back to article How can family sysadmins make a safe internet playground for kids?

Internet access isn't about PCs any more, and keeping an eye on one's children is tough for even the most techno-literate parent despite the plethora of tools available. It's not puritanical to want to control what one's offspring see and hear – there are things on the internet with the power to scar an adult – and while no …


This topic is closed for new posts.


  1. Arctic fox
    Thumb Up

    A thought and considered discussion of the parental/parenting challenges involved.......

    ............without the faintest sniff of Daily Fail hysteria. Major kudos for that. I look forward very much to reading what others, better qualified than I am to make the suggestions you have asked for, have to say on the subject.

    1. Richard 116
      Thumb Up

      I second that.

  2. Anonymous Coward
    Anonymous Coward


    For google requests, the best thing to do is set up a transparent proxy server with url rewriting and append &vss=1 (or it might be &vss=true) to each request.

    That's 'very safe search' and is exactly what the school network does in this area (it spans hundreds of schools). Obviously not a replacement for content filters on it's own, but it's a start.

    If you want a bit more, look at DansGuardian - a squid addon which is also used on aforementioned school network.

    1. Anonymous Coward
      Anonymous Coward


      Actually the best thing to do is educate your kids that there are some bad people out there, there's an awful lot of people who talk bollocks, and that they shouldn't consider meeting any of them in real life.

      After that just leave them the hell alone, if you've done your job in bringing them up being capable of rational thought, and not just turned them into a braindead dribbling vegetable who requires mummy to bubble wrap him before he's even allowed to go anywhere near the front door he'll be fine.

      I had internet access since I was 12, and despite any array of messed up videos, pictures, and stories having passed my eyes it hasn't stopped me achieving well over the average in life in terms of education, career, house, and a nice family.

      Really, kids don't need protecting, they just need educating about the dangers of the real world, rather than simply shielding them from it so that if they eventually do encounter something, they don't know what to do. It's the same with many things in life - the ones who start binge drinking when they hit 16 - 18 are the ones whose parents told them that alcohol was the source of all evil, rather than the ones who were allowed a bit of alcohol each new years eve and taught to enjoy it, but not to have too much.

      Keeping kids naive is the real problem, as long as you've taught them to be aware of the things that can really get them in trouble, like paedophiles, then contrary to The Daily Mail and so forth, no amount of porn, or nasty videos will turn them into a psychotic murderer - the only thing that'll do that is bad genetics, or a truly violent and abusive upbringing - at that point the internet is already the absolute least of your worries.

      Oh, and for those parents who'll inevitably tell me I'm wrong, and that little timmy needs to be sat behind a filter for his own good - here's some news for you, little Timmy already knows how to get round your filter, and if he doesn't, he knows how to get round the school's filter, and if he doesn't know that, he'll know someone with uncensored internet who he'll visit, or other kids will bring print outs or copies of content you don't want them to see into school on their phones and so forth. Either way, little Timmy will find a way to see it regardless.

      1. CheesyTheClown

        Very much agreed

        I have a 9 year old son and an 8 year old daughter who spend far more than a little time playing MineCraft and downloading endless numbers of texture packs and mods for the game. Let me start by saying that while I'm American, my wife and children are Norwegian (yes my kids are half American, but they never lived there).

        My son loves to play all kinds of different MMORPGs and he regularly logs into them. I have a few basic rules for the kids to follow.

        1) Never ever ever talk to anyone on the games unless it is one of their friends from school or one of their relatives and they're addressed directly by name. I don't care if they're in a group and running a dungeon. No talking to strangers... ever. Do it once and you'll be 20 before you play an MMO again. No problem there. They're cool with that. Never even one complaint.

        2) You've seen naked people before. At the beach, at the pool, at the park. It's natural. Lots of companies advertise on websites by providing pornographic banners. Ignore them. Again... no problem. They don't care about that crap. They're more interested in finding the latest mod.

