The network layer: router, DNS and their limits

A network filter is a useful layer of protection.

It is sold as a round-the-house solution, and it is often the first thing parents set up.

It is also the layer that is least likely to follow the child past the front door.

The insight behind this page is simple:

Network filters regulate the network. They do not regulate the device.

The sentence sounds obvious when stated plainly.

It is forgotten as soon as a parent sees a blocked page on the home Wi-Fi.

The parent then assumes the same block will work at school, on the bus, or at a friend’s house.

This page explains what a router or DNS service can and cannot see, why each gap exists, and what works on the device instead [source: rfc9490-mten].

The aim is not to talk a parent out of using a network filter.

The aim is to put the filter where it works, and to stop expecting it where it does not.

This article is verified against the current state of iOS, Android, and the standards that govern home-network filtering as of 2026-08-19 [source: rfc9490-mten].

Why this matters

A network filter sits between the household and the Internet. It sees traffic that flows through it.

It cannot see traffic that does not.

A child with a mobile data plan has a route around the filter.

So does a child with a friend’s hotspot, or with a VPN on the device.

None of these routes requires any technical skill [source: saferinternet-technischer-kinderschutz].

This is not a flaw of any one product. It is a property of the layer the filter lives at.

Network filters are documented, by the providers who operate them, as ending at the front door of the network.

• BT’s parental controls help page states, verbatim: “If you’re accessing the Internet via a mobile network, BT Parental Controls cannot protect the device” [claim: saferinternet-technischer-kinderschutz].
• Swisscom documents that the Internet-Box device time-limit “applies to Wi-Fi only. The device can still access the internet via mobile data” [claim: saferinternet-technischer-kinderschutz].

These are the parents’ own providers writing the limitation down.

The article is also not a circumvention guide. The trick database in this wiki records fifteen separate network-layer gaps.

Each gap is real and worth knowing about.

Each is, in a different way, the same gap: the network filter regulating a network the device has left, or has been told to ignore.

What works in place of a network filter is a setting that travels with the device.

Each one of these travels with an account:

• A Screen Time limit travels with the Apple Account.
• A Family Link content filter travels with the Google Account.
• A profile PIN travels with a Netflix profile.
• A Restricted Mode lock travels with a YouTube account.

[source: apple-screen-time] [source: google-family-link-getting-started].

The rest of this article makes the contrast explicit, step by step.

What a network filter can and cannot see

A network filter sees packets on the wire. It does not see the device that sent them.

What a router or DNS filter does see:

• The device on the home Wi-Fi that sent a request for a domain the filter has classified.
• The destination at the level of domain name, in the clear, when the device is using the filter’s DNS resolver and standard DNS.
• The connection attempt that the filter returns an unreachable answer for.

What a network filter does not see:

• A device that has switched off Wi-Fi. Mobile data is a separate path on the cellular radio. The home router never sees the packet.
• A device on a different network. A friend’s hotspot, a school network, a public Wi-Fi at a café, or any other router than the family’s [claim: saferinternet-technischer-kinderschutz].
• An app or browser using its own resolver. Many browsers and apps encrypt the DNS request before it leaves the device. The router cannot read the domain, and the family DNS resolver is never asked [source: rfc9490-mten].
• Traffic inside a VPN tunnel. Once the tunnel is up, the router sees only the encrypted flow to the VPN provider. The destination inside the tunnel is invisible.
• Traffic inside a browser-based relay. A page reached through a proxy or a translation service has the proxy or service as its visible destination, not the underlying site.
• The identity of the user. The router sees a MAC address, an IP lease, and a hostname. With randomized MAC addresses enabled, even those identities change between connections.

The distinction between “can see” and “cannot see” is the entire reason this page exists.

Parents who set up a router filter and assume it covers their child on every network are mis-locating the protection.

A network filter is, in architecture terms, a network-layer control. Device-level controls are device-layer controls.

They are not the same thing. They do not substitute for each other [source: apple-family-sharing].

Prerequisites

This article assumes the household already has a broadband connection and a router that the parent can reach in a web browser.

A few additional items are useful to have at hand:

• The router’s admin login, usually on a sticker on the bottom of the device, or set during the original broadband installation.
• A list of the devices the family expects to see on the home Wi-Fi. This is the list to compare against on Monday morning.
• A password manager that the child cannot open. The router password and any DNS or filter credentials go in it, not on the sticker.

