Restrict internet access for users

almizilero

Hi everyone!

I'm looking for a way to restrict internet access on a Pixel 6 running Graphene. Background is, we're handing out phones to school classes for project work. The phones should only be allowed to access the project website.
This works pretty good with a firewall app. Problem is, the app is also accessible to the kids. They could just shut it off in the app. Maybe you know a firewall app that is password protected? But even then, I guess they could just go into settings and deactivate the app or kill the VPN in settings.

So far, I didn't find a working solution. It would have to be impossible to deactivate the firewall without a password. Would it be possible to have the VPN/firewall from the Main account also be active in a Guest account? So far, I couldn't get that to work. Any other solution I'm not thinking of would be appreciated.

I think Google Family Link might work, but a) it's Google and b) I can't get it to work on Graphene anyways, even with sandboxed Google Play.

Thanks!

Dumdum

almizilero
Not an expert, but can't websites just be allowed/disallowed at the network level? Just use SIM-free phones that are logged into the school WiFi, which then is configured to only allow certain domains.

almizilero

Basically that would work, but we're at different schools all the time I I don't think we can ask them to re-configure their WiFi just for us. So we need a device-based solution.

commodore64

almizilero Hello almizilero, Just trying to clarify...is the project website publicly hosted (accessible to anyone without a VPN) or is the project website privately hosted (only accessible via VPN)?

We're at different schools all the time.

So does this mean you go to the schools, hand out these phones, then collect the phones, leave and go to the next school?

I'm just trying to understand the lay of the land here.

almizilero

commodore64
Yes, that's about it. The website is not our's, so we can't change anything there. The rest is spot on.

I'm basically looking for a solution like a firewall (I already installed one and it works like a charm for our purposes) that can't be easily deactivated by the kids by opening the firewall app and deactivating it or going into phone settings and killing the VPN (the firewall uses a virtual VPN) or by any other means that I'm not even thinking about :D

de0u

almizilero It sounds almost as if you are looking for a Mobile Device Manager (MDM). But it's not clear there are open-source solutions (or workable non-open-source ones). Maybe somebody could write one for this purpose?

commodore64

almizilero almizilero, I should have asked how many phones you're dealing with in any one particular school. I also should have asked if the school Wi-Fi you're connecting to is password protected or not. My thinking is that in many cases you may be configuring each phone for each school you go to. If you're only dealing with five phones, that may not be a big deal. But if you're dealing with 25 or 30 phones, that could be a hassle each time you go to a school.

Here's where I'm going with this and my crazy thought. If you purchased your own wireless router, you could configure all of the phones to connect to that router. You could then configure that router to use the school Wi-Fi as the default gateway. You could also restrict all traffic through your router to only go to the project website. Now, when you go to another school, you only have to reconfigure one device, your own router, to use the new school WiFi as the default gateway. This is also assuming that all of the students you're dealing with are in one room or an auditorium type environment. Even if they're not in one room reconfiguring two or three routers to connect to the school Wi-Fi instead of 25 phones might still be a little easier.

Just my crazy thinking, LOL. It sounds like you have a solution already. Hope it all works out for you.

almizilero

I think I found a good enough solution for us. I installed an app locker (XLock) to block access to apps. That actually includes setting, so I can protect everything but the browser with a password. I think that shoud do. If kids get around this, thy maybe deserve to watch some youtube ;)

N1b

almizilero not sure if it helps, but the app pinning function might do that without requiring XLock (if you're okay with the display staying on for the time of usage).