Safeguard not working at all

[#1]

I recently tested this again with the VPN switched off and safeguard failed to prevent access to pornhub!! So something's broken

[#2]

No VPN here and Safeguard is still not working, as evidenced by the following DNS response, despite my toggling Safeguard off then on again earlier today on the Plusnet web portal.

>nslookup sex.com 213.120.234.42
Server:  indnsc92.bt.net
Address:  213.120.234.42

Non-authoritative answer:
Name:    sex.com
Addresses:  152.44.38.193
          209.50.58.179
          209.50.54.189
          209.50.50.186

[#3]

---

@Richyroo wrote: snipped
So something's broken

---

I thought it was going to be something like a (edit2 what you mentioned), but now you've said it isn't working with the (edit3 something) off, this had made me sit and ponder.

Although the recent customers reporting this are, thus far, low in number, there could be a bigger issue and if this bigger issue is what I'm going to explain in the following example, then IMHO Plusnet SHOULD be emailing the main account holder as a matter of urgency. And if this is bigger than we'll ever know maybe Plusnet should suggest how parents can ensure their children are safe and/or are prevented from accessing such sites - as I've mentioned already the Plusnet Hub Two has the ability to change the DNS to something different and thus something that should reinstate certain age/content restrictions

A family of four have 2 teenagers and these teenagers have historically tried to access Porn (or another other age restricted site) and they couldn't see this content as mum/mam/mother and dad/daddy/father knew of the risks this wonderful internet does pose and blocked them with Safeguard.

Both parents are happy knowing their teenage kids will never get to these sites but......

it's broken and the parents are none the wiser and just by pure chance their teenagers gave it another go and ......

got through this restriction and......

being teenagers they are more than likely NOT going to tell their parents.

If I'm wrong then fair enough, but what if I'm right. Surely this needs looking at as matter of urgency

And yes I am concerned about the safety of everyone on the www, not just our children.

(also I'm aware of how to bypass certain settings and if you do read this please don't post how to do this as the kids of today will see it on Snoop Google and all this will be for nothing - TIA)

edit 1, just to acknowledge the reply above, does anyone know of a means of getting this escalated before the kitten has left the shopping holder. We all know how word spreads between youngsters.

[#4]

Even if apparently there is a limitation in the configuration options of the Plusnet Hub 2 that means Google "Safe Search" can't be configured (it has always worked on my pfSense router while using OpenDNS !),

at least set your router's DNS to OpenDNS "Family Shield" (208.67.222.123 / 208.67.220.123) ,  it might not prevent an unsuspecting teenager cumming across any porn in Google images, but they should be blocked from browsing adult websites.

The other thing you should do in your router is add two outbound firewall rules to restrict DNS requests to ONLY the DNS addresses you have chosen, to prevent teenagers bypassing your selected filtering by overriding their device network settings.

You need one outbound rule to ALLOW (TCP/UDP port 53) to access your two chosen DNS addresses,

and a second outbound rule to BLOCK (TCP/UDP port 53) to ALL other destinations.

If you are using a better router than the Plusnet Hub 2, then you might be able to enable Google "Safe Search" whilst using a 3rd party filtering DNS (like OpenDNS) by following these instructions -

How to: Enforcing Google SafeSearch, YouTube, and Bing 

Alternatively you might want to setup a local network DNS (using an old PC, or a Raspberry Pi, etc) to perform your home DNS filtering, and applying the safe search rules for Google, YouTube, Bing, etc to your kid's network,  and repoint your router's DNS addresses to the new DNS server.

Another option would be re-flash your router with more capable code to facilitate your DNS and search requirements,  for example Running OpenWRT on the Plusnet Hub One 

[#5]

Not in a position to diagnose personally but something seems off to me from the evidence posted in this thread.

I'll try and prod a few folk tomorrow...

[#6]

Thanks @bobpullen 

Or should I say "That'll do"

[#7]

Looks like Safeguard is working again.

EDIT

But now it is not.

[#8]

The way these systems tend to work is:

1. Our home routers get pointed at special DNS servers.
2. These special DNS servers need to know the public IP address of the home router to associate it with our personal preferences for which sites/categories to block.
3. When we configure something like SafeGuard it associates our blocked sites with our routers IP address.
4. When our devices attempt to browse to a website, the public name is sent to special DNS server from our public IP address. Based on this IP address they look up our safeguard settings and respond accordingly, not returning the real address of the website.
5. For something like google.com they return forcesafesearch.google.com so that it forces safesearch to be always enabled.

My guess would be that it is the lookup using the requesting router's public IP address which has gone wrong since clearly the examples given are using the special DNS servers (as demonstrated by the nslookup commands).

I would assume that this association between router public IP address and safesearch settings is something that plusnet leverages via BT.

So either plusnet is not correctly configuring BT's association or their ability to configure BT's system is not working in some cases.

Since most (all?) of our plusnet routers are using dynamic DNS it might have gone wrong there too. i.e. let's say that three weeks ago my dynamic IP changed from 100.100.100.100 to 100.100.100.200 but for some reason this change somehow didn't cause my safe setting configuration associated IP address to update. This could be a problem since BT would apply no policies to my DNS lookups.

However I am not convinced about that given that my SafeGuard settings had somehow changed since they were originally configured and first set up.

I appreciate this is all conjecture but I'm hoping some of my logic/reasoning might trigger an avenue of investigation.

One of the things that makes this so frustrating is that there is no real means to create an online support ticket with plusnet which would have enabled you to track my routers IP address through the system and check with BT that an association exists on their server.

Hope that helps.

[#9]

What’s the point in using Safeguard when it can easily be bypassed ?

[#10]

---

@Champnet wrote:

What’s the point in using Safeguard when it can easily be bypassed ?

---

I'm not sure is relevant to my problem (i.e. why isn't it working and can you fix it), but I'm sure you can read previous disagreements on other threads.

From my perspective, I'm not defending against a technically capable and determined person trying to get access to things they shouldn't, I'm defending against accidental viewing of disturbing/illicit material by someone old enough to use the internet without my constant supervision but young enough that they would be upset/disturbed by following a link down a rogue path.

Even for the adults in the house who are obviously capable of working around (or switching off) the mechanism, I prefer to block links to questionable sites that it's not always possible to know you're about to land on, so I look at it as a preferred safety.

I can understand why others don't, but it's my preference.

Hope that helps.

[#11]

So, you’re happy to let someone else, or even a computer algorithm, decide which sites are suitable for viewing ?

[#12]

What's the alternative? View sites that are unsuitable for viewing to decide if they are suitable?! That would be rather self-defeating.

[#13]

You could just move on, as you would a TV prog you don't like.......

I'm just trying to understand why users feel they need to be warned of iffy sites and by whom.

[#14]

I understand that you prefer not to, please feel free to start a separate thread to discuss this - but this thread is for those who want to resolve this particular issue with a feature they want to use.

Thanks.

[#15]

---

@bobpullen wrote:

Not in a position to diagnose personally but something seems off to me from the evidence posted in this thread.

I'll try and prod a few folk tomorrow...

---

Neglected to report back.

I did raise the flag last week and there's an internal ticket raised for investigation. I have provided account details from this thread to help further efforts.