The article also assumes the basic device-level settings are already in place.

The next-but-one section covers them, and the linked setup pages cover each in detail.

The five steps in the next section are written for a non-technical parent.

None of them requires opening a terminal or editing a configuration file by hand.

Steps

A reasonable home-network setup does five things.

None of them requires a technical background, and none of them is a substitute for the device-level settings covered in the next sections.

Treat this as a one-evening setup.

Re-check it after any change to the broadband provider, the router, or the family’s Wi-Fi password.

1. Put the router’s own admin password under your control. The password on the sticker on the bottom of the router is the one every default-instruction tells the household to keep. Change it. Store the new one in a password manager the child cannot open [claim: saferinternet-technischer-kinderschutz].

Any router-level setting in the next steps depends on this.

If the child knows the router password, the router-side rule is not a rule.

2. Give every device in the household a recognisable name in the router. Laptops, phones, tablets, game consoles, smart TVs, anything that connects. Most routers call this the “client list” or “device list”. Rename anything that shows up as “unknown”.

The point is not the name.

The point is that you can tell, on Monday morning, which device the child used and which one was the TV.

3. Set the family DNS to a filtering resolver, on the router if your router supports it, and on each device otherwise. Cloudflare for Families, OpenDNS, and AdGuard Family each offer a small set of IP addresses that block known adult-content categories at the DNS layer [source: rfc9490-mten].

On the router, two numbers go in a field usually called “primary DNS” and “secondary DNS”.

On a phone or tablet, the setting is in the Wi-Fi configuration.

The filter is what it is. It works on this network. It does not follow the device off this network.

4. Disable the guest network if the household does not need one, or apply the same DNS and time settings to it. A guest network is, by construction, a network without the household’s parental policy. Anything the child can put on the guest SSID has, in router terms, no parent [claim: saferinternet-technischer-kinderschutz].

If the family does use a guest network for visitors, do not share that SSID or password with the child.

5. Make a list, on paper, of the five devices the child uses in a normal week. Phone, tablet, school laptop, friend’s phone, console. The list belongs next to the router.

The list is not the protection. The list is the reminder. The router protects the home network, not the devices.

Any rule the family wants to apply on every device belongs on the device or on the account, not on the router.

The five steps are complete. The home network is at its best.

The next section explains where the protection ends.

Where it stops: mobile data, VPN, DNS-over-HTTPS

Each of the following is a documented way a network filter stops being the rule.

Each is, in a different way, the device leaving the network the filter polices.

Mobile data instead of home Wi-Fi

A phone on a mobile data connection is, from the home router’s point of view, not on the network.

The cellular radio is a different path with a different operator.

Two providers document this in their own words:

• BT’s parental-controls help page states that the controls “cannot protect the device” when it is on a mobile network [claim: saferinternet-technischer-kinderschutz].
• Swisscom’s Internet-Box help page states that the device time-limit “applies to Wi-Fi only. The device can still access the internet via mobile data” [claim: saferinternet-technischer-kinderschutz].

A router cannot police traffic it does not carry.

This is the single most important structural gap, and it is the reason every other gap in this section exists.

If a rule is intended to follow the child onto the bus, into school, and into the friend’s house, it is not a router rule.

Foreign Wi-Fi and public hotspots

The same logic applies to any Wi-Fi that is not the family’s.

A friend’s phone sharing its hotspot is, from the child’s device’s point of view, a separate network.

The friend has not set up parental controls on the hotspot. The home router sees nothing that travels through it.

A school network, a café network, or any public Wi-Fi is the same pattern.

Each is its own router, its own DNS, its own policy.

VPN, iCloud Private Relay, and other tunnels

A VPN on the device moves the request inside an encrypted tunnel.

The home router sees only the encrypted flow to the VPN provider. The destination inside the tunnel is invisible.

The family DNS resolver is not asked.

Apple’s iCloud Private Relay works the same way for the same reason. So do similar privacy services.

The network operator — including the home router — is not the right place to apply a content rule when the traffic is encrypted end-to-end.

The EE network’s own content-filter documentation explicitly lists VPN and Private Relay among the conditions under which its filter does not apply [claim: saferinternet-technischer-kinderschutz].

