# Some security measures **URL:** \ **Category:** Installing and Using OpenWrt\ **Created:** [December 4, 2020, 10:38pm UTC](https://forum.openwrt.org/t/some-security-measures/81172 "2020-12-04T22:38:48Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![camus](https://forum.openwrt.org/letter_avatar/camus/32/5_5575768a8748004e209b776fc1b2916d.png) [@camus](https://forum.openwrt.org/u/camus)\ **Post date:** [December 4, 2020, 10:38pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/1 "2020-12-04T22:38:48Z")
Hello and thanks for reading and considering my questions. They are simple but as I am new here, I cannot assume to know their answers. These are questions that take the form of needs I would like met using the firmware. I would like to block certain devices from using only certain websites at certain times that I will supply. And to have the chance to add to this list of websites. I would like to block access to the internet at certain times for certain devices and at certain specified times, after which the 'block' will not apply. I will like to subject enhanced safe search results for certain devices. These devices would be identified by IP. I would like to have a message displayed each time users of these devices breach these 'rules.' That's all for now. And, again, many, many thanks. Camus ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [December 5, 2020, 4:24am UTC](https://forum.openwrt.org/t/some-security-measures/81172/2 "2020-12-05T04:24:53Z")
Search is your friend: [https://forum.openwrt.org/search](https://forum.openwrt.org/search) (I literally typed most of your sentences verbatim into search and got the links I would provide you.) > [@camus](#): > > I will like to subject enhanced safe search results for certain devices. These devices would be identified by IP. 😕 - You want a Layer 3 router to capture a web search based on the initiating host - then redirect it to another website??? - If so, do you mean HTTP or HTTPS? - How do you suggest the router guess you're on a search site or want to go to one? > [@camus](#): > > I would like to have a message displayed each time users of these devices breach these 'rules.' - Displayed where? - Your router has a display? - To be clear...which rule(s) - please don't say "all of them"? EDIT: Additionally, none of your statements end with a question mark, so it's really difficult to determine what you asked or what your question is. I'll take the easy route since you didn't ask **how** and simply say all of what you listed seems possible - the web search thing may be difficult though. ---
**Author:** ![camus](https://forum.openwrt.org/letter_avatar/camus/32/5_5575768a8748004e209b776fc1b2916d.png) [@camus](https://forum.openwrt.org/u/camus)\ **Post date:** [December 5, 2020, 12:16pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/3 "2020-12-05T12:16:57Z")
This is a good point and I now fix it by asking clear questions that I will also use to search on the link you sent. How can I block devices from accessing the Internet at certain time of the day. How can I create a set of websites that these devices can access at certain time of the day How can I use for example ([https://github.com/StevenBlack/hosts](https://github.com/StevenBlack/hosts)) to subject certain devices, while other devices on the same network are not subjected to being blocked from accessing the sites on that host file How can I set up Openwrt to display a message on the user's browser when they attempt to visit a website they are not allowed, such as: "you are not allowed to visit this website....." Thanks a lot ---
**Author:** ![vgaetera](https://forum.openwrt.org/user_avatar/forum.openwrt.org/vgaetera/32/113586_2.png) [@vgaetera](https://forum.openwrt.org/u/vgaetera)\ **Post date:** [December 5, 2020, 12:46pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/4 "2020-12-05T12:46:12Z")
- [Parental controls](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/fw3_parent_controls) - [DNS-based firewall with IP sets](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/dns_ipset) ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [December 5, 2020, 1:12pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/5 "2020-12-05T13:12:58Z")
> [@camus](#): > > This is a good point and I now fix it by asking clear questions > [@lleachii](#): > > none of your statements end with a question mark 😕 > [@camus](#): > > How can I set up Openwrt to display a message on the user's browser when they attempt to visit a website they are not allowed, such as: "you are not allowed to visit this website....." ~~Please answer the question.~~ If you don't know a term (i.e. "Layer 3"); don't assume it didn't apply to you. I am replying directly to you and your inquires after all. > [@lleachii](#): > > - You want a Layer 3 router to capture a web search based on the initiating host - then redirect it to another website??? > - If so, do you mean HTTP or HTTPS? > [@camus](#): > > A 'Layer 3 router' is a new phrase for me to learn. I doubt this is what I need. But I will clear this up further below. ~~Nothing was cleared up. A **router** is a Layer 3 device. If you don't need it, then remove the OpenWrt. Web browsing is Layer 7...your device handles Layer 3...so again:~~ > [@lleachii](#): > > How do you suggest the router guess you're on a search site or want to go to one? (Also, can you work on not messing up quotes - so your responses don't appear to be my words. That's very difficult to follow.) EDIT: I noticed you didn't ask again about the web search thing, so I struck-out that information above. ---
