Stephen Royle


<p>I have been running a pi-hole to block ads on my home network for a while. It&#8217;s great! Not only are ads blocked, but it speeds up internet browsing because&#8230; the ads do not load. I wondered if it would be possible to use a pi-hole to make a child-safe internet experience to protect the little people in the house.</p>



<p>Sure, there are ways to do this in most routers but they are not ideal. I have an Orbi mesh from Netgear and this has two parental control options: &#8220;Live Parenting Control&#8221; which is seemingly being deprecated as they push &#8220;Circle&#8221; by Disney. If the words &#8220;by Disney&#8221; alone were not enough to trouble anybody, 1) it works by doing an ARP poisoning attack on the router, 2) Disney (or whoever) would be logging all requests from the network, and 3) the free version is limited and you have to pay for full protection. So, can a pi-hole be used to make a (free) child-safe internet experience? Yes! The trick is how to do that while maintaining a full-bodied internet for everyone else (and maintain ad-blocking for everyone).</p>



<h3 class="wp-block-heading">Existing set-up</h3>



<p>I have the Orbi router doing DHCP assignment (static IPs for some stuff and a range for dynamic assignment). DNS points to the ad-blocking pi-hole which is wired to the router. Yes, I know I can have the pi-hole doing DHCP and I have run it this way with a different router but this configuration is how I have it right now. The router doesn&#8217;t allow DNS settings to be assigned to each device. I&#8217;ll describe how I made the second pi-hole and then how I integrated it into this set up.</p>



<h3 class="wp-block-heading">Making a blockhole</h3>



<p>I bought a RPi Zero W, with pibow case, power supply and 8 GB SD card. My ad-blocker pi-hole runs on a RPi 3B+ and has a bigger card, but there was no need for something that would not handle much traffic.</p>



<p>I installed Raspbian Stretch Lite (I wasn&#8217;t sure if pi-hole is supported under Buster). Legacy downloads of Stretch are available from the Raspberry Pi website. The RPi zero has miniHDMI out to connect to a monitor for the setup. I customised it a bit, enabled ssh and VNC so that I could control it headlessly. Next I gave it the name <strong>blockhole</strong> to <a href="https://thepihut.com/blogs/raspberry-pi-tutorials/19668676-renaming-your-raspberry-pi-the-hostname">distinguish it from the other RPis on the network</a>. I assigned a fixed IP via the router and then ran the pi-hole installation as described on the <a href="https://pi-hole.net">pi-hole site</a>. I could see the dashboard and log in OK, so all was good.</p>



<p>At this point, I simply had a second ad-blocking pi-hole on my LAN with no device(s) on the network using it. Firstly, let&#8217;s turn it into a parental control device. I wanted three things:</p>



<h4 class="wp-block-heading">1. Force safe search on Google, Bing, Duckduckgo and YouTube</h4>



<p>There is a great thread on how to do this on the pi-hole discourse site. The relevant link is <a href="https://discourse.pi-hole.net/t/use-dns-to-force-youtube-into-restricted-mode-and-pi-hole/1996/87">here</a>. Jayke Peters made a really simple bash script to modify the appropriate files on a pi-hole to do this (other people in the thread worked out how to force safe search). In case that link disappears:</p>


<div class="wp-block-syntaxhighlighter-code "><pre class="brush: bash; title: ; notranslate" title="">
wget https://raw.githubusercontent.com/jaykepeters/Scripts/Deployment/Pi-hole_SafeSearch.sh
mv ./Pi-hole_SafeSearch.sh /usr/local/bin/
chmod a+x /usr/local/bin/Pi-hole_SafeSearch.sh
Pi-hole_SafeSearch.sh --enable
</pre></div>


<p>This can all be done via ssh to the blockhole. The last line needs to be run as sudo. You can check that it has generated the appropriate file by:</p>


<div class="wp-block-syntaxhighlighter-code "><pre class="brush: bash; title: ; notranslate" title="">
cd /etc/dnsmasq.d/
ls
</pre></div>


<p>You should see a file called <strong>05-restrict.conf</strong> in there if everything went OK.</p>



<p>Enforcing safe search is such a great idea. Kids can type in a rude word into a search engine and get all kinds of inappropriate content. This change forces the search to be done via the &#8220;safe search&#8221; settings. It really works. The same rude word search with enforced safe search brings down harmless results on Google for example.</p>



