How do I block porn?

The honest bottom line is that there's no way to absolutely, positively block porn, or anything else for that matter. You can make it more difficult, and maybe that's enough, but for every approach we might consider taking there will be ways to circumvent it.

So with that out of the way, let's block some porn...

You Are The ISP

The observation that you are your son-in-law's ISP is a very good one. The very definition of the acronym is pretty clear: Internet Service Provider, and you are providing internet service.

However:

Your ISP has something you don't: equipment, and lots of it. If you were to look at what your ISP actually has in their data center, you'd be amazed at what it takes to get those digital bits to and from your computer. A high end router, for example, could easily block access to various sites. Your ISP probably has several such routers, but is it worth $10,000 or more to you to get one for yourself? Probably not.

The more traditional approach is to install parental control software on each machine that might be accessed by people you feel are untrustworthy ("idiot" or not ).

As you've indicated, even modifying the configuration for OpenDNS on each machine is not an option, so I'm certain that installing anything is even a less of an option.

So we'll head back to where the ISPs do: your router.

The approach is actually quite simple: when a computer connects to your network at boot time, it asks your router for an IP address. Along with that IP address the router also provides the IP addresses that should be used for DNS lookups (the lookups that translate human readable "ask-leo.com" into what your computer really uses to connect: 72.3.133.152).

OpenDNS

So, we configure your router to provide OpenDNS's DNS servers to any computer that connects to your local network, including that of your idiot son-in-law.

Now, unfortunately exactly how you do this will depend on your specific brand of router. For example, in the Linksys router I happen to use, it's configured in the DHCP settings:

With these settings any computer that connects to the internet through this router would use OpenDNS's service.

You'll need to make the equivalent settings for your own router, but fortunately OpenDNS's web site includes instructions for most common routers.

To enable content filtering, you'll need to set up an account with OpenDNS, and configure the types of filtering you want.

Now, there is one gotcha that I suspect is what the initial advice you received was about.

OpenDNS applies those filtering settings based on your internet IP address. In fact, it's part of what you set up when you create an account and add a "network" to the account. All the requests that OpenDNS sees coming from your network IP address are then filtered according to the rules you've configured for your account.

So what happens if your IP address changes?

This is a very common scenario for consumer internet connections, and is called "dynamic IP addressing". One day your internet connection might be on one IP address, and another day it might change. This is totally normal, and is controlled by your ISP.

You can update your IP address with OpenDNS manually, of course. However, OpenDNS does make available a small program which will automatically update OpenDNS's record of your IP address when it changes.

I'm thinking that this might be what they referred to as what you needed to install.

The missing piece is that you only need to install it on one machine - yours. Once OpenDNS understands that the internet IP address has changed for your account, its features are applied to all computers accessing sites through that connection.

So, in your situation, I do believe that OpenDNS remains the best solution - I just enabled it here on my home network's router, and all my machines are now protected.

But please, don't think of it as absolute protection. To the dedicated, there are likely ways around it.

One final caveat: what we've been talking about is web access. OpenDNS doesn't filter incoming email, so any porn spam you might be getting will continue. You'll need to investigate spam filtering solutions for that, and those are likely not things you'll be able to implement without impacting the computers involved.