**Author:** ![camus](https://forum.openwrt.org/letter_avatar/camus/32/5_5575768a8748004e209b776fc1b2916d.png) [@camus](https://forum.openwrt.org/u/camus)\ **Post date:** [December 5, 2020, 1:20pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/6 "2020-12-05T13:20:48Z")
> [@vgaetera](#): > > - [Parental controls](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/fw3_parent_controls) > - [DNS-based firewall with IP sets](https://openwrt.org/docs/guide-user/firewall/fw3_configurations/dns_ipset) @vgaetera thanks a lot for these pointers. Now I have lots to read 😀 I will do so and if i have further questions come back to this thread. If not, I will mark it 'solved.' Thanks a lot. ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [December 5, 2020, 1:25pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/7 "2020-12-05T13:25:54Z")
I surmise you could also use [Adblock](https://forum.openwrt.org/t/adblock-support-thread/507) for the commands and run a cron job to enable/disable the lists...but displaying the violation to the SRC host is difficult no matter what option you use. ---
**Author:** ![camus](https://forum.openwrt.org/letter_avatar/camus/32/5_5575768a8748004e209b776fc1b2916d.png) [@camus](https://forum.openwrt.org/u/camus)\ **Post date:** [December 5, 2020, 1:27pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/8 "2020-12-05T13:27:28Z")
> [@lleachii](#): > > If you don't know a term (i.e. "Layer 3"); don't assume it didn't apply to you. I am replying directly to you and your inquires after all. Yes, this will be correct. And would such a website be within Openwrt, such as a webpage within the router that I can configure with the message I want displayed on Layer 7 devices. ---
**Author:** ![camus](https://forum.openwrt.org/letter_avatar/camus/32/5_5575768a8748004e209b776fc1b2916d.png) [@camus](https://forum.openwrt.org/u/camus)\ **Post date:** [December 5, 2020, 1:28pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/9 "2020-12-05T13:28:56Z")
> [@lleachii](#): > > (Also, can you work on not messing up quotes - so your responses don't appear to be my words. That's very difficult to follow.) I tried, but can't seem to figure out how to do so and multiple separate quotes is not good either. How can I do it with single quote? ---
**Author:** ![camus](https://forum.openwrt.org/letter_avatar/camus/32/5_5575768a8748004e209b776fc1b2916d.png) [@camus](https://forum.openwrt.org/u/camus)\ **Post date:** [December 5, 2020, 1:31pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/10 "2020-12-05T13:31:53Z")
> [@camus](#): > > This is a good point and I now fix it by asking clear questions that I will also use to search on the link you sent. > How can I block devices from accessing the Internet at certain time of the day? > How can I create a set of websites that these devices can access at certain time of the day? > How can I use for example ([https://github.com/StevenBlack/hosts](https://github.com/StevenBlack/hosts)) to subject certain devices, while other devices on the same network are not subjected to being blocked from accessing the sites on that host file? > How can I set up Openwrt to display a message on the user's browser when they attempt to visit a website they are not allowed, such as: "you are not allowed to visit this website....."? Just to make things clear, these are the _specific_ questions. ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [December 5, 2020, 3:08pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/11 "2020-12-05T15:08:15Z")
> [@camus](#): > > And would such a website be within Openwrt, such as a webpage within the router that I can configure with the message I want displayed on Layer 7 devices. No. You would have to create some **API** (if I'm not mixing terms here - no ☕ yet) for the client to receive those. You're mixing what's called **layers of abstraction**. Hence your term "Layer 7 devices" phrasing missed the point and shows partial understanding. Your clients are Layers 1-7; but they talk to your router on Layer 3 though. 😉 Your router passes IP packets (Layer 3) received from clients to WAN, it doesn't: - process HTTP (Layer 7) - HTTPS (Layer 7) - nor render web pages to see if it's a search page - so it knows the client is sending a particular term, nor send display messaged to computer screens (Layer 7), etc. (I added the specific example here in case a search site(s) was a part of this inquiry) It does: - In most cases process the DNS request (Layer 7) - Block traffic by firewall (Layers 2, 3 and/or 4 - usually Layer 3) > **[API](https://en.wikipedia.org/wiki/API)** > > An application programming interface (API) is a way for two or more computer programs or components to communicate with each other. It is a type of software interface, offering a service to other pieces of software. A document or standard that describes how to build or use such a connection or interface is called an API specification. A computer system that meets this standard is said to implement or expose an API. The term API may refer either to the specification or to the implementation. Wh In... > **[Abstraction layer](https://en.wikipedia.org/wiki/Abstraction_layer)** > > In computing, an abstraction layer or