<h4 class="wp-block-heading">2. Block inappropriate sites outright</h4>



<p>The script adds wildcard blocks to common terms found in adult site URLs. This means that these sites are just blocked outright. This is a good method. The alternative is to add blocklists to the pi-hole. There are some available on GitHub. Even those that have 1 million URLs will not block the sites that will spring up tomorrow or next week. So just blocking based on common terms like xxx should work better.</p>



<h4 class="wp-block-heading">3. Add some more blocks</h4>



<p>YouTube is forced into safe search, but what if you just want to block it outright? Or any other site? You can blacklist any site using the pi-hole admin page. Log in and select blacklist. The wildcard function will deal with URL variants. The script mentioned above adds to the blacklist other search engines, e.g. ecosia that have no safe search capacity. I added a bunch of other sites here that I wasn&#8217;t happy about, e.g. FaceBook to round off the blockhole.</p>



<h4 class="wp-block-heading">Upstream DNS</h4>



<p>On the ad-block pi-hole I use Cloudflare 1.1.1.1 as the upstream DNS. It is possible to use a service which has family filtering instead. OpenDNS has an option for doing this (which may be pay-for-service &#8211; I&#8217;m not sure). Neustar or other services will give filtering of inappropriate content. Note that they will be logging requests, but only from the kids devices, so it&#8217;s different to the Disney scenario mentioned above.</p>



<h3 class="wp-block-heading">Integration into the network</h3>



<p>The next step was to get it working with the existing network. As described above, we want to maintain a full-bodied but ad-blocked experience for everyone else.</p>



<p>The simplest method was to alter the DNS settings on the devices that the kids use. The DNS address is the blockhole and so they get child-safe internet. Depending on the device, the setting is quite obscure and can be locked in the case of a kid&#8217;s account on a Mac. If they figure out how to change the DNS, it is possible to hand out the blockhole address from the router and manually assign the ad-blocker pi-hole DNS to devices used by adults. It&#8217;s not perfect but it will do.</p>



<figure class="wp-block-image"><img loading="lazy" decoding="async" width="2498" height="1724" data-attachment-id="1922" data-permalink="https://quantixed.org/2019/07/29/childs-play-pi-hole-set-up-for-a-safer-internet/blockhole/" data-orig-file="https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?fit=2498%2C1724&amp;ssl=1" data-orig-size="2498,1724" data-comments-opened="1" data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}" data-image-title="blockhole" data-image-description="" data-image-caption="" data-medium-file="https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?fit=300%2C207&amp;ssl=1" data-large-file="https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?fit=640%2C442&amp;ssl=1" src="https://i1.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?fit=640%2C442&amp;ssl=1" alt="" class="wp-image-1922" srcset="https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?w=2498&amp;ssl=1 2498w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?resize=300%2C207&amp;ssl=1 300w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?resize=768%2C530&amp;ssl=1 768w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?resize=1024%2C707&amp;ssl=1 1024w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?w=1280&amp;ssl=1 1280w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?w=1920&amp;ssl=1 1920w" sizes="(max-width: 640px) 100vw, 640px" /><figcaption>The blockhole in action. This is the dashboard showing queries etc.</figcaption></figure>



<p>Finally, what about time-limiting the internet? Well, the router has options to pause the internet per device and it is possible to run the blockhole on a scheduler to only allow internet at certain times. This is not as sophisticated as the Circle system where there is an option to have x minutes of internet per day and the possibility to reward more minutes for good behaviour etc.</p>



<p>The point of this post was to share how to set up this system and integrate it with an existing pi-hole. None of the work is mine, it was all done with a bit of searching, but I thought it was worth posting my solution in case it helps other parents or carers out there. </p>



<p>If you use pi-hole to block ads or to make a blockhole, consider <a href="https://pi-hole.net/donate/">donating to this useful project</a>.</p>



<p>&#8212;</p>



<p>The post title comes from the track &#8220;Child&#8217;s Play&#8221; from African Head Charge&#8217;s Akwaaba LP.</p>


I have been running a pi-hole to block ads on my home network for a
while. It's great! Not only are ads blocked, but it speeds up internet
browsing because... the ads do not load. I wondered if it would be
possible to use a pi-hole to make a child-safe internet experience to
protect the little people in the house.

