Hello,
Friends, how do I block pornography images in my RB? I have a rule that blocks all VIDEOS, but today I discovered that my son opens pornographic images from this page "ANNIE HENTAI" and places images, because the videos cannot be opened, so please help me.

Blocking is never the answer, they will allways find a way.
It's better to educate and to supervise until a certain age. When they reach puberty you just have to learn to trust them.

Blocking is never the answer, they will allways find a way.
It's better to educate and to supervise until a certain age. When they reach puberty you just have to learn to trust them.

I understand, but as if there are rules to block pornographic videos, there must be some rule to block pornographic images of ANNIE HENTAI.

Nope, don't know that one. I mean, seriously, do you expect us to know every single porn page on internet? No human can do that. You also didn't share any info at all about your config, how you block things, etc. Anyway, I don't think you can win, you'll block few pages, and there will still be millions of others left.

You didn't read what I wrote, did you? You can ignore the last sentence, but the rest stays. There's nothing to work with, you didn't provide any useful info.

You didn't read what I wrote, did you? You can ignore the last sentence, but the rest stays. There's nothing to work with, you didn't provide any useful info.

Ok, excuse me, so I block the pornographic videos

add action=dst-nat chain=dstnat comment="block porn" dst-port=53 protocol=udp src-address-list="BLOCK PORN" to-addresses=208.67.222.123 to-ports=53

https://www.opendns.com/setupguide/#familyshield

is one idea worth exploring, lets us know how it works!
So put their DNS servers in for all DHCP network settings 208.67.222.123 .........................................
and for the IP DNS servers as well.
208.67.222.123
208.67.220.123
................................

You don't have to add it for whole network (some other users may not like that). Dstnat was ok. In fact, better, because it also intercepts requests to other servers (e.g. if someone configured them manually on their device). Only you should add one more rule, exactly the same as you have now, but with protocol=tcp instead of udp. Keep the old one untouched, so you'll have two. But it won't help, it's just small fix to have complete config.

As for the real problem, the filtering is done by remote server, and it's the same for pictures, videos, everything, because it works with hostnames, i.e. it blocks whole servers. If it doesn't block some, it probably means that they don't know about it (there are millions, so some will always slip through), or it's porn on some otherwise legitimate domain. So you'd have to contact them and report it, so that they could add it to blocklist.

But if your son discovers DNS over HTTPS, VPN, proxy servers, ... you'll still lose, because you can't block all that.

add action=dst-nat chain=dstnat comment="block porn" dst-port=53 protocol=udp src-address-list="BLOCK PORN" to-addresses=208.67.222.123 to-ports=53

This will no longer work as most web browsers now default to using DNS over HTTPS to increase user privacy. That rule is for classic DNS - it would have worked before DNS over HTTPS came out, but is now almost useless. There is no way to construct a rule that will match DNS over HTTPS traffic in that same way.

If the blocking currently works for some/most servers, it means that browser uses regular DNS, so it's not completely hopeless, as long as user doesn't try too hard to get around it (or can't, but it would require completely locked down environment).

I use OpenDNS with a Mikrotik script to update the IP. We use this at the school to block porn, anime and other games website. U can also block certain VPN, anonymizer use OpenDns. The router will block other port 53 and translate to openDns servers. The kids haven't figured DOH yet, once they do then I will have to figure it out as well.

Turn off safe search on your google search

Do a search for example for "sex nude"
Select picture.

To block this, you need to have 100% control of the PC.
You can block google.com, but then just use bing.com instead. Same problem.

Turn off safe search on your google search

Do a search for example for "sex nude"
Select picture.

To block this, you need to have 100% control of the PC.
You can block google.com, but then just use bing.com instead. Same problem.

Too funny Jotne I thought this thread was about blocking porn, not facilitating the access to porn! ;-P

It was just to show that trying to block some are more complicated and nearly impossible today.

I was pulling your third leg mate!

most web browsers now default to using DNS over HTTPS to increase user privacy.

