Home tech

How to set up parental controls on Wi-Fi: 3 layers

By Roof & Router Team. Updated October 26, 2026.

Skip to what to buy (2 types) ↓

How to set up parental controls on Wi-Fi

Parental controls on Wi-Fi work best as three layers that cover each other’s gaps:

1. Router or mesh app. Group each child’s devices into a profile, then pause the internet on demand or on a schedule. Some systems add content filters.
2. DNS filtering. Point your router at a free family DNS service so every device on the network gets basic adult-content blocking.
3. Device controls. Turn on Apple Screen Time, Google Family Link, Microsoft Family Safety or the console’s own controls. These travel with the device, including on cellular data.

The FTC’s advice for parents is the same idea from the other direction: controls “need to be set up on all the devices your kid uses,” and there is “really no substitute for talking with your kid about your family’s rules and expectations.” Start with one tool and add more as needed.

Before you start, make sure the router itself is locked down. A child who knows the admin password can undo everything. See how to secure your home Wi-Fi.

The three layers compared

Router and mesh app controls: eero, Google, NETGEAR, TP-Link, ASUS

Every brand works in roughly the same way. You create a profile for a child, assign their phone, tablet, laptop and console to it, and then pause or schedule that profile. The differences are in what is free and what needs a subscription.

eero. In the eero app, create a profile, add devices, then tap the profile and choose Pause profile. You can also set recurring schedules. eero notes that a paused device stays connected to the network but can’t browse, which is different from blocking a device, which stops it joining at all. eero says there are no monthly fees to use eero, but its content filters and its Block Apps feature are part of the paid eero Plus subscription.

Google Nest Wifi and Google Wifi. In the Google Home app, go to Wi-Fi > Family Wi-Fi, create a group for each child, and tap Pause, or add a schedule with start and end times and days. You can delay a scheduled pause by 30 minutes or skip one. When you create the group you can turn on site blocking, which Google says uses SafeSearch technology to block millions of adult websites. Google states plainly that Family Wi-Fi features do not work with devices that use a private or randomized MAC address.

NETGEAR Smart Parental Controls. Only specific Orbi, Nighthawk, cable and mesh models support it, and NETGEAR warns that support doesn’t carry across hardware versions of the same model, so check its compatibility list for your exact model number. NETGEAR’s feature page lists pausing the internet and creating profiles without a Premium label. Content filters, time limits, bedtime schedules and usage insights are Premium.

TP-Link Deco and HomeShield. In the Deco app, create a profile with your child’s age, and the app presets rules based on that age. Blocking specific websites and a basic “No Internet” bedtime have no subscription note on TP-Link’s setup page. Time limits, Offtime, Family Time (a manual pause), SafeSearch and YouTube Restricted, and setting different bedtimes for weekdays and weekends need the Advanced Parental Controls subscription. TP-Link says new users get a one-month free trial.

ASUS. In the router’s web admin page, open Parental Controls. Web and Apps Filters block content categories for chosen devices on selected models, and Time Scheduling sets offline hours for each device. Devices are picked by their MAC address, and ASUS says schedules depend on the router’s clock, so confirm the time zone. Parental controls work only in router mode, not access-point mode.

A tip that applies to all of them: give devices clear names first. A list of “android-7f3a” entries makes it easy to assign the wrong phone. If the list has grown long, see how many devices a router can handle.

How to filter adult sites for every device with DNS

DNS is the internet’s phone book: it turns a site name into an address. A family DNS service refuses to look up adult sites, so they don’t load. Set it once in your router and every device that uses the router’s DNS is covered, including smart TVs and game consoles that have no filter of their own.

CleanBrowsing also lists IPv6 addresses for its Family filter, 2a0d:2a00:1:: and 2a0d:2a00:2::. If your router hands out IPv6 DNS, set those too, or devices may skip the filter over IPv6.

How to set it: open your router’s app or admin page, find the internet, WAN or DNS settings, switch from automatic DNS to manual, and enter the two addresses. Mesh apps usually call this “DNS” under advanced network settings. Note that OpenDNS’s standard servers, 208.67.222.222 and 208.67.220.220, are different from the FamilyShield nameservers, so use the FamilyShield numbers.

