View Single Post
Old 06-20-2012, 05:10 AM   #14
bhaak
Groupie
bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.bhaak can program the VCR without an owner's manual.
 
bhaak's Avatar
 
Posts: 164
Karma: 164969
Join Date: Dec 2011
Device: Palm IIIx, (iPhone|Kindle) Touch
I think if your children are tech savvy enough to use the wi-fi or usbnet connections to ssh into your kindle and revert the changes you've done to get on the internet, they probably already know how to do it on every other computer in your household and you should probably encourage them to use their super powers for good and show them some open source projects where they can bring in their talents.

Most "digital natives" (I really don't like that term) aren't really that much better with technical stuff but they just use computers more naturally and just because of that know more about it than their parents who also don't often are able to spend as much time on it as kids are.

Anyway, what about using the builtin firewall capabilities of Linux for preventing internet access?

If we look at /etc/upstart/network.conf (jailbroken firmware 5.0.4) we see that on network startup, iptables reads a file with firewall rules: /etc/sysconfig/iptables

Adding some rules before the COMMIT line /etc/sysconfig/iptables should do the trick.

Spoiler:
Code:
# ICMP. Allow only responses to local connections
-A INPUT -p icmp -m state --state RELATED,ESTABLISHED -j ACCEPT

# outgoing only allowing private IPs
-A OUTPUT -d 192.168.0.0/16 -j ACCEPT
-A OUTPUT -d 172.16.0.0/12 -j ACCEPT
-A OUTPUT -d 10.0.0.0/8 -j ACCEPT
-A OUTPUT -j DROP

COMMIT

Last edited by bhaak; 06-20-2012 at 02:56 PM. Reason: updated with fixed and tested iptables rules, thanks hawhill
bhaak is offline   Reply With Quote