Good one.
/s

Good one.
/s

Well it is true - increasing user privacy is the main goal of it. So in this case, the aim is to increase the privacy of the son, and give his father less ability to see what his son is doing.

This downside of the technology is outweighed by the benefits in other cases - ex. potential ISP tracking of what websites customers are going to and then selling the statistics, or authoritarian regimes in certain countries using this information to spy on a customer's web traffic.

Some Western governments like the UK have people actively pushing to get rid of these privacy protections to "protect the children", but this I think is a very misguided path to go down. There are other ways to protect children (ex. content filtering software installed on a PC, or monitoring of the child) rather than trying to get rid of encryption, or allowing for reversible encryption, to try to "resolve the problem".

You cannot block porn using RB .....
You can block porn by using a solution like Untangle running in conjunction with your RB Router ...

Untangle has a learning curve so its not easy nor is it cheap --- but once you learn how to you can effectively block porn plus many other stuff.
Untangle Web Filter

Is untangle applied at the router lever or on each PC?

Is untangle applied at the router lever or on each PC?

The chain is as follows:
RB acting as the Router --> Untangle in Bridge mode as the "Filter --> Switch where all the devices are hung including all AP's
There are multiple Bridge configurations possible --- following is link to networking using Untangle

Untangle can be the Router as well and that takes RB out of the picture ... But if you are heavily invested in Tik gear THEN Untangle in Bridge mode makes sense especially if you want to block porn etc.

So either way
1. one has to pay $$ for a physical device that sits on the network somewhere
2. one has to pay a monthly fee $$ for the service.

It looks rather complex, have you managed to figure out how to place inline in a bridge with common vlan filtering setups??

It looks rather complex, have you managed to figure out how to place inline in a bridge with common vlan filtering setups??

I have not done this using MikroTik Routers ... I have done this for a number of families using Ubiquiti EdgeRoutr-X and Untangle ... To prevent porn some families will pay the price without hesitation but most of these are well-to-do families. Its not complicated once you learn how ... yes it takes time to learn and I do not believe that RB devices would be a problem since they are extensible.

My recommended approach using Untangle is to use it in Router Mode because that would be the KISS approach ... Untangle works really well when it is installed in a machine that has plenty of memory for cache and a very fast processor [3Ghz minimum] and SSD for storage assuming performance is desirable because "content filtering" puts a heavy load on the system.

You can block porn by using a solution like Untangle running in conjunction with your RB Router ...

Can this block porn when you do a google search for "sex nude" and search filter is turned off?
How should Untangle see the different from a search fro "Nasa" or for "sex"?

Can this block porn when you do a google search for "sex nude" and search filter is turned off?
How should Untangle see the different from a search fro "Nasa" or for "sex"?

The Untangle admin will never turn Web Filter off ,,,, the level of sophistication is significant:

https://wiki.untangle.com/index.php/Web_Filter

Web Filter monitors HTTP and HTTPS traffic on your network to filter and log web activities and block inappropriate content. Web Filter also appeals to customers who require an added level of protection or are subject to regulations, for example Web Filter helps libraries comply with the Children's Internet Protection Act). Need to block Pornography or Hate Speech on your network?

Traffic Flow
When scanning traffic, Web Filter evaluates the pass lists, block lists, categories, and rules at two distinct points of the HTTP transaction. The first evaluation happens after the request is received from the client and before it is forwarded to the server. The second is after the response is received from the server and before it is passed back to the client. This allows a high degree of filtering and control over both resources that are requested, and content that is returned in response.

The Link above provides excellent additional information

The Untangle admin will never turn Web Filter off ,,,, the level of sophistication is significant:

So this solution does not work if you do not have 100% control of all clients in the network.

PaloAlto and Forcepoint (and other) also have solution that change the certificate and examines all the packets to see whats inside.
But this is for corporate network where there are admin that has control of the pc.

Untangle does not help with "How do I block pornographic images in my RB?"

I say that blocking porn is a battle that is very hard to win.

No I dont think that is what is being said............. we are talking about implementation NOT on individual PCs jotne!!

