Home Wi-Fi and router controls

Home Wi-Fi

This is a floor, not a ceiling. It can't see cellular data, messages, or traffic inside a VPN. Verizon says when a VPN is on, the router can no longer see the traffic, so it can't apply schedules or block specific content. Pair it with Screen Time or Family Link.

Set this in your router's app, or by changing the DNS setting on the router. Provider controls usually don't apply if you use your own router.

1. Turn on a content filter or a family DNS

   In a browser · about 10 min

   This blocks adult sites and can force SafeSearch across devices on your network, including a smart TV or a friend's phone. CleanBrowsing's Adult Filter, the lighter option, does not block proxy or VPNs, nor mixed-content sites. Pick the Family Filter for kids. Google says its SafeSearch-based Wi-Fi blocking doesn't block sites containing violent or illegal content. Prices and addresses below are from each company's page on Sep 30, 2026.

   1. Use your router's built-in filter if it has one, or set the router DNS.
   2. CleanBrowsing Family Filter (free, throttled, no support; paid plans add more categories): 185.228.168.168 and 185.228.169.168. It blocks adult sites, proxy and VPN domains used to bypass the filters, and mixed-content sites, and forces SafeSearch on Google, Bing, and YouTube.
   3. OpenDNS FamilyShield (free, no sign-up): 208.67.222.123 and 208.67.220.123. Cisco says it is preconfigured to block adult content.
   4. Cloudflare for Families, block malware and adult content: 1.1.1.3 and 1.0.0.3. Malware only: 1.1.1.2. Cloudflare offers test pages such as nudity.testcategory.com.
   5. NextDNS: free up to 300,000 queries a month, then it continues to answer like a classic non-blocking DNS service. Pro is $1.99/month or $19.90/year. Addresses come from your NextDNS account.
   CleanBrowsing filters

   Checked 30 Sep 2026

2. Set a bedtime schedule and use Pause

   On your phone · about 5 min

   Pause and a schedule are the simplest router controls, and they're free on almost every system. They only apply on your Wi-Fi. AT&T notes that when you pause internet, smart devices on mobile networks outside your network can still get online.

   1. Create a bedtime or homework schedule for each child's profile.
   2. Use Pause for dinner or when you need attention now.
   Pause Wi-Fi (Google)

   Checked 30 Sep 2026

3. Make a profile for each child and assign their devices

   On your phone · about 15 min

   eero calls profiles the foundation of parental controls. Routers identify a device by its Wi-Fi address. Apple says devices use a different Wi-Fi address for each network and might rotate it. On iOS 18 and later the choices are Off, Fixed, or Rotating, and Apple says the device chooses Fixed by default when joining a new network that uses WPA2 or stronger security. Google says Family Wi-Fi features do not work with devices that use a Private Address or Randomized MAC Address. The warning sign is the setting for your network changed to Rotating, or the network was forgotten and rejoined and the device shows up as new.

   1. In the router app, create one profile per child and assign each device they use.
   2. On your child's iPhone, keep your home network on Fixed (or Off). On Android the equivalent is usually called randomized MAC. Menu names vary by maker.
   3. Re-check the list after any new device or phone update.
   Private Wi-Fi addresses (Apple 102509)

   Checked 30 Sep 2026

4. Change the router admin password

   On your phone · about 8 min

   If your child can log in to the router, or reset it, every control disappears. Xfinity's instructions say the default admin password is on the sticker on the bottom of the gateway, and that if you forget it you can factory reset the gateway. A reset usually shows up as an outage and a re-setup prompt in your app.

   1. Change the admin password, not just the Wi-Fi password, to one only you know. Manage it from your own phone's app where you can.
   2. Put the router somewhere kids don't handle it. A factory reset is usually a physical button.
   3. Turn on new-device alerts if your router has them.
   Xfinity parental controls

   Checked 30 Sep 2026

5. Catch new or unknown devices

   On your phone · about 5 min

   eero says tech-savvy teens can work around profile settings by rotating a device's MAC address and reconnecting as a seemingly new device. The same pattern covers a secret second phone. eero's unassigned device controls are free: you can be notified when a new device joins, pause it until you review it, or put a schedule on unassigned devices. With eero Plus, content filters can also apply to unassigned devices.

