Router & DNS: the highest-leverage family setting

Filtering at the router changes every device on the network at once, which is what makes it the highest-leverage single setting most families can change. DNS filtering makes the router refuse to look up addresses in the categories you block, such as adult content, gambling and phishing, and it is invisible on the device itself. It does not replace per-device controls and it does not cover mobile data.

What DNS filtering does (and doesn’t)

DNS is the phone book of the internet. Filtering DNS means your router refuses to look up addresses for categories you’ve chosen to block (adult content, gambling, phishing). It’s invisible on the device — nothing to install.

What it doesn’t do: replace per-device parental controls, filter on cellular data (only WiFi), or read encrypted content.

Services to consider

• Cloudflare for Families — free. Two flavors: malware-only (1.1.1.2) or malware + adult (1.1.1.3).
• OpenDNS FamilyShield — free. 208.67.222.123 / 208.67.220.123.
• NextDNS — free up to 300,000 queries a month, then $1.99/month or $19.90/year for unlimited queries (prices at time of review, October 2026). Parental controls include category blocking, enforced SafeSearch and YouTube Restricted Mode, blocking specific apps and games, and “Recreation Time” windows when chosen sites are allowed.
• AdGuard DNS Family Protection — free public servers that block ads, trackers and adult content, and turn on Safe Search and Safe Mode where possible.

How to set it up

1. Log in to your router’s admin page (usually 192.168.1.1 or 192.168.0.1).
2. Find DHCP or DNS settings.
3. Set primary/secondary DNS to your chosen service’s values.
4. Save and reboot the router.
5. Test by visiting a known-blocked URL — the page should fail to load.

Parental controls already in your mesh WiFi app

Most mesh systems ship with an app that can pause and schedule the internet per person, so check what you already own before buying anything. Filtering and time limits are where the subscriptions start.

Eero (Amazon)

Every eero owner can use Profiles: on the eero app’s Home tab, scroll to Profiles, tap Add a Profile, name it and tick the child’s devices. From the profile you can tap Pause profile (and Resume profile) or Add a scheduled pause with a start time, end time and frequency. Content filtering is the paid part: eero Plus adds Content Filters per profile, with preset levels (Pre-K, Pre-Teen, Teen, Adult) and categories including Social Media, Chat and Messaging, Streaming and YouTube Restricted. Eero lists eero Plus at $9.99/month or $99.99/year at time of review (October 2026).

Google Nest Wifi and Google Wifi (Google Home app)

Google’s Family Wi-Fi features work with Nest Wifi Pro, Nest Wifi and Google Wifi, inside the Google Home app. First create a Family Wi-Fi group of the child’s devices. From Family Wi-Fi you can tap Pause under a group, add a Schedule with start and end times and days, and turn on site blocking by editing the group and switching on SafeSearch under “Restrict access.” Google is candid about the limits: site blocking targets sexually explicit sites and “doesn’t block sites containing violent or illegal content,” and Family Wi-Fi does not work on devices using a private or randomized MAC address. No subscription is mentioned in Google’s help pages.

TP-Link Deco (HomeShield)

Open the Deco app, go to the Parental Controls tab, tap Get Started and create a profile with the child’s name and age; the app presets rules from the age you enter. TP-Link lists basic parental controls as free. Many of the useful controls need the paid HomeShield Advanced Parental Controls subscription (30-day free trial): online time limits, “No Internet” Offtime, SafeSearch and YouTube Restricted, blocking app traffic, Family Time, rewards, and choosing specific days for the bedtime rule. TP-Link’s pages we checked did not give a price.

Netgear Orbi and Nighthawk (Smart Parental Controls)

Netgear’s free tier is thin: pause the internet across devices and assign which devices each child uses. Content filtering, daily bedtimes, scheduled internet breaks, time limits, usage tracking and website history all need Smart Parental Controls Premium, listed at $7.99/month or $69.99/year with a 30-day free trial at time of review (October 2026). To pause one device, open the Orbi or Nighthawk app, tap Device Manager, swipe right on the device and tap the pause icon. To pause everything, tap the Parental Controls tile, select the Home profile and tap pause — the Home profile covers every device on the network.

Parental controls in your internet provider’s app

If you rent the router from your provider, its app may already do the job. Every one of these controls works only on your home WiFi.

• Xfinity — Family Settings in the Xfinity app: on the Home tab, tap + > Family Settings > Set up Family Settings, name the child and assign devices. From the profile you can pause WiFi for one device or all of them, Set screentime limits for weekdays and weekends, Schedule a pause (templates include Bedtime, Homework and Dinner), and turn on Parental Controls for content. Xfinity says Family Settings are included with Xfinity WiFi Shield and Shield Select when the account and gateway are eligible. Pausing does not touch cellular data or public Xfinity WiFi hotspots.
• Spectrum — with Advanced WiFi in the My Spectrum App, go to Services > Internet, scroll to Devices on Network and tap Manage. Select a device to Pause Device or Create Pause Schedule, or build Groups to pause several devices at once. Spectrum’s app pauses and schedules; for content filtering and internet time limits, Spectrum points to the Online Safety/Parental Controls in its separate Security Suite.
• AT&T — the Smart Home Manager app offers content controls on the BGW320, BGW210, NVG599, Pace 5268AC gateways and the All-Fi Hub (CGW450): create Profiles, use Pause Internet per profile or device, and set time limits. Web and category filters need ActiveArmor advanced internet security, which AT&T says is only available with the BGW320.
• Verizon Fios — the Verizon Home app handles Parental Controls on the Fios Router (G3100), Verizon Router (CR1000A and CR1000B) and Verizon Wi-Fi Access Point (CHR30A). Verizon says they are included at no cost: scroll to Parental Controls, select Enroll for $0/month, then add a + Profile and its devices. Controls include content filters by age group or type (with Google SafeSearch and YouTube Restricted Mode), Pause Internet, schedules, daily limits and bonus time. Verizon says a VPN must be switched off on the child’s device for these controls to stay active, though pausing the internet still works.

Gotchas

• DNS-over-HTTPS (DoH): modern browsers can bypass your router’s DNS by using their own encrypted DNS. Disable DoH in kid browsers, or block it at the router level.
• VPN on the kid’s device bypasses DNS filtering entirely. Disallow VPN apps.
• Cellular data: DNS filtering doesn’t apply when the phone is off WiFi.