OpenDNS Not Blocking Sites Consistently

mjmoore10 · ‎12-27-2018

I apologize if I am repeating other posts--I haven't seen answers to my questions in other threads.

My problem is that OpenDNS is not blocking adults sites consistently. My house runs multiple OSes (Windows 10, Mac OS High Sierra, iOS, and Linux/Ubuntu). OpenDNS seems to effectively block adult sites on iOS and Linux, but not on Windows or Mac. We're using Firefox as our main browser on all devices.

We have two Linksys WRT3200ACM routers running OpenWRT. One is the main router, and the other is connected by wire to the main router as a client to extend the signal. AFAIK, I have the correct DNS address info input in the routers for both IPv4 (208.67.222.222 and 208.67.220.220) and IPv6 (2620:119:53::53 and 2620:119:35::35) for every network interface (but maybe I haven't put it somewhere it should be?).

And yet...periodically, the client-side OpenDNS updater on the Windows machine says I'm not using OpenDNS. I click Update Now and it appears to, but still shows the error. But when I go to welcome.opendns.com, it says I _am_ using OpenDNS, and it won't let me navigate to the internetbadguys demo site.

But, although I have filtering set in my OpenDNS account to Custom, and definitely have Pornography set to be blocked, both the Mac and Windows machines would load pornhub.com (the Ubuntu and iOS won't).

I initially had all devices set to get DNS from the routers, but on the WIndows and Mac machines I changed the machine settings to have the OpenDNS addresses as the preferred sources for DNS. That seemed to do the trick for the Mac, but the Windows machine is still letting the "blocked" site load.

I've tried everything I can think of. Any suggestions would be much appreciated.

rotblitz · ‎12-28-2018

The problem may be that the IPv6 resolver addresses 2620:119:53::53 and 2620:119:35::35 do not come with content filtering, as clearly explained at https://support.opendns.com/hc/en-us/articles/227986667

As you have dual-stack connectivity, you need to use addresses from the following list for IPv6 instead:
::ffff:d043:dedc ::ffff:d043:dcde ::ffff:d043:dede ::ffff:d043:dcdc

If this does not solve your problem, copy & paste the complete plain text output of the following diagnostic commands to here, from the PC where it does not work:

nslookup -type=txt debug.opendns.com.
nslookup whoami.akamai.net.
nslookup www.exampleadultsite.com.
nslookup www.pornhub.com.
netsh interface ipv4 show config
netsh interface ipv6 show dnsservers

mjmoore10 · ‎12-28-2018

Dear rotblitz,

Thanks very much! That does seem to have solved the problem. I'm curious about the language on the page you link to, and wondering if you have any insight. It says "Custom content filtering cannot be set for IPv6 traffic." and then goes on to say "For users looking for an RFC-compliant DNS service that does not provide any level of filtering, the following IPv6 DNS server addresses can be used instead..." I read that (now, having missed this before) that _custom_ filtering is not available using the 2620... servers, but that standard filtering is--in other words, that my mistake was in trying to customize the filters. Is that how you read it?

If so, perhaps someone on the staff side will take notice and add a warning to the filtering page? If that isn't how you read it, perhaps someone on the staff side could clarify the language? I definitely missed the comment about custom filtering, and ended up thinking "Oh, these are the IPv6 servers that filter, as opposed to those other ones that don't." My bad, but probably not mine alone!

Thanks again. I'm grateful for your help.

mjmoore10

rotblitz · ‎12-28-2018

"but that standard filtering is--in other words, that my mistake was in trying to customize the filters. Is that how you read it?"

No, not to customize the filters, but to use resolver addresses which do not use your dashboard settings, just the OpenDNS defaults. The reason is that you cannot register your IPv6 address at your dashboard yet. However, they seem to be working on this, because it is already available in Umbrella.

If you want to contact staff, you raise a ticket, link "Submit a request" above. We other users cannot help you with changing the web interface.

mjmoore10 · ‎12-28-2018

Thanks again for further insights!