        3) YouTube videos with swearing. There's a line between saying "Woh... Fuck.. I'm about to get fragged" and "I'm going to fuck them up the ass." If someone is abusive, move on to a different video. This one isn't appropriate for children. Again... no problem. The kids just say "Pappa... that guy talks really dirty." "Yeh guys... it's not good, one day they may or may not grow up". Best thing is, my kids don't swear... even with their friends when there's no adults to hear. And no I'm not deluding myself. They have all kinds of other bad habits (nose picking then eating being one at times) but swearing isn't one of them. Well.. unless they're singing dirty playground songs that I taught them (not real dirty... just a little).

        I can go on... but teaching your kids how to deal with the reality of society and explaining the differences between good people, bad people and how maturity can play a major role. Like how teenagers and kids will swear a lot and even try things like smoking (like their nasty old pappa does) to pretend to be cool or exert themselves in an attempt to extend their boundaries and claiming the independence. My kids understand this. They also know I plan to hate them when they're teenagers because I hate all teenagers :)

        Now... on the other hand... you can provide your kids with safe places to play... not because you fear the predators, but to allow them to have a place they feel is safer. Because of this, I run a whitelisted minecraft server, a whitelisted WoW server and also we have an XMPP server with voice support to make it so that my kids can invite their friends to play in a safe environment that even their parents will approve. The only two adults with accounts on the server is myself and my nephew who I trust completely... even if he can't be trusted not to do stupid things like split his own tongue with a razor blade, punch gigantic holes in his ears or get tattoos. While he is self destructive, he's actually great with kids.

        We often have 30-50 kids from the school playing on our servers. I would love to get my hands on a lego universe server so the kids could keep playing that now that Lego killed it. Oh well.

        But as I said... I agree with you. Frankly, I think tight assed nanny types are far less able to handle what is on the web than kids are.

        1. Olafthemighty
          Thumb Up


          That was a very reasonable and well-presented comment. Are you new here?

        2. Anonymous Coward

          I'm with you on the Lego Server thing.

          My son was crushed when they announced that they were shutting it down.

          Fat chance though. :(

        3. MahFL22

          Naked in the USA NOT !

          You don't see naked people at the beach, pool or park in the USA.

  3. Thoguht Silver badge


    Somebody once asked me if I thought it would be OK for their children to use the Internet unsupervised. I replied that it would be fine as long as they'd be happy to let them walk naked through a red light district at midnight.

    1. Mad Hacker

      That was helpful

      So this article is the equivalent of steering the kid away from the red light district, at a more appropriate time, and placing clothes on them.

    2. DJ Smiley

      Its more like walking through Somlia

      Red light districts are strongly regulated in various ways.... somlia on the other hand...

  4. Anonymous Coward

    The most important yet most ignored option...

    Its simple really; /talk to your children/.

    No matter how much high tech safety guards you put up. It doesn't even weigh up against getting your kid /the/ ultimate (restrictive) browsing tool.

    Because in the end kids can (and will!) be curious. And if they focus on something chances are very high that they'll get there eventually anyway. And when they do its better to prepare them somehow instead of simply thinking you're safe with all these devices and that "they'll find out about this when they're older, so it won't hurt them anymore".

    Sure; children deserve some kind of protection against the "heavier stuff" (whether its erotics or violence; IMO there should be no difference there).

    But at the age of 6 - 10 I also think you shouldn't continue to pretend that they live in a perfect world either. Also; /never/ EVER underestimate what they will pick up on school. I know; "My kid doesn't do that". Suuure ;-)

    Have you (dear reader) never done something at (high)school which you initially kept secret from your parents (and teachers, and, and...) ?

    1. Mad Hacker

      I think this article already assumes that...

      You are stating the obvious. I think with reading the article all you said went without saying. What the author (and us parents that do talk with their children) are trying to avoid is the accidental exposure.

    2. Ben 77

      agree, but

      completely agree - you could put in the most restrictive filters, and the next time they go and visit a friend, the filters are no use at all.

      And yet, I don't think there's anything wrong with trying to set up some tools to help - a seatbelt if you will, although I suspect there are all sorts of flaws with that analogy.

  5. Voland's right hand Silver badge

    You are either sysadmin or you are not

    If you are sysadmin then you are capable to take an old P3 box (or a new shiny low power atom), put transparent squid on it and shovel all the traffic from junior devices through a dansguardian. Just give all of his devices static leases. _NO_ direct internet access. Additionally, most of the Sonic Hedgehog clones run perfectly fine on Linux + Firefox. The days when Miniclip was all Adobe shokwave are now gone - it has all gone flash now.