abstraction level is a way of hiding the working details of a subsystem. Examples of software models that use layers of abstraction include the OSI model for network protocols, OpenGL, and other graphics libraries, which allow the separation of concerns to facilitate interoperability and platform independence. Another example is Media Transfer Protocol. > In computer science, an abstraction layer is a generalization of a conceptual model or algorithm, away fro... > **[OSI model](https://en.wikipedia.org/wiki/OSI_model)** > > The Open Systems Interconnection model (OSI model) is a conceptual model from the International Organization for Standardization (ISO) that "provides a common basis for the coordination of standards development for the purpose of systems interconnection." In the OSI reference model, the communications between systems are split into seven different abstraction layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application. > The model partitions the flow of data in a com... Basically: - You have to configure the router to block and notify **itself** (easy) - This level of ease would depend on if you use firewall (easy because you can log it) - or a domain block list (not sure where the warning is logged, if at all) - Put that notification into something that can be transmitted to the client - Have software on the client that received the message To my knowledge, the latter two software do not exist - you'd have to script this. I supposed old Windows messaging protocol and clients could work to send/receive the message...but this is rarely used these days and I'm not aware of a OpenWrt software package to transmit. > **[Windows Messenger service](https://en.wikipedia.org/wiki/Windows_Messenger_service)** > > Messenger service is a network-based system notification Windows service by Microsoft that was included in some earlier versions of Microsoft Windows. > This retired technology, although it has a similar name, is not related in any way to the later, Internet-based Microsoft Messenger service for instant messaging or to Windows Messenger and Windows Live Messenger (formerly named MSN Messenger) client software. > WinPopup sends messages from one Windows computer to another on the same LAN. It is ... > [@camus](#): > > I tried, but can't seem to figure out how to do so and multiple separate quotes is not good either. How can I do it with single quote? 😕 Just don't type inside the quotebox you pasted. Simple. > [@camus](#): > > these are the _specific_ questions. Per your DM and other responses, this already became clear. And TBH, you could have simply edited your first or subsequent post (mainly to correct them). Now your quote in [Post No. 10](https://forum.openwrt.org/t/some-security-measures/81172/10) references a post and phantom text that does not contain what you wrote. Disability-compliant readers will have a hard time, but I can read and follow. ---
**Author:** ![dlakelan](https://forum.openwrt.org/user_avatar/forum.openwrt.org/dlakelan/32/2320_2.png) [@dlakelan](https://forum.openwrt.org/u/dlakelan)\ **Post date:** [December 5, 2020, 3:17pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/12 "2020-12-05T15:17:29Z")
The best way to handle decisions about websites is to make them in a piece of software that processes application layer stuff (layer 7). For the web, this is a web proxy. The best bet is to use squid. Because of https it can only make decisions on domain names not web content, but it's sufficient. The user will get a message that the proxy is refusing connections if they try to open a website that is blocked... To do this you must explicitly set proxy on all clients, and block routing of port 80 and 443 for http and https. At that point going through the proxy is the only option ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [December 5, 2020, 3:20pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/13 "2020-12-05T15:20:33Z")
> [@dlakelan](#): > > To do this you must explicitly set proxy on all clients, and block routing of port 80 and 443 for http and https. At that point going through the proxy is the only option Could the OP make a transparent proxy and have iptables send the packets there? (The OP should understand though, any traffic that uses 80/tcp and 443/tcp that is not actually HTTP and HTTPS respectively, will fail using this method.) ---
**Author:** ![dlakelan](https://forum.openwrt.org/user_avatar/forum.openwrt.org/dlakelan/32/2320_2.png) [@dlakelan](https://forum.openwrt.org/u/dlakelan)\ **Post date:** [December 5, 2020, 3:24pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/14 "2020-12-05T15:24:35Z")
> [@lleachii](#): > > Could the OP make a transparent proxy and have iptables send the packets there? Transparent proxies don't work with https without a man in the middle attack which is way harder than just setting explicit proxies, so no. Just set the proxy explicitly and voila ---
**Author:** ![lleachii](https://forum.openwrt.org/letter_avatar/lleachii/32/5_5575768a8748004e209b776fc1b2916d.png) [@lleachii](https://forum.openwrt.org/u/lleachii)\ **Post date:** [December 5, 2020, 3:25pm UTC](https://forum.openwrt.org/t/some-security-measures/81172/15 "2020-12-05T15:25:13Z")
> [@dlakelan](#): > > Transparent proxies don't work with https without a man in the middle attack which is way harder than just setting explicit proxies Very true, forgot that part.