So untangle will help here? (I have not looked at it)

So untangle will help here? (I have not looked at it)

Yes but you have to buy an untangle box and put it as your router or inline on the LAN as a conduit to the WAN, and you have to pay a monthly fee.
So not cheap.

An this will open google search (https/quic) packets and block search for "sex nude"?
How can I the trust https?

I can understand how this can block sites, but not some part of data from a site.
It will not help OP that like to do it with a MT Router.

An this will open google search (https/quic) packets and block search for "sex nude"?
How can I the trust https?

I can understand how this can block sites, but not some part of data from a site.
It will not help OP that like to do it with a MT Router.

Untangle can also do man-in-the-middle SSL decryption and re-encryption, like Palo Alto and Fortinet devices. You have to trust the certificate of course in order for this to work properly without throwing scary errors to the user.

Untangle can also do man-in-the-middle SSL decryption and re-encryption, like Palo Alto and Fortinet devices. You have to trust the certificate of course in order for this to work properly without throwing scary errors to the user.

So then you need to have control of the clients (PC/Phone ++++). Not for any home/smal business network.
And for home network, kids just connect to mobile network if you start to block anything.

So then you need to have control of the clients (PC/Phone ++++). Not for any home/smal business network.
And for home network, kids just connect to mobile network if you start to block anything.

In all of my Untangle installations non of the families permits their children to have cell phones. Yes it is strictly enforced because those families understand the environment. Untangle is very effective.

I guess they don't permit their children to have friends either? Because it they do, whole thing is in vain.

True, better to educate than to deny because deny doesnt work in our society especially if you have money.

True, better to educate than to deny because deny doesn't work in our society especially if you have money.

Best word as far in this thread.

I guess they don't permit their children to have friends either? Because it they do, whole thing is in vain.

Also a good comment Friends share their mobil net.

In all of my Untangle installations non of the families permits their children to have cell phones.

How old are your children and what country are you in?
Here in north Europa, most 7 years old have their own cell phone.

Understand the code and apply changes if needed. 1.1.1.2 disables just malware.

This will help some.
Problem is that you can set your own DNS (that could be redirected using rules to your DNS)
Some clients are using DoH/DoT and will not use normal DNS server at all. (example iOS >=14)
https://paulmillr.com/posts/encrypted-dns/

Some clients are using DoH/DoT and will not use normal DNS server at all. (example iOS >=14)
https://paulmillr.com/posts/encrypted-dns/

Yes, any fresh OS and browser is able to do DoH. I've successfully used deterrence for this, by announcing that porn is blocked with additional rules to automatically block out any device that tries to get past the restriction. It works, no technical blocking rules needed if users believe

Can you explain how this is done? Can it be done one RouterOS?

I am not sure how to block this without having 100% control of the clients.
You can setup as many DoH server as you like on the internett. Since this is https packets, I do not see how you can block them without opening the https packets and inspect them. Hense, not doable on RouterOS.

What is the ultimate goal here? If the person is able to configure DoH, maybe he is also free to watch his pr0n ? I don't think children will use DoH.

OPs question "How do I block pornographic images in my RB?"

Simple answer:
Can not be done.

As Anav writes: Do educate your user.

I would guess DoH/DoT will become standard and automatically for more and more products, so any attempts to block/control det old, non encrypted, obsoleted DNS, will no help.

add action=dst-nat chain=dstnat comment="block porn" dst-port=53 protocol=udp src-address-list="BLOCK PORN" to-addresses=208.67.222.123 to-ports=53

There is no way to construct a rule that will match DNS over HTTPS traffic in that same way.

However, you can block access to (known) DoH-Server IPs. Which then forces fail-back to standard DNS.

Turn off safe search on your google search
You can block google.com, but then just use bing.com instead. Same problem.

No.
You can force safe search, both for google, and for bing, on the router.

It was just to show that trying to block some are more complicated and nearly impossible today.