    As far as tablets and such -life would have been much easier if Google was not so obstinate to deliberately omit any proxy support from Android. Yes, we understand that this is in order for location + content to match their "Do no evil, feed you some ads" business plan. Not nice though, not nice. Even Symbian used to have a proxy per connection. Considering that it is least likely for google to see the light on this any time soon (or ever) you are back to square 1 - transparent proxy on the house firewall.

    By the way, referring to the title of the article - if you cannot do that you are not a family sysadmin, you are the family muppet :)

    1. Chris 3

      You miss the point entirely

      Family Sysadmin is not a job you get by being qualified for it. It is a job that you are handed by fate irrespective of technical chops. As such, this is a pretty good article.

      1. Arctic fox
        Thumb Up

        Indeed Chris 3, that is an important part of this.

        I am the sysadmin here at Arctic Fox Towers because it is my particular enthusiasm as an amateur technophile - I am not a proff techie. We do not have any children at home (we are no longer in that age category, indeed we belong to the last generation whose children grew up before the "cyber-age" really took off) to be protected but if we did I have to admit that I have no experience of how to implement the kind of precautions that are necessary but will still give them reasonable access. Discussion and advice from pro-techies concerning this issue would, I am absolutely certain, be invaluable for people like me but who are a generation younger and *do* have kids to protect. -:)

    2. Doug Glass


      You're single and childless right?

      1. Voland's right hand Silver badge

        Re: Optional


        Wife and 2 kids :) One in the sonic abomination stage (actually slightly past it).

        So I am speaking this 100% out of experience.

        Debian (or ubuntu for the ones keen on GUIs), dansguardian, elementary squid config and voila. Job done - down to the point where you determine at what time is he allowed to play and watch iPlayer and what not.

        1. Anonymous Coward
          Anonymous Coward

          Tell us more

          Tried to do just that, way too cumbersome to implement (down to buying a Pentium3 SFF box, and later using a VM), though don't mind the odd unix command. Did I use the wrong versions/packages or is this for unix admins only?

          1. Arrrggghh-otron

            Try smoothwall and Dansguardian

            Take an old PC, put two or more network cards in it, install Smoothwall. Put the box between the router and the internal network.

            Then install the Dansguardian home brew mod (it isn't difficult - the instructions are pretty easy to follow) and hey presto transparent proxy that does content filtering on the content of web pages.

            It isn't fool proof and any kid with interweb smarts could get round it without too much trouble... but for the most part it does the job.

            1. Martin

              Or, even easier...

              Old PC, two network cards and install Endian community.


    3. Jean-Luc Silver badge
      Thumb Down

      @You are either sysadmin or you are not

      Wow, can't make up people like you.

      Ever heard of "attack trees"? Aka weakest links. If your kid wants to access uncensored internet, they will. At a friend's home, at a cafe, whatever. So, after all your "alpha geek" (more "self-important twat", IMHO) posturing, what have you achieved? Probably not as a much as one would by just talking to one's kids.

      Besides, this article is plenty relevant to those of us who are not geniuses, unlike yourself, but happen to want to know more about this stuff, without delusions of grandeur. Good article, and generally intelligent comments, certain wankers excepted.

      Myself? Moving to the net hasn't changed the overall picture much, it's still mostly about communication and common sense. More busy justifying to my daughter (12) why she won't have a FB account till she's 16 or so - too much scope for permanent embarrassment - rather than being paranoid about stalkers and web contents. Talk to strangers, if you wish. Just don't agree to meet them in RL. Google Safe Search is plenty good for me, even if it can be turned off. And so is using device in common areas. Really though? I believe my kids will see filth sooner or later, better equip them to deal with it mentally, rather than pretending I can prevent it entirely.

      Still, appreciate the heads up on what choices are out there.

  6. Anonymous Coward

    tricky stuff

    My kids have their own pc with separate logins, already set up opendns and added winblows live family filter, done the google/you tube stuff, also have dd-wrt on router and block keywords and also moshimonsters (kids started chatting with people they didn't know in real life), I also monitor what they are doing and ask them quite a lot, their computer is in front room and next to mine so it would be difficult for them to go on anything unsuitable. Eventually they will have machines in their rooms for homework etc and at that point I'll set up a machine with a linux firewall/server and filter through that.

