How to enforce a DNS filtering service

Prerequisites

The following assumes you have already installed Plucky, and that you know how to open a console window for typing pluck commands.

This guide also assumes your delay is 0 so that the commands described herein have immediate effect. If your delay is not 0, you can set it to 0 first.

pluck delay 0

Use a DNS filtering provider and lock DNS settings

The following requires Plucky v0.99.59 or newer.

Blocking “bad sites”

First, you need the IP address of a DNS filtering provider such as CleanBrowsing, Safe Surfer, or OpenDNS. As an example, the IP address to use CleanBrowsing’s family filter is 185.228.168.168.

Second, configure your computer or home router to use that DNS provider. If you’ve never done this, see CleanBrowsing’s excellent guide on accomplishing this. It’s not that hard.

Third, you must allow the specific IP. In this example, we imagine that we have configured our computer to use CleanBrowsing’s family filter at 185.228.168.168. That is the IP address we use here.

pluck + allow 185.228.168.168

Note that if you configured the DNS on your router instead of your computer, you’ll want to allow the IP address of your router instead. An example router IP address is 192.168.1.1.

pluck + allow 192.168.1.1

Stop here. Do not proceed until the IP rule has become effective or you will lose Internet.

You can verify the rule to allow the IP address has become effective by using the eval command with the IP address you specified above.

pluck eval 185.228.168.168

Once that is done, configure Plucky to block other DNS traffic. This can be accomplished using the following commands.

pluck + block port 53
pluck + block port 853
pluck + block port 5353
pluck + block port 8443
pluck + nodoh
pluck + system

Congratulations, you now have DNS-based filtering set up and enforced by Plucky!

If you do nothing else, you’ll still have images and videos blocked by default. If you want to allow images, videos, and the rest by default, read on.

Allowing everything else

If you now feel it is safe for you to allow images, video, and a few other things by default, you may do so using the following gobbledygook.

pluck - block image/
pluck - block video/
pluck - block application/mp4
pluck - block application/octet-stream
pluck - block application/vnd.rn-realmedia
pluck - block application/vnd.rn-realmedia-vbr
pluck - block application/x-bittorrent
pluck - block application/x-iso9660-image
pluck - block application/x-shockwave-flash
pluck - block application/x-silverlight
pluck - block audio/x-pn-realaudio

Alternatively, you can clear your Plucky configuration completely using the clear command (pluck clear), and then re-adding all of the rules that you added while following this guide.

Finished

There you have it.

If you find this setup works well for you, or falls short in practice, please do provide feedback.