How router-level blocking works
Your router hands every device on the Wi-Fi two things: an address, and the DNS resolver to use. Change that resolver to one that filters adult categories, and every phone, tablet, laptop, TV and console on the network asks a resolver that refuses pornography. No app on any device, nothing to configure per person. The mechanism itself is the one in DNS porn blockers explained.
Step by step
- Pick a filtering resolver. Several public services publish "family" or "adult content" resolver addresses meant for exactly this, and some let you create an account to choose categories. Their addresses are on their sites.
- Open your router's admin page (usually printed on the router: an address like
192.168.1.1, plus a login). - Find the DNS settings, typically under Internet, WAN, or DHCP/LAN. Replace the automatic or ISP resolvers with the filtering ones. If the router has both WAN and LAN DNS fields, set the LAN one: that's the one handed to devices.
- Save, reboot the router, and on one device forget and rejoin the Wi-Fi so it picks up the new resolver.
- Test: an adult site should fail to load on every device on the Wi-Fi.
If your ISP's box doesn't let you change DNS, put your own router behind it, or set the filtering resolver on each device instead.
Door one: mobile data
The router filters the Wi-Fi. A phone that switches to 4G or 5G is on the carrier's network, with the carrier's resolver, and the router has never heard of it. One swipe in Control Center. Any router-only block on a device that has a SIM is a block for as long as the person chooses Wi-Fi.
Door two: a VPN, or a DNS setting on the device
A device can ignore the resolver the router offers. On a phone or a computer, the DNS field in the network settings overrides it. A VPN app tunnels all traffic, DNS included, to the VPN provider. Browsers with their own encrypted DNS (Chrome's Secure DNS, Firefox's DNS over HTTPS) can skip the system resolver entirely unless the resolver answers the canary that tells them not to. The router sees none of this. The full list of workarounds, and what closes each one: a porn blocker that blocks VPNs.
Who a router block is for
A router block is a good household layer: it filters the smart TV, the console, guests' phones, the old laptop nobody manages. It's the right first move for parents, and there's no reason not to do it in a house where someone is quitting.
It is not a lock for the person quitting. That person owns a phone with a SIM and knows the DNS field. For them the block has to live on the device, attached to something they can't undo on an impulse. On iPhone and iPad that's a supervised profile: the filtering DNS is set by the profile, the profile can't be removed, and adding a VPN is forbidden. Mobile data doesn't matter, because the filter is in the phone, not in the network. Setup is ten minutes once: the iPhone guide. On Mac and Windows, SELFCNTRL installs the filter as an app tied to your account, with curfews and a twenty-four-hour delay to loosen.
Layers, side by side
| Layer | Covers | Bypassed by | Good for |
|---|---|---|---|
| Router DNS | Everything on the Wi-Fi | Mobile data, device DNS, VPN, browser DoH | The household |
| Device DNS setting | That device, on any network | Changing it back, VPN, browser DoH | A quick layer |
| Supervised profile (iPhone / iPad) | That device, on any network, every app | Only a request from the account, after a delay | The person quitting |
Questions
Can I block porn on my Wi-Fi without touching each device?
Yes: set a filtering DNS resolver in the router's LAN/DHCP settings and every device on the Wi-Fi is filtered. Devices that use mobile data, their own DNS setting or a VPN are not.
Does a router block work on a phone using 4G or 5G?
No. Mobile data goes through the carrier's network, not your router. A block for a phone has to be on the phone.
My ISP router won't let me change DNS. What now?
Either connect your own router behind the ISP's box and set DNS there, or set the filtering resolver directly on each device. For the device that matters, a supervised profile sets the resolver and keeps it set.
Does router blocking keep any history?
A resolver you use answers "where is this domain?", so the resolver operator sees domain lookups. Whether they keep them depends on the service. SELFCNTRL's filtering works by category and keeps no browsing history; the privacy policy says exactly what is processed.