  7. Ken Hagan Gold badge


    "One imagines that once the children can configure their own DNS then they're probably old enough to cope with the consequences."

    Small nitpick, whilst we're collecting requirements for this project. -> Once the *oldest* child can configure their own DNS, you'd better hope that the youngest child who has access to the same device can cope with the consequences.

    1. El Zed

      Transparently redirect all requests

      to the DNS server on your firewall box.

      Then, it doesn't matter what tricks the little darlings learn from their friends at school...

      Seriously, anyone with children should expect to engage them eventually in a battle of 'cyber' wits when they reach a certain age, just worry when they stop asking you questions about the firewall (usually means they've found a way to bypass it, at which point, congratulate them - especially if your firewall is of the BOFH level-of-deviousness persuasion - and let them get on with it).

    2. gort
      Big Brother

      To block alternate DNS, on your firewall/router, block all outgoing access to DNS (UDP port 53) to all servers, forcing everyone on the LAN to use your router's DNS. On a good firewall you can add exceptions to allow specific devices access to other DNS.

      1. Anonymous Coward
        Anonymous Coward

        Devil in the detail

        Can you mention routers doing that, all the ones I have looked at are light on config, and even what they have is poorly implemented (like my D-link's useless schedules, or poor filtering options).

        1. Anonymous Coward
          Anonymous Coward

          Tomato on a WRT54GL is good for faffing with firewall/DNS etc. Much less bloated than DD-WRT and immensely stable (I've never manually rebooted it in 3 years, only goes down if the power goes down):

          Also runs on many other routers (list here:


          Only one D-link listed there though.

  8. Ken Hagan Gold badge

    Outgoing content

    And another thing...

    Most of the article focuses on blocking incoming nasties, but El Reg carries stories every few months about some clot who has made their own video nasty and unwisely posted it to the waiting world (either by internet or phone). Is that a sufficiently serious risk that it is worth blocking outgoing content? Or do you just grab 'em by the lugs when they're young and force them to read *every* such story on El Reg until the hard-won experience of others sinks into their heads.

  9. Anonymous Coward
    Anonymous Coward

    The internet is a pretty large place

    So the basic approach would center on keeping an eye on type supervision. There's no reason why kids should have 24/7 access to, well, the world. I mean, approach the extra tech as enablers to allow you-the-parent a bit more rest while giving the kids more access. In the absence of that, well, less access. Go read a book or draw a picture or something.

    The rest is gravy really. But no less useful gravy for all that. Just wanted to set a base line. You set the rules, so you can rule that without you around access will be restricted. Simple.

    Way back when I didn't have unrestricted access to the telly either; had to pick and choose from the tv guide and we got to watch only that. Ok, maybe the next programme too, but oftentimes not. If the kids aren't old enough for that, then maybe pure whitelist/supervised only is all they're ready for.

    A home router with filtering proxies (often squid) and packet filtering (whatever the system provides) and stuff goes a long way. Custom DHCP* and related tricks make it selective on the client. Probably need a bit more power than the usual all-in-one jobs, but if you can stick a custom firmware like openwrt on it, you suddenly have a lot more options, especially if you can easily add extra storage, eg via usb, to hold software and blacklists and such. This might be turned into an appliance, even.

    You still need "lists of badness" to block, but those are probably also available, perhaps for a price. Or you go the whitelisting route. You can even block access entirely during sleepy time, and why not expand that to a strict whitelist during unsupervised time, to be expanded when you are around for the requisite shoulder surfing.

    Though google and such could do a far better job of catering to families --especially telcos treating everybody as a child until proven otherwise through a credit card is so horribly wrong on so many levels-- what's possible is far less important than what you want to achieve. If shielding is important and no technology available, then no access. It's nearly that easy. The snags are more with harmonising your decisions with your kids' friends' parents than anything else.

    * The ISC dhcpd is flexible enough, dnsmasq may or may not be for your purposes.

  10. Anonymous Coward
    Anonymous Coward

    On an unrelated note...