Sure, there are ways to do this in most routers but they are not ideal.
I have an Orbi mesh from Netgear and this has two parental control
options: "Live Parenting Control" which is seemingly being deprecated as
they push "Circle" by Disney. If the words "by Disney" alone were not
enough to trouble anybody, 1) it works by doing an ARP poisoning attack
on the router, 2) Disney (or whoever) would be logging all requests from
the network, and 3) the free version is limited and you have to pay for
full protection. So, can a pi-hole be used to make a (free) child-safe
internet experience? Yes! The trick is how to do that while maintaining
a full-bodied internet for everyone else (and maintain ad-blocking for
everyone).

### Existing set-up {#existing-set-up .wp-block-heading}

I have the Orbi router doing DHCP assignment (static IPs for some stuff
and a range for dynamic assignment). DNS points to the ad-blocking
pi-hole which is wired to the router. Yes, I know I can have the pi-hole
doing DHCP and I have run it this way with a different router but this
configuration is how I have it right now. The router doesn't allow DNS
settings to be assigned to each device. I'll describe how I made the
second pi-hole and then how I integrated it into this set up.

### Making a blockhole {#making-a-blockhole .wp-block-heading}

I bought a RPi Zero W, with pibow case, power supply and 8 GB SD card.
My ad-blocker pi-hole runs on a RPi 3B+ and has a bigger card, but there
was no need for something that would not handle much traffic.

I installed Raspbian Stretch Lite (I wasn't sure if pi-hole is supported
under Buster). Legacy downloads of Stretch are available from the
Raspberry Pi website. The RPi zero has miniHDMI out to connect to a
monitor for the setup. I customised it a bit, enabled ssh and VNC so
that I could control it headlessly. Next I gave it the name
**blockhole** to [distinguish it from the other RPis on the
network](https://thepihut.com/blogs/raspberry-pi-tutorials/19668676-renaming-your-raspberry-pi-the-hostname).
I assigned a fixed IP via the router and then ran the pi-hole
installation as described on the [pi-hole site](https://pi-hole.net). I
could see the dashboard and log in OK, so all was good.

At this point, I simply had a second ad-blocking pi-hole on my LAN with
no device(s) on the network using it. Firstly, let's turn it into a
parental control device. I wanted three things:

#### 1. Force safe search on Google, Bing, Duckduckgo and YouTube {#force-safe-search-on-google-bing-duckduckgo-and-youtube .wp-block-heading}

There is a great thread on how to do this on the pi-hole discourse site.
The relevant link is
[here](https://discourse.pi-hole.net/t/use-dns-to-force-youtube-into-restricted-mode-and-pi-hole/1996/87).
Jayke Peters made a really simple bash script to modify the appropriate
files on a pi-hole to do this (other people in the thread worked out how
to force safe search). In case that link disappears:

::: {.wp-block-syntaxhighlighter-code}
``` {.brush: .bash; .title: .; .notranslate title=""}
wget https://raw.githubusercontent.com/jaykepeters/Scripts/Deployment/Pi-hole_SafeSearch.sh
mv ./Pi-hole_SafeSearch.sh /usr/local/bin/
chmod a+x /usr/local/bin/Pi-hole_SafeSearch.sh
Pi-hole_SafeSearch.sh --enable
```
:::

This can all be done via ssh to the blockhole. The last line needs to be
run as sudo. You can check that it has generated the appropriate file
by:

::: {.wp-block-syntaxhighlighter-code}
``` {.brush: .bash; .title: .; .notranslate title=""}
cd /etc/dnsmasq.d/
ls
```
:::

You should see a file called **05-restrict.conf** in there if everything
went OK.

Enforcing safe search is such a great idea. Kids can type in a rude word
into a search engine and get all kinds of inappropriate content. This
change forces the search to be done via the "safe search" settings. It
really works. The same rude word search with enforced safe search brings
down harmless results on Google for example.

#### 2. Block inappropriate sites outright {#block-inappropriate-sites-outright .wp-block-heading}

The script adds wildcard blocks to common terms found in adult site
URLs. This means that these sites are just blocked outright. This is a
good method. The alternative is to add blocklists to the pi-hole. There
are some available on GitHub. Even those that have 1 million URLs will
not block the sites that will spring up tomorrow or next week. So just
blocking based on common terms like xxx should work better.

