Why the Home Network Is the First Line of Defence

Every device your children use — their laptop, tablet, phone, games console, smart TV — connects through your home network before it reaches the internet. That makes the network itself the most powerful control point you have. A filter on one device can be bypassed by switching to another. A filter at the network level covers everything.

This guide walks through four layers of protection that work together: securing the router, filtering DNS to block harmful content before it reaches any device, segmenting the network so children's devices are separated from your own, and scheduling internet access so the connection itself switches off at bedtime. None of these steps require specialist knowledge. If you can log into your router, you can do all of this.

Step 1: Secure the Router

Your router is the front door to your home network. Most people never change its default settings. That is the first thing to fix.

Log Into the Router

Open a browser and go to your router's admin page. The address is usually 192.168.1.1 or 192.168.0.1 — it is printed on a sticker on the router itself, along with the default username and password. Common defaults are admin / admin or admin / password.

If you are using the router supplied by your internet provider, the admin credentials are often on the sticker on the back or bottom of the device.

Change the Admin Password

The very first thing to do is change the router's admin password. This is not your Wi-Fi password — it is the password that controls access to the router's settings. If your children know it, they can undo every control you put in place.

Choose a strong password and store it in a password manager. Do not write it on a note stuck to the router.

Update the Firmware

Router manufacturers release firmware updates that fix security vulnerabilities. Check the router's admin panel for a firmware update section and install the latest version. On most routers this is under Administration, System, or Advanced Settings.

If your router has not received a firmware update in more than two years, consider replacing it. An unpatched router is an open door.

Set a Strong Wi-Fi Password

Your Wi-Fi password should be long — at least 16 characters — and not something guessable. A passphrase of four or five random words works well: correct horse battery staple is the classic example, but use your own. Change it from whatever the default was.

Use WPA3 (or WPA2 at Minimum)

Your router's wireless security setting should be WPA3 if your devices support it, or WPA2 if they do not. Never use WEP or WPA — both are broken and can be cracked in minutes. The setting is usually under Wireless Security or Wi-Fi Settings.

If your router only offers WEP or WPA, it is too old. Replace it.

Disable WPS

Wi-Fi Protected Setup (WPS) is a convenience feature that lets devices connect by pressing a button or entering a PIN. The PIN method has a known vulnerability that allows attackers to brute-force their way onto your network. Disable WPS entirely. The button is not worth the risk.

Disable UPnP

Universal Plug and Play (UPnP) allows devices on your network to automatically open ports on the router. This is convenient for gaming and media streaming but it also allows malware to open ports without your knowledge. Disable it. If a specific game or application needs a port opened, open it manually — this is called port forwarding, and it is in your router's settings under NAT or Port Forwarding.

Disable Remote Management

Some routers allow administration from the internet — not just from within your home network. This should be turned off. It is usually labelled Remote Management, Remote Access, or WAN Access in the admin panel. There is no reason for anyone outside your home to access your router's settings.

Step 2: DNS-Level Content Filtering

DNS (Domain Name System) is the phonebook of the internet. When your child types a web address or clicks a link, their device asks a DNS server to translate that name into an IP address. By changing which DNS server your network uses, you can block entire categories of content — pornography, malware, gambling, violence — before the page ever loads.

This is the single most effective protection you can put in place. It works on every device connected to your network, including devices that have no built-in parental controls: games consoles, smart TVs, older tablets.

Option 1: Cloudflare for Families (Simplest)

Cloudflare offers two free filtered DNS services:

Block malware only:

Primary DNS:   1.1.1.2
Secondary DNS: 1.0.0.2

Block malware and adult content:

Primary DNS:   1.1.1.3
Secondary DNS: 1.0.0.3

Log into your router, find the DNS settings (usually under Internet, WAN, or DHCP settings), and replace the existing DNS servers with the Cloudflare addresses above. Every device on your network will now use filtered DNS.

This is the fastest option to set up. It takes two minutes and requires no account.

Option 2: OpenDNS Family Shield (Simple, No Account Needed)

OpenDNS Family Shield is a free service from Cisco that blocks adult content:

Primary DNS:   208.67.222.123
Secondary DNS: 208.67.220.123

Set these in your router's DNS settings exactly as with Cloudflare. Family Shield has no dashboard and no customisation — it blocks adult content and that is all. For many families this is enough.

Option 3: NextDNS (Customisable, Recommended)

NextDNS is the best balance of simplicity and control. The free tier handles up to 300,000 queries per month, which is enough for most households. The paid plan is roughly two pounds per month and removes the limit.

Sign up at nextdns.io and create a configuration. NextDNS gives you:

Once configured, NextDNS gives you DNS server addresses and setup instructions for your router. Set them in the router's DNS settings as with the other options.

NextDNS also offers apps for individual devices if you want different filtering profiles for different family members — stricter for younger children, lighter for teenagers.

Option 4: Pi-hole (Advanced, Self-Hosted)

Pi-hole is a DNS sinkhole that runs on a Raspberry Pi or any Linux machine on your home network. It intercepts DNS queries and blocks domains that appear on its blocklists. Pi-hole gives you complete control and visibility, but it requires more technical setup.

Install Pi-hole on a Raspberry Pi or a spare machine running Ubuntu:

curl -sSL https://install.pi-hole.net | bash

During installation, select your preferred upstream DNS provider. After installation, set your router's DNS to point to the Pi-hole's IP address.

Add blocklists for adult content. Several community-maintained lists exist — search for "Pi-hole adult content blocklist" for current options. The Steven Black unified hosts list is a good starting point and includes categories for porn, gambling, and malware.