DNS-over-HTTPS, alternate resolvers, and Android Private DNS

Modern browsers and operating systems can encrypt DNS requests.

The request for example.com no longer travels in the clear to the family’s DNS resolver.

When that happens, three things change at once:

• The router no longer sees the domain name.
• The filtering DNS resolver is no longer asked.
• The router cannot redirect the request to a block page.

The standard documents this pattern explicitly and names it as a parental-control complication [source: rfc9490-mten].

Android ships a setting called Private DNS that does exactly this.

iOS and iPadOS encrypt DNS to a resolver of the device’s choice by default.

Each can be set to the family resolver. The choice is on the device.

IPv6, Encrypted ClientHello, and other protocol gaps

Two further changes to the underlying protocols work in the same direction.

IPv6 is the modern addressing scheme that runs alongside IPv4. A router filter that classifies by IPv4 leaves IPv6 traffic unclassified.

Devices that prefer IPv6 use it whenever they can. Most current phones and laptops do.

Encrypted ClientHello (ECH) removes the server-name indication (SNI) from the visible part of an HTTPS handshake.

A router filter that classifies by hostname loses that signal.

Neither is a bypass invented by the child. Both are protocol features the industry is rolling out.

A filter that classifies by hostname or by IPv4 works with a smaller and smaller fraction of the traffic.

Guest network, randomized MAC, and other identity gaps

A device that joins the guest Wi-Fi is, by router policy, not on the parental network.

A device that randomizes its MAC address looks like a different device on every connection.

These are not exploits. They are defaults on most current devices.

The router’s view of the household is, at best, an approximation.

How to notice it stopped working

A network filter does not announce its failure. The page the parent thought was blocked simply loads.

Three signals mean the network filter is no longer the rule that is running on the device.

• The blocked page loads on cellular. If the block is in force on the home Wi-Fi but the page opens on the child’s mobile data, the block was the home router, not the device. The block stops at the front door.

• The blocked page loads on a friend’s Wi-Fi. The home router is not on that network. The block, if any, is the friend’s. If the friend has not configured one, there is no block.

• The device asks for the blocked site at all. A router filter cannot know whether the device is the child, a guest, a smart TV, or the fridge. If the device is also on mobile data or behind a VPN, the filter sees nothing.

To distinguish these from a configuration mistake:

• Test the filter from a known device on the home Wi-Fi, with mobile data turned off. If the page is blocked here, the filter is working on the home network. If it is not, the filter is not configured.
• Test the same page from the same device with mobile data turned on. If the page loads, the gap is mobile data. This is the documented behaviour, not a bypass.
• Test the same page from the same device on a hotspot from another phone. If the page loads, the gap is the foreign network.

If all three of the above show the same pattern — works on home Wi-Fi, fails on mobile, fails on a foreign hotspot — the network filter is working as documented.

It is the right tool for the home network. It is the wrong tool for everywhere else.

What belongs on the device instead

The rules that need to travel with the child live on the device or on the account.

Five layers are documented by their respective providers, and each is the right answer for a different gap.

• iOS Screen Time, configured for the child through Family Sharing on the parent’s device. Screen Time rules travel with the Apple Account, not with the network [source: apple-screen-time] [source: apple-family-sharing].

A Screen Time limit on a specific app works on Wi-Fi, on cellular, on a friend’s hotspot, and at school.

The setting does not know which network the device is on. It does not need to know.

• Google Family Link, configured for the child through the parent’s Google Account. Family Link rules travel with the supervised Google Account [source: google-family-link-getting-started].

On Android, Family Link is the supported path.

On iOS, Family Link covers a partial set of settings — Screen Time and Family Sharing remain the supported channels on iPhones.

• Carrier-level filters, where the mobile provider offers them. These do what a router filter cannot: they filter on the cellular path, in the operator’s network, for the SIM that is in the child’s phone.

Not every carrier offers them. Not every carrier that offers them covers the same set of services.

Where they exist, they are the closest the industry has to a mobile equivalent of a home-network filter.

• App-level controls and account-level PINs. Netflix, Disney+, and YouTube all attach rules to profiles or accounts, not to networks [source: apple-parental-controls].

The profile PIN and the profile-creation lock are the load-bearing settings.

A profile switch is the bypass; the PIN is the lock.

