Content filtering - how to enforce at home

Hi,

I am trying to attach small filtering "appliance" in home environment. From
user perspective it is a proxy server and firewall with IP address A on LAN
side. WAN side connected to DSL/cable modem (CPE). All traffic other than
restricted web categories shall be allowed. CPE DHCP  turned off, allows
only "appliance" MAC address.

Scenario 1. Web proxy (A) enforced on workstation.

Scenario 2. CPE or firewall blocks 80&443 from sources different than "A".
"Appliance" is in transparent mode, because all workstation users can modify
proxy settings. Disadvantage - only ports 80 and 443 are filtered - filter
can be bypassed using Internet-based proxy.

Scenario 1a. Smart 7 years young hacker replaces "appliance" with some
non-filtering proxy, using the same IP. How to avoid this hack?

Scenario 2a. Smart 7 years young hacker clones "appliance" MAC and connects
dorectly to CPE.How to avoid this hack? 802.1x?

Scenario 2b. CPE is provider-managed - in my case cable modem acting as a
bridge. No mac filtering. Any connected DHCP client gets online. Anything
else than physical lock will help (connecting cable modem with "appliance",
setting up appliance as DHCP server, both boxes secured with key in
enclosure)?

Is there any software based solution that could do the job?

Specifically, tamper proof network driver acting as ICAP client (I could
install filter with ICAP server in remote location).

Wieslaw

_______________________________________________
firewall-wizards mailing list
[email protected]
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards