Why Parental Controls Sometimes Don't Work: IPv6 and DNS over HTTPS

You entered the filter in the router, everything looked right, and then a site that should be blocked still loads on your child's laptop. That doesn't mean you did something wrong. A filter at the router only works if every request reaches it, and there are two classic detours.

As a reminder: before loading a page, every device asks a DNS server, the phone book of the internet, where the page lives. The filter doesn't answer for blocked addresses. That only works if the device really asks this server. How the basic principle works is in Setting Up the Internet-Schutzschild on Your Router. This article is about the cases where the request takes another route. The Internet-Schutzschild enters the filter at the router, so it applies to the devices on the Wi-Fi, not on mobile data.

Detour 1: The second address path (IPv6)

Modern routers hand out two kinds of addresses: classic IPv4 and the newer IPv6. Each has its own DNS server setting. If you enter the filter for IPv4 only, a device that uses IPv6 may ask the router's own server or the one your internet provider prescribes, and walk around the filter. On a Fritz!Box, the box announces itself as the DNS server to the devices and then asks the filter you entered.

On a Fritz!Box you find both fields under Internet → Account Information → DNS Server (after choosing "Use other DNS servers" there is a section for DNSv4 and, if your connection has IPv6, one for DNSv6). Menu names can differ by model and version. Enter the same provider for IPv6 as for IPv4. The Internet-Schutzschild guide walks through this step with the right addresses.

One more trap from our own family network: the IPv6 addresses of devices change, several times a day on a Linux laptop of ours, and a filter at the router doesn't mind. Rules for single devices by their address don't hold up, though, and identifying a device by the fixed number of its network card (MAC) only works in AdGuard Home if it hands out the addresses itself; otherwise you need a matching step.

Detour 2: The browser asks by itself (DNS over HTTPS)

Firefox and Chrome can look up addresses encrypted at a provider of their own instead of at the router. This is called DNS over HTTPS (DoH). It was built for privacy; for a filter at the router it is a detour, because the router never sees the question.

Firefox. According to Mozilla there are four protection levels. The default level turns DoH off when parental controls or company policies are active or when the network tells Firefox not to use it. That signal is an address the filter deliberately "doesn't know" (use-application-dns.net). But Mozilla also writes: the signal only applies when DoH is on by default, not when someone turned it on themselves. At our home the signal address was blocked and Firefox still used DoH. We haven't conclusively worked out why. Check under Settings → Privacy & Security → DNS over HTTPS which level is chosen. Safest: Off. The default level relies on a signal from the network, and that wasn't enough for us.

Chrome. Chrome has "Use secure DNS" on by default, in automatic mode with the current provider. According to Google's help, Chrome then only encrypts if your existing DNS provider supports it and otherwise falls back to the unencrypted lookup. A provider chosen by hand ("Custom") is the detour. You find the setting under Settings → Privacy and security → Security. Google also says it can't be used when the device is managed or parental controls are active.

Fixing it in place. If you want to set Firefox permanently on a Linux, Windows or macOS computer, Mozilla offers an enterprise policy called DNSOverHTTPS that turns DoH off and locks it (fields Enabled and Locked). Whether it applies shows on the page about:policies in Firefox. That's for parents who like to get hands-on.

Tell your child beforehand: "I'm quickly testing whether our filter works." From about 11, they can help find which route goes around the filter. That strengthens their sense of being able to make something happen (our assessment, not a study finding).

1. Test on the child's device. Open the protection check in the browser your child uses. It shows whether known adult sites are blocked. Repeat it in every browser on the device, and set a fixed occasion for it: after every router update and after major browser updates.
2. IPv6 field in the router. Is there another entry or none at all? Enter the same provider as for IPv4.
3. DoH in the browser. Firefox: check the level. Chrome: don't set "Secure DNS" to a provider of its own.
4. Wi-Fi, not mobile data. The filter only works in the home network. Mobile data and other Wi-Fi networks stay outside, and so do VPN apps.

If everything that should be blocked is blocked afterwards, you have level 1 in good shape. Where even a clean filter leaves gaps is in Why DNS protection isn't everything. For rules per child, your own filter at home (AdGuard Home) is the way to go, which the Home Guide describes. And the filter doesn't replace the conversation: what is blocked and why is best talked through with your child. Whoever can change the setting needs an agreement, not just a lock.