You are correct, when stating "nearly". But it is much closer to 100%, as your comments suggest.
Unfortunately, I doubt everything can be done on a MT, as not "open" enough. openwrt-device is a good platform, though.
Blocking DoH-Servers should be possible for MT device, at least. Forcing "Safe Search" probably not, because user control regarding DNS-sever not sophisticated enough. But SNI-inspection is possible, AFAIK, giving lot of control regarding https-porn sites.

Without 100% control of all clients in a network, you can not control what they can do or can not do.
Example. Here in Dubai (vacation), they have blocked video/audio on Whats app/MSN ++, but had no problem finding a way to get around it.
In Turkey they blocked various sites, like Wikipedia. DoH fixed access to it.

So please show me a solution that are up to 100% secure without controlling the clients.

So please show me a solution that are up to 100% secure without controlling the clients.

If your network cannot control all of its networked clients then porn connot be blocked or dropped ….

So then back to OPs request.

How do I block pornographic images in my RB?

Can't be done.

@Jotne …. You are going in circles …. I said earlier it can be done with Untangle under condition that all network clients are using the network chain as follows ….. RB as router => Untangle in bridge mode => managed Switch => connected clients regardless of wired or wireless … the key point is that all clients must be connected into the untangle filter.

RB alone cannot do it … but add-in untangle and the scene changes.

And no change on the clients, no control, no modification, no policies added/changed?
RB + Untangle gives 100% control (or close to)?

Can you give a quick description on how it does it? Does it open and examine all https package (how)?
If I search for porn in google, how does it block it?

Untangle site is not clear on how it does stuff and what is done where.
https://www.youtube.com/watch?v=KILmKRNHLYA
Does not show how its installed.
I can see that i can block Quic that are more and more used. But that are the same as block https since I do not like it. (or can not block part of it)

@Jotne
Very comprehensive how web filter works in untangle https://wiki.untangle.com/index.php/Web_Filter
This is not a quick read … to understand read slowly ….

Untangle in bridge mode
https://support.untangle.com/hc/en-us/a ... ridge-Mode

In Turkey they blocked various sites, like Wikipedia. DoH fixed access to it.
So please show me a solution that are up to 100% secure without controlling the clients.

Obviously, you did not read my post. Or, you did not understand. Then it does not make sense, to explain more details to you, regarding
blockage of DoH usage, which can be done on MT.
I did not not write, that 100% is possible. But quite close.
Of course, no need to control clients.
To be clear here: To block only porn images, this would need control of clients, and analysis of graphical images, on the fly. Impossible.
Different story for porn sites. Unfortunately, because of closed architecture of MT, this is not the best platform for it, having not all LINUX packages available.

@Jotne
Very comprehensive how web filter works in untangle https://wiki.untangle.com/index.php/Web_Filter

At first glance, part of it contains a commercial version of squid, to intercept http(s). Impossible to be done on MT, but, as I wrote already, to be done yourself on openwrt device, or small Linux box. Which must run within network of clients, and installed to "see" all traffic.
Blockage of specific http-URLs no big deal, then; intercept of https and de-crypt/ inspect/ en-crypt requires cert installs on clients, as decribed. And some ICAP-module for squid. Not so trivial, this part, though.
All the rest of the "core" functions also can be done yourself.

Intercept of https and de-crypt/ inspect/ en-crypt requires cert installs on clients, as decribed.

This is what I was looking for. Since you need to do some with the clients, this is more or less the same as how Palo Alto or Forcepoint works.
Only a solution for company that has 100% controls of their clients. Not for ISP/hotells/shops/home user that have uncontrolled clients.

Blocking DoH by IP (firewall) only possible in some degree. I can just set up an DoH server at any VPS senter and bypass it.

This also needs a dedicated IT departement. White list pages that can not be open, or should not be open like banking. TV and other devices that needs internet (Netflix) that do not handle certificates. +++

Intercept of https and de-crypt/ inspect/ en-crypt requires cert installs on clients, as decribed.