#### 3. Add some more blocks {#add-some-more-blocks .wp-block-heading}

YouTube is forced into safe search, but what if you just want to block
it outright? Or any other site? You can blacklist any site using the
pi-hole admin page. Log in and select blacklist. The wildcard function
will deal with URL variants. The script mentioned above adds to the
blacklist other search engines, e.g. ecosia that have no safe search
capacity. I added a bunch of other sites here that I wasn't happy about,
e.g. FaceBook to round off the blockhole.

#### Upstream DNS {#upstream-dns .wp-block-heading}

On the ad-block pi-hole I use Cloudflare 1.1.1.1 as the upstream DNS. It
is possible to use a service which has family filtering instead. OpenDNS
has an option for doing this (which may be pay-for-service -- I'm not
sure). Neustar or other services will give filtering of inappropriate
content. Note that they will be logging requests, but only from the kids
devices, so it's different to the Disney scenario mentioned above.

### Integration into the network {#integration-into-the-network .wp-block-heading}

The next step was to get it working with the existing network. As
described above, we want to maintain a full-bodied but ad-blocked
experience for everyone else.

The simplest method was to alter the DNS settings on the devices that
the kids use. The DNS address is the blockhole and so they get
child-safe internet. Depending on the device, the setting is quite
obscure and can be locked in the case of a kid's account on a Mac. If
they figure out how to change the DNS, it is possible to hand out the
blockhole address from the router and manually assign the ad-blocker
pi-hole DNS to devices used by adults. It's not perfect but it will do.

<figure class="wp-block-image">
<img
src="https://i1.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?fit=640%2C442&amp;ssl=1"
class="wp-image-1922" loading="lazy" decoding="async"
data-attachment-id="1922"
data-permalink="https://quantixed.org/2019/07/29/childs-play-pi-hole-set-up-for-a-safer-internet/blockhole/"
data-orig-file="https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?fit=2498%2C1724&amp;ssl=1"
data-orig-size="2498,1724" data-comments-opened="1"
data-image-meta="{&quot;aperture&quot;:&quot;0&quot;,&quot;credit&quot;:&quot;&quot;,&quot;camera&quot;:&quot;&quot;,&quot;caption&quot;:&quot;&quot;,&quot;created_timestamp&quot;:&quot;0&quot;,&quot;copyright&quot;:&quot;&quot;,&quot;focal_length&quot;:&quot;0&quot;,&quot;iso&quot;:&quot;0&quot;,&quot;shutter_speed&quot;:&quot;0&quot;,&quot;title&quot;:&quot;&quot;,&quot;orientation&quot;:&quot;0&quot;}"
data-image-title="blockhole" data-image-description=""
data-image-caption=""
data-medium-file="https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?fit=300%2C207&amp;ssl=1"
data-large-file="https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?fit=640%2C442&amp;ssl=1"
srcset="https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?w=2498&amp;ssl=1 2498w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?resize=300%2C207&amp;ssl=1 300w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?resize=768%2C530&amp;ssl=1 768w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?resize=1024%2C707&amp;ssl=1 1024w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?w=1280&amp;ssl=1 1280w, https://i0.wp.com/quantixed.org/wp-content/uploads/2019/07/blockhole.png?w=1920&amp;ssl=1 1920w"
sizes="(max-width: 640px) 100vw, 640px" width="2498" height="1724" />
<figcaption>The blockhole in action. This is the dashboard showing
queries etc.</figcaption>
</figure>

Finally, what about time-limiting the internet? Well, the router has
options to pause the internet per device and it is possible to run the
blockhole on a scheduler to only allow internet at certain times. This
is not as sophisticated as the Circle system where there is an option to
have x minutes of internet per day and the possibility to reward more
minutes for good behaviour etc.

The point of this post was to share how to set up this system and
integrate it with an existing pi-hole. None of the work is mine, it was
all done with a bit of searching, but I thought it was worth posting my
solution in case it helps other parents or carers out there.

If you use pi-hole to block ads or to make a blockhole, consider
[donating to this useful project](https://pi-hole.net/donate/).

---

The post title comes from the track "Child's Play" from African Head
Charge's Akwaaba LP.


I have been running a pi-hole to block ads on my home network for a while. It’s great! Not only are ads blocked, but it speeds up internet browsing because… the ads do not load. I wondered if it would be possible to use a pi-hole to make a child-safe internet experience to protect the little people in the house. Sure, there are ways to do this in most routers but they are not ideal.


Publicaciones de Rogue Scholar

Child’s Play: pi-hole set up for a safer internet