything elsewhere that isn’t overwritten on a reboot. Anyone have experience with this approach? I’ve also read about the DDWRT release of cron not waking, but have not been able to find out of this is just user error/inexperience or legit as there is no mention in the wiki about a known issue that I found.

Thanks for your assistance...

jwb
Sponsor
jwbtx
DD-WRT Novice


Joined: 17 Sep 2012
Posts: 28

PostPosted: Thu Sep 20, 2012 1:43    Post subject: Reply with quote
Ok.. I modified it quite a bit after reading man pages and some other periodicals... Tested and seems to be working very well. My previous one had some issues.

Anyone that wants to install a parental control iptable filter, this is for you. This filter will restrict all access except for WWW & FTP (take off port 21 if you want) to a specific IP while allowing unrestricted access to the other devices on your network. I wanted to create a filter that would prevent my kids from playing any games like WoW or StarCract 2 etc online, but still giving access to the web should they need it for research.

My cron entry is below which invokes the scripts at different times. Currently my cron turns the filters on as follows:

Sunday – Thursday
Filter on between 7-9pm and back on permanently at 10:15pm until 7am the next morning.
Friday – Saturday
Filter comes off at 8:15am and comes on at 1:15am

I stored both files in /root. I kept it simple and gave it “chmod 777 filename” which gave it the necessary permissions to be ran. /root is actually on the /tmp partition, so it will be lost each time the unit reboots or loses power. Move this into the jiffs if you want to have it stored permanently.

#drewfilterON.sh
#!/bin/sh
iptables -I FORWARD 1 -p tcp -s 192.168.0.68 -m multiport --dports 21,80,443 -j ACCEPT
iptables -I FORWARD 2 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -I FORWARD 3 -s 192.168.0.68 -j DROP
iptables -I FORWARD 4 -j ACCEPT

I simplified things turning it off by just flushing since I don’t have any other iptable filters, but if you do, just use the same commands above but replace the -I with -D.

#drewfilterOFF.sh
#!/bin/sh
iptables --flush

My cron entry looks like this:
0 19 * * 0,1,2,3,4 root /tmp/root/drewfilterON.sh
00 21 * * 0,1,2,3,4 root /tmp/root/drewfilterOFF.sh
15 22 * * 0,1,2,3,4 root /tmp/root/drewfilterON.sh
0 07 * * 0,1,2,3,4 root /tmp/root/drewfilterOFF.sh
15 1 * * 5,6 root /tmp/root/drewfilterON.sh
15 8 * * 5,6 root /tmp/root/drewfilterOFF.sh

Hope this helps someone in need. If you have any questions, please let me know.

Props go out to joksi for his previous posts in other threads. I took his information and modified it.

Cheers,

jwb
Sash
DD-WRT Guru


Joined: 20 Sep 2006
Posts: 17638
Location: Hesse/Germany

PostPosted: Thu Sep 20, 2012 9:04    Post subject: Reply with quote
would u be so kind to add it to the wiki?
_________________
Forum Guidelines...How to get help
&
Forum Rules
&
RTFM/STFW
&
Throw some buzzwords into the WIKI search Exclamation
_________________
I'm NOT rude, just offer pure facts!
_________________
Atheros (TP-Link & Clones, etc ) debrick service in EU
_________________
Guide on HowTo be Safe, Secure and Protect Your Online Anonymity!
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Advanced Networking All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You cannot download files in this forum