1) This is what I was looking for. Since you need to do some with the clients, this is more or less the same as how Palo Alto or Forcepoint works.
Only a solution for company that has 100% controls of their clients. Not for ISP/hotells/shops/home user that have uncontrolled clients.
2) Blocking DoH by IP (firewall) only possible in some degree. I can just set up an DoH server at any VPS senter and bypass it.
3) This also needs a dedicated IT departement. White list pages that can not be open, or should not be open like banking. TV and other devices that needs internet (Netflix) that do not handle certificates. +++

1), 3) Not shure, that you really understand: Messing around with certs only required when blocking https://_URLs_ . For ISP,/hotels/shops/home usage. blockage of porn sites good enough. I did several variants of simple clones of openDNS for various WISPs, for them not to pay royalties for commercial use of openDNS.
2) Correct. That is for the 0.01% of users, which do not fit into 100% success rate. I never wrote, that it is possible to achieve 100%.
Blocking of porn-sites good enough, usually.

We are far out of what was asked for.

Block pornographic on the Router OS.
Can be done in some degree (by setting DNS to sites that filter it). But can be bypassed with simple steps.
And for the rest. Is it possible to block some permanent. No, without doing some with all clients.

The funny part is, you consider setup of private DoH-Server to be simple.
But you do not recognise the (technical) difference between blockage of (porn-)domains, which usually is good enough, and blockage of specific (porn-)URLs.

BTW: A "clever' guy, trying to circumvent DNS based blockage, would try to use fixed IPs, instead of domain name in the URL. Like https://1.2.3.4/pornpage.html
Unless the smart implementer inhibits such usage. Not possible using RoS, of course.
The "guru" forgot to mention, or did not know.

eldoncito2019 is already goed away on 24 dic and all this is useless.

Porn is unblockable.

The only way to have only some control is not block this or that,
but on routerboard block all and permit only selected DNS and IP on specific device.

Porn is unblockable.

This is wrong generalization.
Correct is: "Porn is not 100% blockable, but 99.9%". Assuming proper knowledge and tools, of course.
MT enthusiasts should not think, the limits of RoS also apply to standard ubuntu, for example. Or openwrt.

When going down to porn blockage on URL level, instead of domain level, this needs control of clients, only regarding to https.
Which is enforced by google etc. only to make it harder to block (their) adverts. Same valid for quic.

If you still stick to your wrong generalization, pls provide "unblockable" scenarios.

Correct is: "Porn is not 100% blockable, but 99.9%". Assuming proper knowledge and tools, of course.

I would say closer to 80%, not 99.9%
Example when search for "sex" in google.com using any browser, how would you block that.
If you do not control the PC, typical a company PC, you can not block it without block all google site or remove cable.

And to repeat my self in regard to OP's question: You can only in some degree block porn using your router.
Example:
* DNS control
* Access list
* Kid control

Education are the correct way to go.

PS I did work several years with students as clients. What ever we did to control or restrict some, they did find a way around.
But telling them that miss use result in grade of their diploma, and that we monitor and see all sites visited, did help a lot.

"I would say closer to 80%, not 99.9%
Example when search for "sex" in google.com using any browser, how would you block that."
Bad example: Various methods to force "Safe Search" for bing, google, etc. For details, google "How to force safe search google".
untangle can do this; I did it several times in clones of openDNS for WISPs.
So, your 80% too low already. However, I wrote about forcing "Safe Search" before.
(Have to admit, impossible to do it on MT.)

"PS I did work several years with students as clients. What ever we did to control or restrict some, they did find a way around."
One student of CS is about 0.1% of users. Valid arg for my 99.9%

Bad example: Various methods to force "Safe Search" for bing, google, etc. For details, google "How to force safe search google".

And you are off topic again.
How do I block pornographic images in my RB?
To do what you suggest, you have to do some with the clients. This was not requested.
And to do some with the clients, you have to have control of the clients.

Am I right or am I wrong?

