Router & DNS: the highest-leverage family setting
One setting at the router protects every device. Here’s the setup, the services, and the gotchas.
What DNS filtering does (and doesn’t)
DNS is the phone book of the internet. Filtering DNS means your router refuses to look up addresses for categories you’ve chosen to block (adult content, gambling, phishing). It’s invisible on the device — nothing to install.
What it doesn’t do: replace per-device parental controls, filter on cellular data (only WiFi), or read encrypted content.
Services to consider
- Cloudflare for Families — free. Two flavors: malware-only (
1.1.1.2) or malware + adult (1.1.1.3). - OpenDNS FamilyShield — free.
208.67.222.123/208.67.220.123. - NextDNS — freemium. Per-family dashboard, granular category toggles, block-list imports, daily schedules.
- AdGuard DNS Family Protection — free. Also blocks ads.
How to set it up
- Log in to your router’s admin page (usually 192.168.1.1 or 192.168.0.1).
- Find DHCP or DNS settings.
- Set primary/secondary DNS to your chosen service’s values.
- Save and reboot the router.
- Test by visiting a known-blocked URL — the page should fail to load.
Hardware parental-control routers
If you want more granular control (schedule by device, time limits, usage reports), hardware routers can help:
- Eero (Amazon) — Eero Plus subscription adds family profiles and content filtering.
- Gryphon — family-focused router with deep parental controls.
- Circle Home Plus — attaches to your existing router; per-device time limits and filtering.
Gotchas
- DNS-over-HTTPS (DoH): modern browsers can bypass your router’s DNS by using their own encrypted DNS. Disable DoH in kid browsers, or block it at the router level.
- VPN on the kid’s device bypasses DNS filtering entirely. Disallow VPN apps.
- Cellular data: DNS filtering doesn’t apply when the phone is off WiFi.
Common questions
What is the highest-leverage parental control in the house?
DNS filtering at the router. Changing one setting protects every device on your WiFi at once — children’s phones, school Chromebooks, smart TVs, Alexa, everything — with nothing to install on any of them.
Which DNS filtering service should I use?
Cloudflare for Families is free, with malware-only (1.1.1.2) or malware-plus-adult (1.1.1.3) options. OpenDNS FamilyShield is free at 208.67.222.123 and 208.67.220.123. NextDNS is freemium and adds a per-family dashboard, granular categories and daily schedules. AdGuard DNS Family Protection is free and also blocks ads.
How do I actually set it up?
Log in to your router’s admin page, usually at 192.168.1.1 or 192.168.0.1, find the DHCP or DNS settings, set the primary and secondary DNS to your chosen service’s values, then save and reboot. Test it by visiting a known-blocked address — the page should fail to load.
What does DNS filtering not do?
It does not replace per-device parental controls, it does not work on cellular data (only on your WiFi), and it cannot read encrypted content. It is a strong first layer, not a complete answer.
How do kids get around router filtering?
Three ways. DNS-over-HTTPS lets a browser use its own encrypted DNS and ignore your router — disable it in your child’s browser or block it at the router. A VPN app bypasses filtering entirely, so disallow VPN apps. And switching off WiFi to use cellular data sidesteps it completely.