Limits worth knowing: the free CleanBrowsing tier is throttled and has no support, according to CleanBrowsing, and a DNS filter treats every device the same. A parent’s laptop gets filtered too. For age-specific rules, use the router’s per-profile filters or device controls.

Device controls: Screen Time, Family Link, Family Safety and consoles

Device controls are the only layer that follows a child off your Wi-Fi, so they matter most for phones.

Apple Screen Time (iPhone, iPad). With Family Sharing, set Screen Time schedules for different times of day, daily time allowances by app category, and allowed contacts. Under Content & Privacy Restrictions, choose Limit Adult Websites or Approved Websites Only. Apple says Limit Adult Websites is on by default for children under 18, and Ask to Buy and Ask to Browse are on by default for children under 13. Set a Screen Time passcode your child doesn’t know.

Google Family Link (Android, Chromebook). Set a daily screen time limit for each day of the week, app time limits, and a schedule, or lock the device from your phone. Google notes the daily limit applies per device, so a 2-hour limit gives 2 hours on each Android device or Chromebook. Phone and emergency calls still work on a locked phone.

Microsoft Family Safety (Windows, Xbox). Turn on Filter inappropriate websites and searches. Microsoft says this blocks mature sites and filters Bing searches by default, and it works in Microsoft Edge. Other browsers are blocked so they can’t be used to get around the filter.

Game consoles.

Nintendo notes that play time limits are set in the app only, not on the console, and they apply to the whole console rather than each player. PlayStation limits apply on both PS5 and PS4 if a child uses both.

Why Wi-Fi parental controls stop working

Cellular data. Router and DNS controls only see traffic on your network. A phone that switches to cellular data, or joins a friend’s hotspot, is outside them. Google even suggests turning off Wi-Fi and using mobile data to get back into the Google Home app if you pause the device you’re managing from. That’s why phones need device controls too.

Private Wi-Fi addresses (MAC randomization). Routers identify devices by MAC address, a hardware ID. Apple says its devices use a different MAC address for each Wi-Fi network by default. On iOS 18 and later, the “Rotating” setting changes the address every 2 weeks, while “Fixed” keeps it the same. Android uses a randomized address by default since Android 10, normally one that stays the same for each network, though Android 12 and later can re-randomize on some networks. When the address changes, the router sees a new, unmanaged device. Google says its Family Wi-Fi features don’t work with private or randomized addresses at all.

The fix: on the child’s device, open Settings > Wi-Fi, tap the info button next to your home network, and set Private Wi-Fi Address to Off (iPhone) or switch the MAC setting to the device’s own address (Android). Then reassign the device to its profile in your router app. A child can switch it back, so a device-level passcode lock still matters.

VPNs and proxies. A VPN tunnels traffic past DNS filters and many router filters. CleanBrowsing’s Family filter blocks proxy and VPN domains “used to bypass the filters,” but its Adult filter does not. On phones, Screen Time and Family Link app approvals are the practical way to stop a VPN app being installed.

Will parental controls slow down my Wi-Fi?

Pausing and scheduling don’t use meaningful bandwidth; they simply stop a device’s traffic. A DNS filter changes only where names are looked up, though a free service may be throttled, as CleanBrowsing says its free tier is. If the whole network feels sluggish after setup, check the usual suspects first in why is my Wi-Fi slow.

Parental controls setup checklist

• Change the router admin password and keep it to yourself.
• Name every child’s device in the router app and group them into one profile per child.
• Turn off Private Wi-Fi Address for your home network on each child’s device.
• Set a bedtime or homework pause schedule in the router or mesh app.
• Set your router’s DNS to OpenDNS FamilyShield or CleanBrowsing Family (add IPv6 addresses if used).
• Turn on Screen Time or Family Link on every phone and tablet, with a passcode the child doesn’t know.
• Set up the console’s own controls: Xbox Family Settings, PlayStation Family Management or the Nintendo app.
• Talk through the rules with your child, and adjust the controls as they grow, as the FTC advises.

Setting up a new mesh system for the holidays? Our mesh Wi-Fi vs. extender guide explains which one gives you a single network that’s easier to manage.