Cons:
I'm still a long way from foolproof parental control, though I have some new ideas. Parental control without cooperation of client device is hard.
First, create a network for controlled devices. Apply a schedule to it. Problem: devices can still connect to guest network, so guest network needs a schedule too.
Unfortunately, routers don't log DNS queries — the first step towards blocking websites. Looks like there is no choice, will need to run a local DNS server. The router is responsible for redirecting external DNS queries and blocking DoT and DoH.
Step 1: block DNS-over-HTTPS (DoH). This is not easy. UDR 7 has a traffic rule to block mainstream public DoH providers, but it is not comprehensive, of course.
Test:
curl --doh-url https://cloudflare-dns.com/dns-query https://example.com
Step 2: block port 853 (DNS-over-TLS). It is encrypted, so it cannot be redirected. Clients that do not switch to port 53 will fail to work.
Step 3: redirect all port 53 (DNS) to router. (In the future, this will be changed to the DNS server.)
An additional rule is needed if the DNS server is on the same subnet. The traffic must be routed through the router so that the DNS server does not reply to the client directly! (The client will see a different src addr and may reject the packet as spoofed.)
Adding this rule means the DNS server won't be able to tell which client made the request, as they all come from the router. The fix is to put the DNS server in its own subnet.
QUIC is 'replacement' for TCP and is used for HTTP/3. It runs over UDP port 80 and 443. It uses UDP port 53 for DNS, but sometimes UDP port 443 (DoQ; DNS-over-Quic). Due to lack of support for blocking DoQ, the whole port has to be blocked.
VPN is a massive loophole. Either block well-known ports or deny all and whitelist selected ports — and do some sort of packet inspection to ensure no tunneling. This is reaching enterprise-level setup!
Mobile remains an ever loophole. The mobile device can be under parental control, but it can create a hotspot and let other devices connect to it. The only solution is to block the ability to enable hotspot.
|Network|AP|Mode|Band|Chn|Purpose| |---|+--|+--|+--|---|+--| |A|UDR 7|Router|5 GHz, 6 GHz|–|Home| |B|UDR 7|Router|2.4 GHz|1|Home| |C|AX82U|AP|2.4 GHz|11|IoT| |D|AX82U|AP|2.4 GHz|11|Guest|
Network B is for coverage. I don't like to mix 2.4 GHz and 5 GHz as I have bad band steering experience. Maybe it is better now.
6 GHz uses 5 GHz for out-of-band discovery — it is much faster.
Network C is the AP's primary network. Asus router cannot define guest network alone. I repurpose it as the IoT network because in AP mode, Asus router enforces client isolation on guest networks — no option to disable it.
Network D is a guest network. It is client isolated.
Networks C and D only have access to Internet. Only the AP is accessible from the intranet — needs explicit firewall rules.
In hindsight, I could have done the same with a pair of AX82U, which I already have.
|Network|Mode|Band|Chn|Purpose| |---|+--|+--|---|+--| |A|Router|5 GHz|–|Home| |B|Router|2.4 GHz|11|IoT| |C|Router|2.4 GHz|11|Guest| |D|AP|2.4 GHz|1|Home|
The UDR 7 has more advanced routing, though. AX82U is like a toy next to it.
Specs:
UDR 7 is a good beginner's entry into UniFi's ecosystem. No messing with separate router, switch and AP.
It costs around S$450. It is more expensive than mid-end Asus routers, but not high-end ones.
UDR 7's one con: it cannot be used as AP. If you outgrow it and buy a higher-end router, you cannot repurpose it as an AP. (Well, you can, but it is unmanaged.)
UDR 7's PoE is only sufficient to drive UniFi U7 Lite (13W). U7 Lite supports 2.4/5 GHz and has 2x2 antenna. You need U7 Pro Max to get 4x4, and it comes with a dedicated radio for real-time spectral analysis. Cool. It needs 25W using PoE+.
U7 Pro Max has been succeeded by U7 Pro XGS. 10 GbE, requires PoE++ (29W). Both have dedicated antennas for different bands and run super hot — like 60°C. They are also quite big physically.
The dedicated radio for scanning means both of them support zero-wait DFS. This is super useful if you are in a DFS-heavy zone.
UniFi APs are super expensive. It seems like an overkill to get an AP for 120 sqm — though you need a 6 GHz AP in rooms you want 6 GHz speed. Rule of thumb for 6 GHz: line-of-sight.
I reviewed and updated my WiFi settings, last changed 3+ years ago. With time, better understanding.
2.4 GHz:
|Setting|Old|New| |---|+--|+--| |Auth|WPA2|WPA2/WPA3| |Mode|N-only|Auto; disable b, enable ax| |Channel width|20 MHz|–| |Multicast rate|Auto|OFDM 6| |Beacon interval|500|400| |DTIM interval|2|–| |Preamble|Short|–| |TX bursting|Y|N| |WWM no-ack|Y|N| |Airtime fairness|Y|–| |MU-MIMO|Y|N| |Universal beamforming|Y|N| |TX power level|Balanced|–|
N-only does not include AX, but includes G — I didn't know until I checked the router's Wireless log and found I have one G IoT device. :horror: Auto -11b +ax means it allows G, N, AX. Interestingly, one AC entry shows up on 2.4 GHz. AC is supposed to be 5 GHz only.
It is not possible to set min data rate on Asus router (stock FW). Some say for N-only, the min rate is CCK 5.5 Mbps, and for Auto w/ disable 11b, the min becomes OFDM 6.
I turned off all useless functionality.
5 GHz:
|Setting|Old|New| |---|+--|+--| |Auth|WPA2/WPA3|WPA3| |Mode|N/AC/AX|–| |Channel width|80 MHz|40 MHz| |Beacon interval|500|300| |DTIM interval|2|–| |TX bursting|Y|N| |WWM no-ack|Y|N| |Airtime fairness|Y|–| |MU-MIMO|Y|N| |OFDMA|UL/DL|DL| |Universal beamforming|Y|N| |TX power level|Good|–|
I turned off all useless functionality. I reduced channel width to 40 MHz in return for some range, hopefully.
