Posted: Wed Dec 04, 2013 20:02 Post subject: How to block Youtube App for Android and Ipad
Hello,
Here is my problem. I got a 3-4 years old kid who love watching video content on a tablet. We have both Ipad and Android devices at home. He has figured out how to use Youtube and love to go online and watched random video. Youtube is a great media platform, but it has absolutely no language filter. I will see him watch some videos that filled with profanity and rage. I can't protect him forever from these kinds of content, but at least I want him to grow older before he are exposed to these behaviors and learn not to act like it.
I have no problems blocking youtube and its domain on youtube. However, I am having difficulty figuring out how to block the Youtube app on Ipad/Android. I can't seem to figure out which domain/ip that Youtube used for streaming.
I have tried com.android.google.youtube as a domain and it still won't work. I don't want to uninstall Youtube from the devices, since my wife will be using it. I just want to be able to block him from accessing that app during certain time block while he is awake. The only solution I can come up with is to block internet access to the device while he is awake, but it is kind of counter-intuitive.
Please let me know if anybody has a solution to this.
I think you misunderstand my problem. The problem is not learning how to block Youtube app on Ipad/Android. The problem is knowing what to block. I don't know what port, what domain, or what domain I should use to block the app. Please remember this is for the Youtube app on Ipad/Android only. Blocking the website youtube.com is a piece of cake.
Joined: 24 Feb 2013 Posts: 1634 Location: Belgrade
Posted: Thu Dec 05, 2013 8:48 Post subject:
If you wan't to block YT app on Android/iOS don't use blocking by URL/Keyword (webstr) but blocking by service because there is a L7 youtube pattern... In short, you can do it Layer7 filter. DDWRT supports L7 filtering... Simply, save this to your firewall (x.x.x.x=Static lease of your tablet, bind MAC with IP)...
I just want to be able to block him from accessing that app during certain time block while he is awake.
For this you must use AR (Access Restrictions) because it has to do with cron or iptables time module wich I couldn't find (it depends on kernel compiling)...
excuse me for my bad English. I hope this could help you to start from...
If you wan't to block YT app on Android/iOS don't use blocking by URL/Keyword (webstr) but blocking by service because there is a L7 youtube pattern... In short, you can do it Layer7 filter. DDWRT supports L7 filtering... Simply, save this to your firewall (x.x.x.x=Static lease of your tablet, bind MAC with IP)...
I just want to be able to block him from accessing that app during certain time block while he is awake.
For this you must use AR (Access Restrictions) because it has to do with cron or iptables time module wich I couldn't find (it depends on kernel compiling)...
excuse me for my bad English. I hope this could help you to start from...
Finally, I did it. After a lot of tweaking in DD-WRT, I decide to flash my router with tomato firmware. There is an option in the Access Restriction of tomato for Layer7 blocking. It is just a few click and setup and I was able to block youtube based on IP and time period. I would love to try it on DD-WRT but all the tinkering with cron and iptables did not work for me. Thank you for your suggestion.
Sir,
I also have a require that to block YouTube APP on Android devices, and my router has flashed with Tomoto Shibby firmware. Could you please give more information that how to setting in "Access distriction"??
Thanks a lot.
vi6s wrote:
Mile-Lile wrote:
If you wan't to block YT app on Android/iOS don't use blocking by URL/Keyword (webstr) but blocking by service because there is a L7 youtube pattern... In short, you can do it Layer7 filter. DDWRT supports L7 filtering... Simply, save this to your firewall (x.x.x.x=Static lease of your tablet, bind MAC with IP)...
I just want to be able to block him from accessing that app during certain time block while he is awake.
For this you must use AR (Access Restrictions) because it has to do with cron or iptables time module wich I couldn't find (it depends on kernel compiling)...
excuse me for my bad English. I hope this could help you to start from...
Finally, I did it. After a lot of tweaking in DD-WRT, I decide to flash my router with tomato firmware. There is an option in the Access Restriction of tomato for Layer7 blocking. It is just a few click and setup and I was able to block youtube based on IP and time period. I would love to try it on DD-WRT but all the tinkering with cron and iptables did not work for me. Thank you for your suggestion.
Thanks Mile-Lile provided setting for block Youtube with DD-WRT firmware. But DD-Wrt has wifi signal problem with Asus rt-n18u, my router only flash Tomoto Shibby. I saw "vi6s" to block youtube with tomoto firmware successfully, so I follow this thread here.
I noted the setting options with DD-Wrt, but steel need Tomoto options.
I've spent the whole day trying to figure out how to insert the iptables command you mentioned here, and after a whole lot of research, I was able to use Putty for SSH, gained access, and put the iptables command line into the router. Not forgetting my iPad ip replacing the x.x.x.x
NOTHING HAPPENED. It just didn't work.
I also tried to insert the command line into "Command Shell" in DD-WRT administration. Tried to save it as firewall, startup, shutdown, custom script. All with no avail.
Ok, I'm in a similar position to the original poster and I've tried running the iptables command to block youtube, as stated, firstly on my own mobile to see if it works, where I've given my device a static IP, but like the last post, nothing happens. I've tried adding the drop rule without the '-t filter' part and also to the INPUT instead of the FORWARD rule list but nothing makes a difference.
I also note that when I run iptables -L the rule doesn't seem to be listed so it doesn't look like it's even taking the rule, yet it displays no errors after issuing the command. Something I checked by adding random characters to various arguments in attempt to break the command, yet I still get no errors. I can enter 'iptables -#' and get no errors. iptables --help doesn't output anything either.
So it seems the command is not working on our routers but why not and how can we fix this? Please, can anyone help?
Joined: 24 Feb 2013 Posts: 1634 Location: Belgrade
Posted: Sat Apr 25, 2015 19:17 Post subject:
Some ddwrt routers uses nDPI instead of l7 filters... I think (but not sure) it is kernel depended. There is module called xt_nDPI... about nDPI you can read here http://www.ntop.org/products/ndpi/ and abput https (SSL) they stated:
Quote:
The trend of Internet traffic is going towards encrypted content often using SSL. In order to let nDPI support encrypted connections, we have added a decoder for SSL (both client and server) certificates, thus we can figure out the protocol using the encryption certificate.
Shortly: If you have xt_nDPI module and youtube nDPI pattern, you can block youtube very efficiently. I can confirm that with my unit 842ndV2 and latest public build 26653 this is working.
Joined: 24 Feb 2013 Posts: 1634 Location: Belgrade
Posted: Sat Apr 25, 2015 20:13 Post subject:
forget about my last post. With latest build 26653 it is not possible to block youtube with l7,nDPI filters. Devs are working on it, I reported problem... there are some missing filters... only URL blocking with webstr matching...
I just use an app locker to control which apps the kids can use. You simply put an app in the locker and they can't use it without the password. You can also block them from system settings, browsers, etc.
Or, if you can find the api domain for youtube, you can block it with dnsmasq like this: address=/api.youtube.com/127.0.0.1
(You'll need to make sure the primary dns that dhcp hands out is that of your router.)
BTW, in the browser, this dnsmasq setting will lock them to youtube's safe search.
address=/www.youtube.com/216.239.38.120
(This option will enforce it on your whole network through the browser. Although you can exempt certain hosts if you choose to.)
If they are using a seperate google account on the tablet, you can also just turn on safesearch for that particular account. I think that covers search, and youtube.