• A conversation about what the rule is for, what the rule is not for, and what to do when the rule is in the way. The configuration protects the device. The conversation protects the relationship.

A network filter is not on this list. It has its place — the home network — and that is its only place.

The Austrian Safer Internet Centre describes this layering as the documented baseline: each layer does what the others cannot [source: saferinternet-technischer-kinderschutz].

Talking about it

A network filter the child does not understand looks like surveillance. A network filter the family cannot explain becomes a lie.

It becomes a lie the first time the child walks out of the front door with a phone in their pocket.

A few ground rules help the conversation land.

• State the scope out loud. “This rule works at home. It does not work when you leave the house. That is by design, not a failure.” A child who has heard this once will not, in five years’ time, assume the home filter is a parent watching from a distance.

• State the rest of the rules. “There are also rules on your phone, on the apps you use, on your account.” The point is that the network filter is one layer, and the others exist because the network filter is not enough on its own.

• Invite the report. Children notice when a filter is wrong. A school research page blocked by a category classifier, a translation page blocked by a domain rule, a homework site flagged as adult content. These are real, and they are the reason children stop trusting the filter.

The child who is invited to report a wrong block is more likely to also report a real one.

• Do not turn the gap into a moral test. “I see you used mobile data” is not a finding. The mobile data path is a normal path, and the child’s use of it does not mean the rule was broken.

The question to ask is “what were you looking at, and was it something we have a rule about”.

The network layer is the wrong place to read intent.

• Re-check the network rules once a year. Broadband provider changes, router firmware updates, and family Wi-Fi password resets all reset the router-side configuration. The home-network filter drifts the same way every other setting drifts [source: wirecutter-parental-controls].

The article is not a complete parenting framework.

The When a setting stops working page in this wiki covers the diagnostic order for device-level settings.

Sources

Each marker resolves to a stub under Wiki/sources/ with the URL, the retrieval date, and the licence.

• rfc9490-mten — IETF, “RFC 9490 — Report from the IAB Workshop on Management Techniques in Encrypted Networks (M-TEN)”. Primary source for the architecture-level description of DNS, VPN, and other network-layer controls as parental-control surfaces.

• ofcom-age-assurance-2026 — Ofcom, “Use of Age Assurance Report 2026”. Independent regulator source on UK minors’ use of VPNs and related tools [source: ofcom-age-assurance-2026].

• saferinternet-technischer-kinderschutz — Austrian Safer Internet Centre, “Wie richte ich einen technischen Kinderschutz ein?”. The documented layered-defense guidance and the source of the verbatim provider-quoted gaps [source: saferinternet-technischer-kinderschutz].

• apple-parental-controls — Apple Support, “Use parental controls to manage your child’s iPhone or iPad”. Primary source for the account-and-device-level controls that travel with the Apple Account, not the network [source: apple-parental-controls].

• apple-screen-time — Apple Support, “Use Screen Time to manage your child’s iPhone or iPad”. Primary source for the on-device schedule, content, and limits that travel with the device [source: apple-screen-time].

• apple-family-sharing — Apple Support, “How Family Sharing works”. Primary source for the family-membership model and the device-scope of Screen Time [source: apple-family-sharing].

• wirecutter-parental-controls — Wirecutter / NYT, “The Best Parental Control Apps to Manage Screen Time”. Independent test reporting of confusing setup and intermittent re-enabling of controls that depend on multiple layers [source: wirecutter-parental-controls].

• consumer-ftc-parental-controls — U.S. Federal Trade Commission, parental-controls guidance. The documented periodic-re-review recommendation, applied here to the home-network filter [source: consumer-ftc-parental-controls].

• google-family-link-getting-started — Google Families Help, Family Link getting-started page. Primary source for the account-and-device-level controls that travel with the supervised Google Account [source: google-family-link-getting-started].

• google-android-android-wellbeing — Google Android Help, “Digital Wellbeing”. Primary source for the on-device settings that travel with the Android device [source: google-android-android-wellbeing].

[source: rfc9490-mten] [source: ofcom-age-assurance-2026] [source: saferinternet-technischer-kinderschutz] [source: apple-parental-controls] [source: apple-screen-time] [source: apple-family-sharing] [source: wirecutter-parental-controls] [source: consumer-ftc-parental-controls] [source: google-family-link-getting-started] [source: google-android-android-wellbeing]