You are wrong, in regards regarding clients: "Force Safe Search" is possible _WITHOUT_ doing anything on the clients.
Just read the docs about it.
You are right, that this is not possible on Mikrotik, running RoS. In case, the mikrotik is running openwrt, you can do it.
Installation according to untangles "bridge mode".

... that this is not possible on Mikrotik, running RoS. In case, the mikrotik is running openwrt, you can do it.

Agree with @rextended the OP left long ago. Content filter is always a game of whack-a-mole, so nothing is going to be 100%.

But this notion that OpenWRT on same hardware has some inherent advantage at content filter is misplaced - any router has the same general problem that content filtering requires working across multiple OSI layers, but RouterOS only works at lower layers of the stack. And, if all you're using is some config on a little L2/L3 router, you really are limited in options to filter content.

But if you referencing to OpenWRT's safe-search opkg, that same approach is possible Mikrotik. It's a DNS re-write rule - that maps google.com (and all the country-specific domains too) to use the IP address from forcesafesearch.google.com instead. That is something possible with RouterOS, just require using /ip/dns commands instead of OpenWRT's dnsmasq config . There are DNS names for Bing and DDG's version of "SafeSearch" too ("strict.bing.com" and "safe.duckduckgo.com").

The approach may be better explain by OpenDNS: https://support.opendns.com/hc/en-us/ar ... e-and-Bing .

But just like all the DNS tricks, they work until they don't. And any content filtering's effectiveness is pretty subjective. But if you're going down the DNS intercept road, this would be another stop I'd imagine.

"That is something possible with RouterOS, just require using /ip/dns commands instead of OpenWRT's dnsmasq config ."
OK, I di dnot know, because I do not know RoS so well. Dropped usage of RoS for hotspots many years ago, because not the best platform for this type of app.

Sorry, I do not understand your
" ... But if you're going down the DNS intercept road, this would be another stop I'd imagine."

Set NextDns doh in routeros, force all port 53 traffic to router

(/ip firewall nat
add chain=dstnat action=dst-nat to-addresses=192.168.88.1 to-ports=53 protocol=tcp dst-port=53
add chain=dstnat action=dst-nat to-addresses=192.168.88.1 to-ports=53 protocol=udp dst-port=53)

Go to your nextdns account settings> parental control> categories > add "porn" to the blocked category, then enable "safe search" and lastly enable "block bypass methods'
this is not a 100% but will work for children and also on less knowledgeable persons.

Yes, that is the simple, general method to intercept all DNS requests, and force them to a specific server.
Thus, it can be used to force usage of own, custom DNS server to perform the porn filtering by domain, and force the safe search.
Because I do not really trust 3rd party services, which might use the DNS requests for dubious reasons ...
Such a special DNS server to be done on any Linux, incl. openwrt. Not on RoS, because not open enough for general package installs.

However, to block "https://1.2.3.4/anyurl.html", where IP 1.2.3.4 belongs to a porn site, needs some more effort.
IPsets are one method. Or squid, to always block access via IP instead of domain name.

So, coming closer to my 99.9% performance.
Still waiting for methods to circumvent the porn filter, which actually can not be handled.
Only one until now, the setup and usage of a private DoH-server. And even here, I imagine, setting up DPI might catch it after a while, because of many relatively small packets, to same IP.
To be investigated, I have to admit.

As repeatedly posted many times. Block porn with DNS helps just some. As more and more OS (IOS 14) starts to use DoH/DoT, it bypass it without any problem.

Also I have seen that devices like Chormecast that is hard coded to DNS 8.8.8.8 stops working if its redirected.

You are wrong, in regards regarding clients: "Force Safe Search" is possible _WITHOUT_ doing anything on the clients.

This solution is as far as 99.9% as it can get. Just google on how to ignore the Force Safe Search and you are done.
Or you can just change browser.

Again: Without 100% control of all clients, you can not block porn.

@reinerotto What are you trying to defend here with all this posts? That its easy to to block porn with RotuerOS?

