Flint 2 - Parental Control doesnt work at all :(

Ive just recevied my new router. I would like to block few web pages.

I create profile - put some adresses in BLOCK LIST - APPLY...
...and nothing happened.

How can i make this Parental Control work?

It can block my whole internet access - or grant me a full access - nothing more - nothing less :frowning:

Help please.

1 Like

Please refer this docs to check if the configuration of the Parents Control is right.

Yes - i did everything by the book. Im uisng FW 4.6.2 - "stable version".

  • no matter if i use Brave or Edge
  • i add both my wifi & eth interface to my profile
  • no "network acceleration"
  • your syntax library for parental control shows "404 - page not found" on GitHub
  • i setup profile - sites - schedule...
  • ...stop TEMPORARY SCHEDULE...
  • ...the schedule starts to work...

Only sign that PARENTAL CONTROL is working is just "BLOCK INTERNET" option.

and than blocked sites doesn't work for moment... Brave is thinkink... and then open the sites normal. All of them. Not event one site is really blocked :frowning:

Ive bought your hardware for this feature since i have 3 kids...

Thanks for the tips.

I am not completely sure how the parental control works, but I guess it is some DNS filter as well. Brave (and other Chromium-based browsers) can detect DNS issues and will switch to DNS-over-TLS then, for example.

All in all, DNS filtering is pretty dead and will be buried in the next months/years.

Make sure that your browser does not use any other DNS than your router.

Ok - but im using the Brave browser with default setup. The same for EDGE.

How this feature could be usefull if there is so easy to avoid?
I can block any IP on adguard home - and it works straight away.

Why do you thinkg that DNS filtering will die?

But thanks for the tip - i will dig for it and let you know if that worked.

---EDIT---

Since PARENTAL CONTROL works on DNS one of the reasons why its not working is DNS CACHE. Since im using AdGuard Home i think that ADH can be my "DNS CACHE" - so when i setup the rule its working - bun ADH tryies to find another way to the website. It could be this delay that ive talked about. After that the new route to site is establish... and site is working.

Thats why block on ADH works so well...

If i right that means the PARENTAL CONTROL i usefull feature that will never work :frowning:

Because DoT and DoH don't allow interception and browsers start using them as default.

Sooner or later filtering will happen only in more or less enterprise environments where you can control browsers and devices better than in private usage.

1 Like

So i can forget about PARENTAL CONTROL and block sites on AdGuard Home only?

Can't tell for sure, but from my point of view, this "parental control" is always just some cosmetics.
But maybe @bruce can explain how it works and if it's just some DNS blocker?

1 Like

Looks like it supposed to be a simple easy-to-use feature right from box...

So it should work even with ADH. :thinking:

I use glinet parental controls, although it's just the timer function (allow / block schedule), I haven't used it to block domains as I also run adguard home which can do it on a far better scale.

I use the parental controls with a generic kids profile and add their devices. They have a default block list and then I just add the allow hours for the times they are allowed, runs every day and works flawlessly.

If you then enable adguard home and also toggle on the setting "AdGuard Home Handle Client Requests"

This will list each client in adguard home (when they start making requests) then you can create a "client" for your children's devices and set granular controls on a per client basis. So for example you might want to block tiktok for a young child but allow your older children to have access (yes you can make different profiles inside glient parental controls to achieve this but it's just far easier on adguard ans better) with adguard you can block it on the client and still have a global allow for everyone else, works perfect.

Also I have learnt that adguard also allows individual upstream DNS per client too! This means you can use a DNS from cleanbrowsing.org (which is what Ubiquiti use for their content filtering) or any other DNS you like

The beauty of using a custom pre filtered DNS upstream means that you then have two points of protection to try and catch the undesired traffic.

Another point on adguard is that you don't have to go hunting for ways to block certain sites, they have a pre made list of the major sites and you just toggle what you want blocking, unlike when using pfblocker where I had to manually find the IPs (like trying to block WhatsApp!) Glinet parental controls also requires manual entries to block things (no quick social media blocking toggles)

Unless you are doing domain policy based VPN filter then check out adguard home and use it with the parental controls (time scheduling)

There is currently a bug in adguard whereby you can't set a time schedule "Pause service blocking" (if time isnt UTC) but I've already reported that so hopefully that's fixed in upcoming firmware.

Also make sure you have nat acceleration toggled off.

I forgot to add. When using parental controls your internet connect will drop for all clients at the time you chose to block the devices, this will be very quick but if you are streaming you might have to switch channel and back / reload to establish the connection, just worth noting. The reason for the drop in connection is probably to kill any active states, something I needed to add to my opnsense box otherwise if someone started a connection on a WhatsApp call then they wouldn't get blocked until after. I had my elder child making calls 5 minutes before the cut off only to find they are still on the call way past the block rule. So a kill states features is what's needed here however maybe the Devs can try and narrow down the kill states features to only be for the clients that are in parental controls?

So I just want to sum up. Using the glinet router with adguard and built in parental controls is very powerful! You have the tools you would need for what you want to achieve. I have used pfblockerng & pi hole in the past, the fact you can just block services with ease is what sets adguard apart from them..oh and you couldn't easily do a per client basis role on pi hole in the past and I doubt it's easy (or possible) to be able to give a client a separate DNS.

thanks for the answer - but stil...
What for you are using Parental Control if it simply doesn't work at all and block really nothing?
What it can do - is to block whole internet access - which is stupid.

Because I don't want to schedule different sites at different times, I want my children's devices to be blocked completely and time limits still falls under parental controls on most consumer devices.