    ... a rather well-known TV presenter over in the Netherlands is of American descent; her parents decided they'd rather have their kid grow up in Europe. Growing up multilingual has its own advantages, though moving to a foreign country just for that purpose is clearly not for every parent, but it did get me thinking about whether sizing down the "internet space" by switching to a language with a smaller body of speakers might be useful for this purpose. Not very practical, I know; I didn't manage to make a cogent point out of the thought, but I wanted to toss it out anyway. So there. Ideas? Comments?

    1. Anonymous Coward
      Anonymous Coward

      You're nuts!

    2. Richard 12 Silver badge

      Gotta pick the language carefully!

      Picking a different mother tongue for your offspring is a fairly difficult task, I think I may have managed to simply double my kids exposure by ensuring they'll speak both Spanish and English.

      - It also turns out that Spanish was a very bad choice anyway, having just got back from visiting my inlaws in Latin America...

  11. clanger9

    ISP filtering?

    The principle of "talk to your kids" seems like the best approach, but (dammit) they will still click on links that are best left unclicked.

    TalkTalk's HomeSafe (the horror!) seems to provide a useful safety net for a house with younger kids in. The blocking is crude and not 100% effective, but friends and family seem to like it when I set it to block the worst stuff (in conjunction with OpenDNS).

    I presume BT have a similar service but I've not played with it.

    I'm not convinced this is the complete answer, but then again I don't have kids.

  12. Graham Wilson

    Damned if I know.

    Fundamentally, I'm against censorship but I'm damned if I know what you do here.

    By today's standards, I had a very innocent childhood (and in hindsight I'm very glad I did).

    ...But I'm absolutely certain that if I'd had the internet back when I was a kid and I'd been subject to parental controls/censorship, then--even before the age of 12--I'd have hacked my way through to all sorts of naughtiness (the temptation to check out banned stuff would've been overwhelming).

    Even if some kids can't bypass parental controls at home, then they'll almost certainly see what's banned on their mates' iPads.

    Perhaps, unfortunately, it's just inevitable that kids of today will lose their innocence considerably earlier than we did.

    1. Anonymous Coward
      Anonymous Coward

      Censorship? Recall we're talking children, not adults here.

      In a general sense I'm with you on the censorship. The general problem with censorship is exactly that it means someone else (the state, some telco, a quango, some pressure group, you name it) makes decisions for you where you should be able to make them yourself. If you choose to follow someone else's lead (eg. religion) then that's up to you. Once people who are otherwise supposedly adults capable of making their own decisions (disregarding people that are euphemistically more than a little slow for the moment) are treated like they're not, especially systematically so, you know you're in for a treat.

      In the specific case of parents taking decisions for their children, though, well, that's fairly necessary, accepted, and naturally limited. Once you reach majority, you can walk away and never come back should you wish to do so. As a parent you're responsible for the welfare of your children, but as part of that deal you have a say in what access they have.

      And then there's that the rules you'd set for a six year old are a little different from those for a 12 year old. Kids grow up and progressively can deal with more. The rules for adults in a supposedly free country don't really compare; Why would the rule makers know better than the rest? (Usually it turns out they don't, in fact, they're just highly opinionated. As am I, but I don't force it down on everybody else.) Children need the help, they're still growing up, and that's one of the things a parent needs to provide. Once they're old enough, well, then they can remove or even set up the filters themselves if they'd wish to do so.

      So a large part of the censorship debate is indeed that some people insist everyone including all adults be treated as unable to make their own decisions, which to me clearly is nonsensical, insulting even. That doesn't mean that parents shouldn't care what they let their (own) children come in contact with. They should, it's their job.

      Did that help you?

  13. Anonymous Coward
    Anonymous Coward

    My kids have 2 ways to get on the net. Firstly is supervised access using either my or my wife's computers. They also have an old laptop which they have non-sudo accounts on. This is set up with dansguardian such that if the daemons aren't running, they have no internet. It's not perfect and seems to need me to login to restart squid occasionally but it's not bad.

  14. Anonymous Coward
    Anonymous Coward


    Kids will always work out how to circumvent any filtering. I have used a free program called K9 for their PCs and its pretty damn good, but the rule in our house its that the parents hold the right to random checks of all their devices. Not because we don't trust them, but we have found improper video on mobiles which has most likely been transferred via bluetooth in the playgrounds.