Correct is: "Porn is not 100% blockable, but 99.9%"

Until someone changes the math, 100% is not identical to 99.9_%,
so the statement "porn is unblockable" is the only truth until,
apart from idiotic methods like turning off the power to the device or other idiotic responses,
someone comes up with a 100% valid solution.

The statement "porn is unblockable" is wrong already, when at least ONE porn site is automatically recognized and blocked.

What are you trying to prove?
Yes, you can block some with DNS, yes you can block some with IP, Yes you can block some more with Safe Search and you can even block more with control of the clients.

But not 99.9%

To get around Forced Safe search:
* Login to your Google account and disable "Safe Search"
* Use Bing search engine (this is how people find explicit content)
* Use Duckduckgo for search engine and disable "Safe Search" anonymously:

Edit:
Even here in Dubai where Porn is prohibited and they have blocked many sites, its easy to get around it.

Yes, you can block some with DNS, yes you can block some with IP, Yes you can block some more with Safe Search and you can even block more with control of the clients.

I think my reference to "whack-a-mole" requires a visual since it's in-line with @Jonte's thoughts:



But I view this question is more "How much content filtering can you do on a Mikrotik?". Answer is "something but not a lot" – full of ways to motivated user to bypass.

" ... But if you're going down the DNS intercept road, this would be another stop I'd imagine."

All I meant by "DNS intercept road" was the approach of trying to force clients to use the Mikrotik routers DNS, typically by setting DHCP to only use the Mikrotik with some mix of firewall mangle rules if you to cover more (and certainly not ALL cases). None will be even close 100% – and maybe 0% for even a lightly skilled user who wants to bypass the restrictions.

But assuming the Mikrotik has control of the DNS, it is somewhere between 0 to 99.999% effective. But to get above 0%, you're left trying expressing content filter rules based on the DNS name/IP of the site – NOT the actual data. Then with only stuff like address lists, regex-power static DNS entires, etc. that you have to build yourself (or buy, find on forum, etc.). Perhaps more firewall to add some "tls-host" firewall filters to cover at some secure/TLS/SSL cases. The Mikrotik config get complex quickly, and as such, you risk the stability of your allowed/desired traffic with complex rules/config/etc.

Depending on how much you care, this all more effective when combined with by client-based enforcement (e.g. no admin access to users, OS policies, third-party apps, etc.), company/"family" policy (e.g. some bad action will happen if you view unauthorized content), flip-side being education, etc.

And I think that my point here. Content filter is just like any other aspect of security: multiple layers are good since any one approach is unlikely to even get close 100%. Here were talking about one class of content, but the same approaches also work for doing something about malware, virus, etc. Additionally, the some of these techniques to use block... can easily be used to "log" instead. e.g. if any filter techniques is trigger/logged, there could be some administrative/parental conversation/penalty about the class of content being viewed (and logged by router) – more like a honeypot.

In some cases doing something is better than nothing is what I imagine here. And with more layers, you reduce the bypass vectors or at least make them more complex/annoying. So in this regard, [thoeritically] 50% effectiveness from a Mikrotik, when combined with 75% effectiveness of client software, doesn't actually add up to 100% – but higher than just the 75% or 50% alone. More just say there are tools on Mikrotik to mitigate some undesired content...

Whether someone want to play this game on their router – leave that decision to them...

1) Just google on how to ignore the Force Safe Search and you are done.
2) Or you can just change browser.
3) Again: Without 100% control of all clients, you can not block porn.
4) @reinerotto What are you trying to defend here with all this posts? That its easy to to block porn with RotuerOS?

1,2) Sorry, you are wrong again. The methods proposed only disable safe search, in case it is enabled in browser. Not applicable to the name server based method.
The fact, that you do not understand the difference, shows some need for "education" in this area. And might explain, why "it can easily bypassed".
3) Wrong too. For what do you need the 100% control of clients ?
4) Simply to proof, that it is possible, to block porn, without 100% control of clients. Not all porn, but 99.9%. I already wrote, that several of the required methods are not possible, on RoS, though.
And, I wanted some very qualified critics of the methods (I) used to block porn. To verify, whether any bypass possible. Until now, nothing showed up.
Regarding Chromecast, it looks like you were wrong, again: https://www.techilife.com/bypassing-chr ... oogle-dns/
The article just confirms, that redirected DNS on the routerr solves the issue. Haven't tested it myself, though, because no user complained until now.

