Why router rules miss the phone

A router rule sits on the home Wi-Fi. A phone has at least three other ways to reach the Internet.

Mobile data, a friend’s hotspot, and a neighbour’s Wi-Fi are not the home network. A router rule that “covers the network” covers the home network and only the home network [source: saferinternet-technischer-kinderschutz].

The first article in this package, The network layer: router, DNS and their limits, frames the broader pattern. This page makes the pattern concrete: where the child goes, the router does not.

Why this matters

Parents who set up a router filter and assume it covers the child on every network are mis-locating the protection [source: saferinternet-technischer-kinderschutz].

The mis-location is the most common reason a parental-control plan fails quietly. The rule is in force. The page the parent thought was blocked loads. No alarm rings.

The rule was in force. On a different network.

Definition

A “router rule” in this page means any setting the parent applies on the home router: DNS resolver, content filter, time schedule, per-device pause, or per-device identity [source: www-rfc7754-filtering].

A “router rule misses the phone” describes any case where the phone reaches a destination that the router rule was meant to filter, through a network path the home router does not see [source: saferinternet-technischer-kinderschutz].

Scope

This page covers the four network paths a phone can use other than the home Wi-Fi:

• The cellular radio on the SIM in the phone.
• A hotspot from another phone or a portable router.
• Any foreign Wi-Fi: school, friend, library, café.
• Any captive portal that proxies the request through its own login flow.

It does not cover VPN, encrypted DNS, or other protocol-level paths. Those are documented in Encrypted DNS and what parents see and in VPN and proxy on a child’s device.

What the providers say in their own words

Three providers document the limitation in their own help text:

• BT Parental Controls help page states that the controls “cannot protect the device” when it is on a mobile network [source: saferinternet-technischer-kinderschutz].
• Swisscom Internet-Box help page states that the device time limit “applies to Wi-Fi only. The device can still access the internet via mobile data” [source: saferinternet-technischer-kinderschutz].
• EE Content Lock help page lists VPN, Apple iCloud Private Relay, and custom DNS as the conditions under which the carrier filter does not apply [source: saferinternet-technischer-kinderschutz].

The first two are home-network filters. The third is a mobile filter. Both quote the same structural limit: the filter does not reach the device when the device is on a different network [source: saferinternet-technischer-kinderschutz].

RFC 9076 names the underlying reason: cellular, home, work, and public networks are distinct network contexts, and a filter in one context does not follow the device to another [source: www-rfc9076-dns-privacy].

Mobile data instead of home Wi-Fi

A phone on a mobile data connection is, from the home router’s point of view, not on the network. The cellular radio is a different path with a different operator.

The home router never sees the packet. The family DNS resolver is never asked. The content filter is never consulted [source: saferinternet-technischer-kinderschutz].

A router cannot police traffic it does not carry. This is the single most important structural gap, and it is the reason every other gap in this page exists [source: saferinternet-technischer-kinderschutz].

If a rule is intended to follow the child onto the bus, into school, and into the friend’s house, it is not a router rule.

Hotspot from another phone

A friend’s phone sharing its hotspot is, from the child’s device’s point of view, a separate network. The friend has not set up parental controls on the hotspot.

The home router sees nothing that travels through that hotspot. The cellular operator of the friend’s phone is not the family operator.

The hotspot is a separate device’s Internet connection. A router rule on the family router cannot reach it [source: www-rfc9076-dns-privacy].

Foreign Wi-Fi at school, friends, or cafés

A school network, a café network, or any public Wi-Fi is the same pattern. Each is its own router, its own DNS, its own policy.

The home router is not on that network. The block, if any, is the foreign network’s [source: saferinternet-technischer-kinderschutz].

If the friend has not configured a filter, there is no filter. If the school has configured a content filter, that filter follows the school’s policy, not the family’s.

Captive portals and proxy login pages

A captive portal is the login page that appears on a hotel Wi-Fi, a coffee-shop Wi-Fi, or a conference Wi-Fi.

The login itself is a web page served from the foreign router. Until the user accepts the terms, the foreign router blocks all other traffic. After acceptance, the foreign router routes the device’s traffic through its own path.

The home router sees nothing of this. A router rule on the family side has no leverage over a captive portal.

What belongs on the device instead

The rules that need to travel with the child live on the device or on the account:

• A Screen Time limit travels with the Apple Account [source: saferinternet-technischer-kinderschutz].
• A Family Link content filter travels with the supervised Google Account.
• A profile PIN travels with a Netflix profile.
• A Restricted Mode lock travels with a YouTube account.

These settings do not know which network the device is on. They do not need to know [source: saferinternet-technischer-kinderschutz].

A carrier-level filter, where the mobile operator offers one, is the closest the industry has to a mobile equivalent of a home- network filter. EE Content Lock is an example for EE mobile customers in the UK [source: saferinternet-technischer-kinderschutz]. The filter follows the SIM, not the network.

How to notice it stopped working

A router rule that has stopped working does not announce itself. The page the parent thought was blocked simply loads.

Three signals mean the router rule is no longer the rule that is running on the device:

• The blocked page loads on cellular. The block was the home router, not the device. The block stops at the front door [source: saferinternet-technischer-kinderschutz].
• The blocked page loads on a friend’s Wi-Fi. The home router is not on that network. The block, if any, is the friend’s [source: www-rfc9076-dns-privacy].
• The device asks for the blocked site at all. A router filter cannot know whether the device is the child, a guest, a smart TV, or the fridge.

To distinguish these from a configuration mistake:

• Test the rule from a known device on the home Wi-Fi, with mobile data off. If the page is blocked here, the rule is working on the home network.
• Test the same page with mobile data on. If the page loads, the gap is the cellular path.
• Test on a hotspot from another phone. If the page loads, the gap is the foreign network [source: saferinternet-technischer-kinderschutz].

If all three show the same pattern, the rule is working as documented. It is the right tool for the home network. It is the wrong tool for everywhere else.

Talking about it

State the scope out loud. “This rule works at home. It does not work when you leave the house. That is by design, not a failure.”

State the rest of the rules. “There are also rules on your phone, on the apps you use, on your account.” The router is one layer, and the others exist because the router is not enough on its own.

Invite the report. A school research page blocked by a category classifier. A homework site flagged as adult content. These are real, and they are the reason children stop trusting the filter [source: saferinternet-technischer-kinderschutz].

Do not turn the gap into a moral test. “I see you used mobile data” is not a finding. The mobile data path is a normal path. The question to ask is “what were you looking at, and was it something we have a rule about.

Related wiki pages

The article on Encrypted DNS and what parents see covers the protocol-level paths the router cannot see.

The article on VPN and proxy on a child’s device covers the most common way children route around a router rule.

The honest limits page, What the network layer cannot do, lists the gaps the router leaves open.

Sources

• www-rfc9076-dns-privacy — IETF, RFC 9076. Network contexts and resolver privacy [source: www-rfc9076-dns-privacy].
• saferinternet-technischer-kinderschutz — Austrian Safer Internet Centre. Documented layered-defense guidance and the source of the verbatim provider-quoted gaps [source: saferinternet-technischer-kinderschutz].
• www-rfc7754-filtering — IETF, RFC 7754. Scope and efficacy of blocking [source: www-rfc7754-filtering].

[source: www-rfc9076-dns-privacy] [source: saferinternet-technischer-kinderschutz] [source: www-rfc7754-filtering]