    1. Peter H. Coffin

      Additionally, "safe spaces" become magnets for those that wish to do harm, more so than hanging around places where harm is known to be. The harder one works to create the safe space, the more attractive it is.

  15. Christian Berger Silver badge

    What I wonder

    What kind of benefit does a 6 year old have from the Internet? After all at that age you typically cannot read yet. I mean the Internet is all text.

    You can play games locally, at least on Linux.

    1. Peter H. Coffin

      Are you kidding? Half my first year class could read. Some of them were reading at the level of twelve-year-olds.

      1. Christian Berger Silver badge

        @6 year olds can read

        I seriously didn't know that, when I was 6 years old it was unusual to be able to read at that age.

        1. Ken Hagan Gold badge

          @Christian Berger

          I'll take a guess that you grew up in a country that doesn't start *formal* education until 6 or 7. Most of the people here probably started formal education in the school year containing their fifth birthday, but that's just the UK for you.

    2. fatal
      Big Brother

      My 6 year-old can read, why can't yours?

      My 6 year-old daughter can read perfectly well and so could her brother when he was 6. They've both been using the internet since they were about three. is a great site and they rarely ever wanted to try anything else. Of course, now they have heard about bin weevils and moshi monsters from school friends and moved on to them. They also like youTube for drivel like Annoying Orange and BBC iPlayer for endless repeats of Doctor Who and Danny's House.

      They know there is porn and "bad people" out there, but so far we've been fortunate that they haven't explored those possibilities.

    3. Lamont Cranston

      Oh, dear.

      My five year old can read, and is quite capable of firing up firefox when he feels like it (or clearing all the icons from my desktop, mucking up my widgets, or whatever), and gets a lot out of sites like CBeebies, Sesame Street, and You Tube. He can't load the sites for himself (yet) but he can successfully navigate them without assistance.

      My three year olds aren't at that level, but they can both play the games on the CBeebies site, without any assistance.

      I don't know what world it is where 6 year olds cannot read, but in this one, pre-schoolers learn basic mouse skills.

      I can look back and laugh at my father's inability to use the family VCR, but I really do worry about my ability to effectively regulate my own offspring's internet experience.

    4. Cheshire Cat

      You clearly dont know 6 year olds.

      Of course a 6yr old can read; mine can read just fine, as can most of her class. And the Internet has not been mostly text for many years...

      My worry is when they get onto youtube and start clicking about looking for Peppa Pig episodes, and find some abomination that some little scrote uploaded with a smug comment that "its yor own fault if yor kids see this your not suppervising them ha ha" (spelling errors included). Fortunately I was with them and stopped it quick, but when someone goes out of their way to conceal the fact that 20 seconds into the innocent clip Peppa Pig gets her head blown off it is hard not to throw your hands in the air and block youtube entirely.

    5. Anonymous Coward
      Anonymous Coward


      My 3 1/3 year old belts around cbeebies, know how to get to cbeebies iplayer and maximise the display to full screen. Has a vtech innotab which she boots and chooese what she want to do.

      Granted she can't "read" yet, but she can reconise words.

      If she can't read by 6, I REALLY want to know what has gone wrong. Maybe the fact whe spend at LEAST 30 minutes a day reading with her may be the key, along with going to preschool.

      BTW I read Lord Of the Rings trilogy at 9, so I doubt 6 is "normal" for learning to read.

  16. h3

    Opera mini is the way past any internet filtering on mobiles.

    I am glad my parents were not so prudish (never card what I looked at and afaict I am none the worse for it).

    No way I would do random checks of anything its wrong. (Same way them looking through the parents stuff is).

    I would rather teach them that the big brother attitude unequivocally and without exception.

    (The european attitude towards nudity and sex is far better than the American one we seem to be emulating).

    1. Anonymous Coward
      Anonymous Coward

      The desktop version of opera also has the same webpage compression ability, which is what works so well for avoiding censorship. It basically acts as a high speed proxy server.


This topic is closed for new posts.

Biting the hand that feeds IT © 1998–2019