   1. On eero, turn on unassigned device controls.
   2. On other routers, check the device list regularly and pause anything you don't recognize.
   eero parental controls (Jul 21, 2026)

   Checked 30 Sep 2026

6. Close encrypted DNS and iCloud Private Relay on kids' devices

   On your kid's device · about 20 min

   Chrome's secure DNS is on in automatic mode by default. Automatic mode keeps the same DNS provider your network already uses, so a family DNS filter on the router keeps working. The bypass is a custom provider: Chrome won't then default to unencrypted mode. Google says if the device is managed or parental controls are turned on, you can't use Chrome's secure DNS. Check Chrome > Settings > Privacy and security > Security > Use secure DNS, and make sure it isn't a custom provider. Firefox has turned encrypted DNS on by default for US desktop users since 2019 (Canada since 2021). Its checks only stop default-on encrypted DNS: it holds back when it detects parental controls in Windows or macOS, a canary domain (use-application-dns.net), forced SafeSearch, or an enterprise policy. It doesn't detect router filters directly, and those checks are disabled if someone sets the provider or mode manually. Lock it with Firefox's DNSOverHTTPS policy, Enabled false and Locked true. Mozilla says Locked prevents the user from changing DNS over HTTPS preferences. Warning sign: sites your filter blocks load in Firefox but not in other browsers. Android Private DNS: Bark recommends turning it off, and the Bark Phone locks it. iCloud Private Relay, part of iCloud+, protects web browsing in Safari, DNS lookups, and insecure http app traffic, so it covers the phone's DNS lookups and unencrypted app traffic, not just Safari. No Screen Time lock for Private Relay was found. Block it at the router: have DNS answer mask.icloud.com and mask-h2.icloud.com with NXDOMAIN or no error no answer. Apple devices then alert the user and use your network's DNS. T-Mobile says Apple Private Relay must be toggled off for T-Mobile content filtering to work. Private Relay isn't available in all countries.

   1. On each child's computer, confirm Chrome secure DNS is not set to a custom provider. On a Family Link device, open that screen once to confirm it isn't available.
   2. On a family computer, lock Firefox with the DNSOverHTTPS policy (Enabled false, Locked true). Mozilla's policy page explains Group Policy, a Mac configuration profile, or a policies.json file.
   3. On Android, check Private DNS (Samsung: Connections > More connection settings). Bark's guide says to turn it off.
   4. Block mask.icloud.com and mask-h2.icloud.com on your router or family DNS. Some services have a block iCloud Private Relay option.
   Prepare your network for iCloud Private Relay

   Checked 30 Sep 2026

7. Match the controls to your router, and check the price in the app

   On your phone · about 10 min

   eero Plus is $9.99/month (1-month trial) or $99.99/year (2-month trial), for Wi-Fi 6 or later eero devices. Free eero controls include profiles, pause, block specific devices, basic scheduling, limit online access, and unassigned device controls. eero Secure is the old name and is no longer sold directly. No official eero Guard product was found. Google Nest Wifi and Google Wifi include Family Wi-Fi at no documented extra charge. NETGEAR Smart Parental Controls lists profiles and adult-content filtering as base features. There's no explicit list of what stays free after the 30-day trial, so confirm in the app. SPC Premium is $7.99/month or $69.99/year. NETGEAR Armor, which is security rather than parental controls, starts at $99.99/year. TP-Link HomeShield Advanced Parental Controls is from $2.99/month or $17.99/year. Total Security Package is from $69.99 the first year and $129.99 at renewal. TP-Link says prices may vary by region and the app's price prevails. Spectrum Security Suite is included with Spectrum Internet for up to 10 computers. Security Shield is included with Advanced WiFi and Invincible WiFi. Verizon Fios parental controls are included at no cost on the G3100, CR1000A/B, and CHR30A. Xfinity's page lists Pause, Downtime, and Active Time Limits, and doesn't state a paid add-on price. Trusted Computers in the Xfinity Admin Tool bypass parental controls. AT&T content filters need ActiveArmor on a BGW320. The price isn't stated on that page. Supported gateways listed by AT&T: BGW320, BGW210, NVG599, Pace 5268AC, and All-Fi Hub (CGW450). T-Mobile's T-Life app documents no built-in parental controls. FamilyMode is a separate app and needs a HomeBase for home Wi-Fi. A current FamilyMode price wasn't captured. Check with T-Mobile.

   1. If you use your own router, use that router's controls. The internet provider's controls usually don't apply.
   2. Confirm in the app what stays on after any free trial, especially NETGEAR.
   3. On Xfinity's older Admin Tool, make sure no child device is marked Trusted.
   eero Plus

   Checked 30 Sep 2026