Need some help please! :shock:
I use a 2920n at home and need to create the following environment:
Some family members need unrestricted access to internet (i.e. parents) and this needs no special configuration - easy-peasy
3 children need protection in terms of inappropriate websites as well as time restrictions for internet access (i.e. not between 22:00 and 08:00) and I am not sure whether - and how- this is achievable? Do I need to set them up as USERS and have them go to a sign-in page to log on every time they want to access the internet from their computers?
ALSO, they use a variety of Android and iOS devices to get online via the router and I don't know how to configure access for these? For example, I can use URL blocking for franklychat.com but how do I stop someone accessing this via their Android or iOS app? Is there a way of configuring this in the router itself?
Am I trying the impossible here or can Draytek cope with this? I've read the pdf manual for the router but it seems I need men in white coats to decipher some of the more complicated options! I've also done some searches on this forum but have not found any real answers.
Any suggestions would be hugely appreciated - thank you.

Do you or whoever it is that needs to access adult material always use the same computer and do the children never use that computer ? How old is the oldest ? ( the reason for the last question is that a 6 year old is going to be stumped. By simpler measures!). Do you want to allow only specific sites for them or just block all unsuitable?

Yes, both parents (us) use our own computers and kids don't have access to them. Youngest is 9 and oldest is 16. Just want to block inappropriate sites on their machines, mixed Apple and Win7/8 but they also use tablets and iPods to access services via apps like Frankly and snapchat and I need to be able to block these as well. How on earth does one block an app accessing the web?

Thanks for your reply!

A few pointers - you can use OpenDNS as your first line of defence for the network as a whole - and I'd strongly suggest you do so. Register (it's free) then set your router (or whatever is providing your home DNS server) to use the OpenDNS servers as it's forwarder instead of your ISP or Google etc. Then set up a basic policy filtering out the really nasty stuff. It will also catch some zero-day viruses. If you have a static IP that's all there is to it, if you don't and can get one cheaply I'd suggest you do so (some ISPs provide a static IP for a one-off charge of a few £), otherwise you also need to install an agent on a PC to keep OpenDNS updated with your assigned public IP, so that the correct filter is applied.

Next check out specialist family filtering solutions, Microsoft Family Safety or Norton Family Safety for example. If you are in the UK, you can get an information pack with lots of different options from your childrens' school. Apple devices also have some rudimentary controls built-in .

For device access, consider getting a dual-SSID capable WiFi AP (your Draytek router may already have this, if it's a WiFi model). Then you can set up one SSID (WiFi network) for your children, along with time-of-day restrictions, and a second network that runs all the time. Bear in mind that any 3G capable devices might be better on the WiFi than on cellular, though.

End point filtering is probably the best option (like Microsoft, Symantec etc).

You also need to set up an ip filter for DNS lookups, otherwise the 16 year old will just change the DNS server on his PC. Also, what does OpenDNS do for https lookups ?

Yes that's a good point (i.e. the firewall rule would be LAN to WAN, source port any, destination TCP/UDP port 53, block immediate).

OpenDNS serves the IP address of it's own 'blocked' page ( this ) for any lookup matching a set category - or other criteria - so HTTP and HTTPS (and FTP and anything else) will be caught. That also enables it to block some phishing attacks, zero-day stuff, and transparently correct some mis-typed domain names.