The fact that adguard is far easier to block apps makes sense to have that doing all the filtering and because I know adguard is powerful to use but out of curiosity I tried parental controls and it does block site access but it's not that straight forward really.

On parental controls scroll to the bottom and create a new profile, let's call this "kids blocklist"

Choose a colour so you can differentiate the rule (avoid default blue and red)

Add a site. For example: yahoo.com

Save the rule.

Now at the top of the page go to profiles, create your profile, I called mine kids and put all their devices under one umbrella and then save.

The next page is the important part and probably not very well implemented.

For example, you would just assume to select your "kids blocklist" on this page (Default Ruleset) click finish and then go to the time schedule but then there is no drop down for our kids devices to choose as we have chosen it from the default ruleset and this the problem.

Just to note for the below section - If you click "Later" on "4. Go to set schedules" then we don't need to make a block rule to get to the next page

On the next page where we want to schedule we have to choose a list other than our default list "kids blocklist" so you can choose block for example and just hit apply so we can get to the next page where the schedule shows. You will now see your schedule is all red because we have put a block rule over the top of our default rule.

If you click the :gear: on schedules then you can now click "Delete all schedules" and you will see your kids blocklist default rules applied all day every day, if you wanted to have all internet access say 9am - 6pm, you can add a schedule and choose "no limit" for the times that you DONT want the "kids blocklist" filter to be in place.

You can also do it in reverse which is a better approach in my opinion and by that I mean choose default ruleset: No limit or Block internet access depending if you want to stop the filter or stop internet access altogether as the main rule set.

And then on the schedule you can choose your kids blocklist or any other schedule in-between other than the default blocklist.

So yes it's not clear! The takeaway from this is that the default ruleset can't be used in schedule as it's already implied that's it's a default 24hr rule.

The main problem here is that the GUI is telling us to "Go to Set" and then we can't set anything with our kidsblock list as its already the default rule. What we can do is either choose "Later" on the schedule page and then go back to the main overall parental controls page and click the :gear: icon next to the profile name and edit the schedule that way (add no limit schedule in-between times so the filter isn't applied for example)

Or when you are on the "Go to Set" page just click cancel and you will be in the schedule page for the profile.

Now after all that try and hit yahoo.com on a device that's in the kids blocklist, you should see it's blocked if you haven't used a "no limit" override for the given period of time/day.

Man did that take some back and forth on my phone to write up! Hope this helps

Tldr - use adguard and timer like I do :rofl:

1 Like

Don'g get me wrong - i really appreciate your time for answering for my post - but the main problem is that from my point of view PARENTAL CONTROL simple does nothing at all.

No matter what i will do first - there is really no change.
Right now i have just two symptoms that this feature do anything:

  • it can block whole internet access
  • it can slow down opening sites that should be blocked (but only first time - and not all of them).

It's to bad that GL-INET support is still quiet :frowning:

It looks like a bug, would it be convenient for you to have our technicians support it remotely?

In addition to that, have you tested enabling the Override DNS Settings for All Clients option on the DNS page to prevent clients from using their own DNS?

1 Like

Since almost every modern device can randomize their mac's, probably better option for Adguard filtering is to make all site blocks, content filters etc -global- and after this set exception devices (like parent PC's, laptops, mobiles) and make sure these device's mac's aren't go random every time.

Remotely support? That would be great!
(since ive persuadedd few of my friends to buy your RU cause we are all in the "dads club").

How can this be done?


You mean this feature?

Im using ADGUARD HOME so which option should i enable there?
Right now here - http://192.168.1.1:3000/#encryption
i see something like this (and this is new for me...)
GL-INET_DNS_2

@okinoko - my PC's has static MAC and same IP reserved in DHCP.

Add the device to GoodCloud, there you can share it then.

Don‘t enable Remote Access on the router itself!

Hi,

Please refer this guide to share your router with us.

Please PM router MAC with me!

Technical Support via GoodCloud.tar (192 KB)

If Adguard is in use I believe option: -override DNS settings for all users- should be -off- for router, since all traffic goes through Adguard anyways. Adguard tab have 2 switches on it's page which should be in -ON- state, 1st is turning Adguard -on-, 2nd switch actually allow Adguard separate clients.
P.S. the only problem I see at the moment, my wifi mesh network connected to router doesn't allow Adguard separate traffic for clients on dashboard page (probably bcs all devices goes to internet through 1 main mesh device physically connected to the router). So I will test if Flint 2 can cover all my flat with proper signal strength and maby turn mesh network off.
P.P.S. It's only 2nd day I have this router, so there is plenty things to do, but I'm amazed about wireguard server option. Setup it in 15 second (only changed DNS server setting to one I need in standard configuration file). It works much faster than Tailscale (which is quite logical since do not need go through Tailscale servers :blush: ) and also gives access to local network very easy.

kmod-gl-sdk4-parental-control_5.4.238+git-2024.106.36783-337f139-1_aarch64_cortex-a53.tar (47.5 KB)

1.Turn off hardware acceleration and close adguardhome----Because adguardhome may use custom dns, parental controls may be affected
2.After decompression, use winscp to upload the ipk file to the /tmp directory
3. ssh [email protected]
4.opkg --force-reinstall install kmod-gl-sdk4-parental-control_5.4.238+git-2024.106.36783-337f139-1_aarch64_cortex-a53.ipk
5. /etc/init.d/parental_control  restart
6. conntrack -F
7.Clear browser cache
8. test

Please let me know the test status

thank you