Why a VPN beats a filter
A DNS filter, a router setting, or a filtering app all work by standing between your device and the internet and refusing certain answers. A VPN builds a tunnel from the device to the VPN provider and sends everything through it, including the DNS questions. The filter is still there; it's just no longer in the path. Nothing is hacked. You installed an app and tapped connect.
This is why "we block VPN websites" is only half an answer: blocking the VPN provider's website doesn't remove the VPN appfrom the App Store, and it doesn't stop a tunnel that's already configured.
What "VPN-proof" has to mean
There are only three real ways to make a filter hold against a VPN:
- Forbid adding a VPN at the device level. Not the website, the capability. Only the operating system can do that.
- Refuse the VPN's traffic on the network. Firewall rules that block VPN protocols. Possible on a computer you administer, or on a router; fragile, because you administer it.
- Block the category "VPN / proxy / anonymizer" at DNS level. Stops the VPN app from reaching its servers by name, on a device that still uses your resolver. Useful, but a VPN that is already connected has already replaced that resolver.
Only the first one is a lock. The other two are layers you can add on top; they don't hold on their own for the person who set them up.
iPhone and iPad: the door that can be removed entirely
Apple lets a configuration profile forbid creating VPN configurations, but only on a supervised device. On a supervised iPhone or iPad, the setting isn't hidden; it's unavailable. The VPN app installs, opens, and cannot add its tunnel. The same profile carries the filtering DNS resolver and, on a supervised device, cannot be removed from the phone: the Remove Profile button doesn't exist.
That combination is what SELFCNTRL installs on iPhone and iPad. Filtering by category, every app, every browser, private mode included; VPN configurations forbidden; profile non-removable. Loosening anything goes through your account and waits twenty-four hours. How supervision works, and what it does and doesn't do to your phone: supervised iPhone explained. Ten-minute setup: the iPhone guide.
Mac and Windows: honest limits
Neither Apple nor Microsoft offers supervision for a personal computer the way iOS does. On a Mac or a PC you own, you are the administrator, and an administrator can install a VPN, change DNS, or remove an app. A blocker that claims to be unbeatable on a computer you administer is describing a lock whose key is in your pocket.
What can be done on a computer, and what SELFCNTRL does: the filter installs as an app tied to your account rather than to a setting, it enforces safe search, it adds curfews that cut the internet on a schedule, and any loosening waits twenty-four hours while tightening is immediate. That delay is the point. A VPN you'd install at 2am is an impulse; an impulse that has to wait until tomorrow afternoon usually doesn't get acted on. Device details: Mac, Windows.
In practice, the phone is the device that's with you at night, and the phone is where the door can be shut for real. Lock the phone first.
Router-level "VPN blocking"
Some routers and filtering resolvers offer a "block VPN and proxy" category. It stops VPN apps from resolving their servers while the device still uses your resolver, and it's worth turning on for a household. It does nothing for a phone on mobile data, and nothing once a tunnel is up. See the router guide.
Side by side
| Setup | VPN app installs? | VPN connects? | Filter survives? |
|---|---|---|---|
| DNS set by you (any device) | Yes | Yes | No |
| Router with VPN category blocked | Yes | Often not on Wi-Fi; yes on mobile data | Partly |
| Mac / Windows, you're admin | Yes | Yes | Only with a delay you can't skip |
| Supervised iPhone / iPad | Yes | No — configuration forbidden | Yes |
The bet
On a device we locked, if you get the filter off by your own means, VPN included, we send you $100 on top of a full refund. Details in the refund policy.
Questions
Does a VPN bypass a porn blocker?
A VPN bypasses any blocker that works by DNS or network filtering on an ordinary device, because it replaces the resolver and tunnels the traffic. It does not bypass a supervised iPhone or iPad whose profile forbids VPN configurations: the VPN app cannot set up its tunnel at all.
Can I block VPN apps from being installed on iPhone?
Screen Time can restrict installing apps altogether, but that's a passcode you hold. A supervised profile can forbid the VPN capability itself, whatever apps are installed, and cannot be removed from the device.
Is there a VPN-proof porn blocker for Windows?
Not in the strict sense: on a PC you administer, you can install a VPN. What holds on Windows is a filter attached to your account with a delay to loosen it, plus curfews. The unremovable lock is on iPhone and iPad, and most relapses happen on the phone.
What about Tor or a proxy?
Same family as a VPN: a different path around the resolver. On a supervised iPhone, the filter is on the device and proxies fall under the same category blocking; on a computer, the answer is the same as for a VPN — the delay, not the wall.