Nevermind. Jonte totally right:

What are you trying to prove?

Perhaps write a useful post sharing your enlightened config that solves all these problems?

Maybe try to helps other who don't know as much as you... Telling people to educate themselves isn't actually educating. I don't try to enforce content policies on Mikrotik, so this isn't an issue I'm facing. But get other have different needs.

Posts #11 and #65 already give a good start. And then to use the few rules, posted here already, to redir all DNS-requests to openDNS, for example.
There are lists of the "well known" DoH-Servers on the web. Block access to them on the RB, using firewall.
Finally, implement "Force Safe Search", on RB.
Then you are very close already to %99.9
WIthout having access to the clients, assuming, RB is installed like in untangles "bridge-mode".
Feel free to reverse-DNS the porn-blacklists, and also block these IPs using IPsets. Or the RoS equivalent.

Sorry, not being an RoS user anymore, I admit not to be able to provide ready-to-use scripts.

If you are not using RouterOS, what are your doing here?

Running openwrt on certain mikrotiks, so I have the permission to be here, I assume.
However, I consider it a good idea, to correct the spreading of some wrong and bad desinformation, in case I encounter it, by chance.
To fight the degradation of software quality.

I do not spread wrong information.

Question: How do I block pornographic images in my RB?
Answer: Only in some degree. (Far from 99.9%)

You are dragging with other solutions, no me.

I do not spread wrong information.

You still did not answer my question, how you can you claim, 100% control about clients is required, to block porn.
Which I also consider, to be wrong.

Wow, just wow!

@reinerotto

To solve this discussion. Give me a VPN to a site that you control and is porn secure, and I can send you some print screen show what I can get when using your VPN. (As long as you have standard usable open net. Not all IP blocked.)

@reinerotto

To solve this discussion. Give me a VPN to a site that you control and is porn secure, and I can send you some print screen show what I can get when using your VPN. (As long as you have standard usable open net. Not all IP blocked.)

First of all, the fact, that you still did not provide an argument, why 100% control of user device is required to block porn, confirms, that you have none.

Regarding your request, it is not according to real world environment. As stated already multiple times, the RB, running the porn blocker, has to be installed in "bridge-mode".
And, of course it _ALSO_ should block the VPN ports. Besides the known VPN-server IPs. And besides some functions to block access to TOR.
All of which should not be possible only on openwrt, but RoS, as well.

Of course, when trying to get close to 100% performance, you need to invest quite some effort and knowledge.

All these "How to block XYZ" threads are so pointless.
Unless you have complete control of client devices or only allow limited access to whitelisted IPs, it's impossible to block anything.

DNS filtering? pointless, just use DoH or IP address
Restricting ports? SSTP on regular HTTPS port

You can try all you want to block TOR nodes and VPNs, but there's just so many of them popping up every day it's impossible.
I know several of these services that are used to punch holes in Chinese firewall and that requires a lot of changing IPs and making sure it really looks like regular HTTPS.
Not even China regime with entire bureau dedicated to filtering unwanted internet traffic can't stop them. So do you think you can do it better? Good luck with that!

Simply as long as you can't see what's inside SSL traffic, it's completely moot point trying to filter anything. And if you try to break or restrict SSL in some way, you break the internet.
You either have to go full "corporate big brother" way and force clients to install your certificate, so you can inspect all SSL traffic... or just give up.

The statement "porn is unblockable" is wrong already, when at least ONE porn site is automatically recognized and blocked.

Ok, again these stupid grammar games just for morons.
It's really idiotic to write this bullshit just to not know what to write.

Replace all occurencies of "Porn is unblockable" with "You can not block all porn in the world",
makes me question your sanity if you can't figure out what I meant by that "short" phrase, english or not.