Force safesearch for Web search engine (google, yahoo, bing...)

[gitdevmod]

Add Safesearch option in proxy for filtering content in web search engine

[AdSchellevis]

timeout

[Stephanowicz]

Here's a description how to solve this with Unbound DNS:

https://forum.opnsense.org/index.php?topic=3423.0

You need to create a file with the CNAME A records like this:
local-data: "www.google.com A 216.239.38.120"

You can copy the list from the link above - we also duplicated the list without the 'www.'
local-data: "google.com A 216.239.38.120"

and also added youtube and bing:

local-data: "www.youtube.com A 216.239.38.119"
local-data: "youtubei.googleapis.com A 216.239.38.119"
local-data: "youtube.googleapis.com A 216.239.38.119"
local-data: "www.youtube-nocookie.com A 216.239.38.119"
local-data: "www.youtube.de A 216.239.38.119"
local-data: "youtubei.googleapis.de A 216.239.38.119"
local-data: "youtube.googleapis.de A 216.239.38.119"
local-data: "www.youtube-nocookie.de A 216.239.38.119"
local-data: "youtube.de A 216.239.38.119"
local-data: "youtube.com A 216.239.38.119"

local-data: "www.bing.com A 204.79.197.220"
local-data: "bing.com A 204.79.197.220"

Hope this helps!

Cheers,

Stephan

[fichtner]

Hi Stephan,

Thanks for the tutorial. :)

Cheers,
Franco

[Hemmingen]

Could we have a list in this repo containing safesearch options for google/youtube, bing, startpage, ... so this could be embedded as a feature in OPNsense?

[mimugmail]

It's supported by Bind Plugin. Maybe I can add it to Dnscrypt-proxy too

[Hemmingen]

Unbound is still the default on OPNsense installations so I was hoping to see such a feature in there, too.

[mimugmail]

@fichtner @AdSchellevis maybe we can add some folder include like with strongswan here too?
It would also ease things e.g. for plugins extending Unbound.

[AdSchellevis]

@mimugmail it's probably a good idea to add something similar, any suggestions for a target directory? The current files are generated into /var/unbound, I think we rather define some path in /usr/local/etc if that doesn't bite with the chroot it uses.

[fichtner]

Though the point of the chroot is that you can't see /usr/local... additional symlink maybe? That being said, maybe a good opportunity to kill the advanced settings as well...

[mimugmail]

Good point, an include folder could kill advanced options. I'm unsure at which place in config to include the include, my knowledge about Unbound is sadly bit limited.

[AdSchellevis]

Initially I thought the same, but I think it reads config before performing the chroot(), within the chroot this doesn't exist either

core/src/etc/inc/plugins.inc.d/unbound.inc

Lines 329 to 330 in 31a81c5

	# Access lists
	include: /var/unbound/access_lists.conf

Which suggests it reads config first, but I might be wrong.

I don't mind killing advanced, as long as the include functions and it's in a major release.