Pi-hole's dashboard at http://pi.hole/admin shows every query made by every device on your network in real time. You can see exactly what your children's devices are connecting to.

Preventing DNS Bypass

A technically inclined child can bypass DNS filtering by changing the DNS settings on their own device to use an unfiltered server like 8.8.8.8 (Google) or 1.1.1.1 (Cloudflare). Prevent this with a firewall rule on your router.

Most routers with custom firmware (OpenWrt, DD-WRT, pfSense, OPNsense) allow you to create a firewall rule that redirects all DNS traffic (port 53) to your chosen DNS server, regardless of what the device requests. Some consumer routers also offer this under Access Control or Firewall Rules.

If your router supports it, add rules to:

On a router running OpenWrt, the firewall rules look like this:

# Redirect all DNS to Pi-hole / NextDNS
iptables -t nat -A PREROUTING -i br-lan -p udp --dport 53 -j DNAT --to 192.168.1.2:53
iptables -t nat -A PREROUTING -i br-lan -p tcp --dport 53 -j DNAT --to 192.168.1.2:53

# Block DNS-over-TLS
iptables -A FORWARD -i br-lan -p tcp --dport 853 -j DROP

Replace 192.168.1.2 with the IP address of your DNS server (Pi-hole or the router itself if it handles DNS).

This is an advanced step. If your router does not support custom firewall rules, the DNS filtering still works for devices that have not been manually reconfigured — which covers most children's devices, especially games consoles and smart TVs that do not expose DNS settings.

Step 3: Network Segmentation

Network segmentation means putting different types of devices on different networks so they cannot communicate with each other. This achieves two things: it isolates children's devices from your work devices (so malware on a child's tablet cannot reach your work laptop), and it lets you apply different rules to different networks.

Separate Wi-Fi Networks

Most modern routers support multiple SSIDs (Wi-Fi network names). Create separate networks:

On consumer routers, look for Guest Network settings. Some allow you to create a guest network that is automatically isolated from your main network. Use this for children's devices if your router does not support multiple SSIDs with individual settings.

On routers that support VLANs (most prosumer and business routers, plus consumer routers running OpenWrt), create separate VLANs for each network. This gives you proper isolation at the network level.

Apply Different DNS to Different Networks

If you use separate SSIDs or VLANs, you can assign different DNS servers to each network through DHCP settings. This lets you use strict filtering on the children's network and lighter or no filtering on your own.

On a router running OpenWrt or pfSense, each DHCP scope can specify its own DNS server. On consumer routers, this is less common — the DNS setting is usually global. In that case, use NextDNS with per-device profiles: install the NextDNS app on your own devices to use an unfiltered profile, while the router-level DNS serves the filtered profile to everything else.

Step 4: Schedule Internet Access

Children do not need internet access at three in the morning. Most routers allow you to schedule when Wi-Fi is available, or when specific devices can access the internet.

Router-Level Scheduling

Look for Access Control, Parental Controls, or Access Schedule in your router's admin panel. Most routers allow you to:

If your router does not have scheduling, NextDNS offers time-based rules that achieve the same thing — block social media and gaming during homework hours, allow them in the evening, block everything at bedtime.

Managing Screen Time Expectations

A hard internet cutoff at bedtime is more effective than trusting a child to put the device down. When the Wi-Fi stops working, the argument stops too. Set the schedule, communicate it clearly, and enforce it consistently. The router does not negotiate.

For younger children, physically collecting devices at bedtime and charging them in a common area (the kitchen, a hallway shelf) removes the temptation entirely. The network schedule is the backup in case a device is missed.

Step 5: Keep Your Router's Device List Clean

Periodically review the list of connected devices in your router's admin panel. Most routers show this under Connected Devices, DHCP Clients, or Network Map. Look for:

Some routers let you assign friendly names to devices (e.g. "Ella's iPad", "Living Room TV") so you can recognise them at a glance. Take ten minutes to label everything.

Step 6: Secure IoT Devices

Smart speakers, cameras, baby monitors, smart TVs and other IoT devices are notoriously insecure. Many ship with default passwords, receive infrequent firmware updates, and communicate with servers you have no control over.

Put all IoT devices on a separate network (the IoT SSID from Step 3). This means that even if a smart device is compromised, the attacker cannot reach your computers, phones, or children's devices.

Change the default password on every IoT device. If a device does not allow you to change its password, consider whether you trust it on your network.

Disable any features you do not use. If your smart TV has a microphone and camera and you do not use voice commands or video calling, disable them.

What This Does Not Cover

Network-level controls are powerful but they are not complete. They do not protect your children when they leave the house and connect to school Wi-Fi, a friend's network, or mobile data. For that, you need device-level controls — parental settings built into each operating system — which are covered in Part 2 of this series.

Network controls also do not replace conversation. A child who understands why certain content is blocked and what to do if they encounter something distressing is better protected than one who simply cannot reach it on the home Wi-Fi. Part 3 of this series covers the human side.

Summary

Secure the router first: change the admin password, update the firmware, use WPA3 and a strong Wi-Fi password, disable WPS, UPnP and remote management. Deploy DNS filtering at the router level — NextDNS for customisable control, Cloudflare for Families for simplicity — so every device on the network is covered. Segment the network into separate Wi-Fi SSIDs for adults, children and IoT devices. Schedule the children's internet access so the connection switches off at bedtime. Review connected devices regularly. These controls work on every device including those with no built-in parental controls, and they cannot be bypassed without access to the router's admin panel.