CleanBrowsing for Routers

Only works on routers that can run executables

Our Help repository at CleanBrowsing Help provides specific instructions for different routers.

We use the Free Filtering service in the examples below. Paying customers should use the values issued in the dashboard.

Configuration Details

Recommended

IPv4

1Log into your router. Access via links like http://192.168.0.1/ or http://192.168.1.1/ or App.
2Locate the DNS settings inside the interface.
3Remove all addresses (if any) then add 185.228.168.168 and 185.228.169.168
4Click Save (or similar).

AND

IPv4 (Paying Customers)

1Log into the CleanBrowsing Dashboard.
2Click Your Network.
3Add public IP to the Your Network card
4Click Add IP Address or Domain Name.

AND

IPv6

If your network supports IPv6. Can also disable IPv6 on router and device.

1Log into your router. Access via links like http://192.168.0.1/ or http://192.168.1.1/ or App.
2Locate the DNS settings inside the interface.
3Remove all addresses (if any) then add 2a0d:2a00:0001:0000:0000:0000:0000:0000 and 2a0d:2a00:0002:0000:0000:0000:0000:0000
4Click Save (or similar).

CleanBrowsing for Windows

Windows 10 and Windows 11 (64-bit)

We use the Free Filtering service in the examples below. Paying customers should use the values issued in the dashboard.

Configuration Details

Recommended

Desktop App (v1.7.0)

One-click setup — no command-line needed

The CleanBrowsing Desktop App configures DNS filtering automatically on all your network interfaces. It includes browser hardening, captive portal detection, password protection, and automatic network monitoring.

1Download CleanBrowsing v1.7.0
2Run the installer and follow the prompts
3Launch the app and click Enable on your preferred filter (Family, Adult, or Custom)
4Go to Settings and set a password to prevent unauthorized changes

For full setup instructions, see the Windows App Setup Guide. For a complete feature overview, see Windows Desktop App — Features and Overview.

Configuration Details

Recommended

DNS over HTTPS

Windows 11

1Open the Settings app.
2Go to Network & internet.
3Click on Wi-Fi (or Ethernet).
4Click on Hardware properties, or ignore this step if you clicked on Ethernet.
5Click the Edit button next to DNS server assignment.
6Select Manual.
7Enable IPv4.
8Enter 185.228.168.168 as Preferred DNS, then select On (manual template) and enter https://doh.cleanbrowsing.org/doh/custom-filter/[code].
9Enter 185.228.169.168 as Alternate DNS, then select On (manual template) and enter https://doh.cleanbrowsing.org/doh/custom-filter/[code].
10Click Save.

IPv6

Your network supports IPv6

1Click on the Start menu, then click on Control Panel.
2Click on Network and Internet, then Network and Sharing Center.
3Click on Change Adapter Settings.
4Right click on the Wi-Fi network you are connected to, then click Properties.
5Select Internet Protocol Version 6.
6Click Properties.
7Click Use The Following DNS Server Addresses.
8Replace the current addresses (if any) with 2a0d:2a00:0001:0000:0000:0000:0000:0000 and 2a0d:2a00:0002:0000:0000:0000:0000:0000.
9Click OK, then Close. You may need to restart your browser.

Powershell

1Click on the Search in toolbar.
2Type PowerShell
3Right-Click on Windows PowerShell and Run as Administrator
9Copy and Paste the commands separately and press Enter inside the prompt window

										Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -ServerAddresses 185.228.168.168,185.228.169.168
									
										AND
										
										Set-DnsClientServerAddress -InterfaceAlias "Ethernet" -AddressFamily IPv6 -ServerAddresses 2a0d:2a00:1::,2a0d:2a00:2::

Command Prompt

1Click on the Search in toolbar.
2Type Command
3Right-Click on Command Prompt and Run as Administrator
9Copy and Paste the commands separately and press Enter inside the prompt window

										netsh interface ipv4 set dns name="Ethernet" static 185.228.168.168 & netsh interface ipv4 add dns name="Ethernet" 185.228.169.168 index=2
									
										AND
										
										netsh interface ipv6 set dnsservers "Ethernet" static 2a0d:2a00:1:: & netsh interface ipv6 add dnsservers "Ethernet" 2a0d:2a00:2:: index=2

CleanBrowsing for MacOS

Only works on routers that can run executables

Our Help repository at CleanBrowsing Help provides specific instructions for different MacOS configurations.

We use the Free Filtering service in the examples below. Paying customers should use the values issued in the dashboard.

Configuration Details

Recommended

Configuration Profile

macOS Big Sur or higher

1Download the configuration profile.
2Open Download folder
3Doulbe-click mobile.config file
4Click OK when it says Profile Downloaded
5Open Settings app
6Click Profile Downloaded in left menu
7Double-click CleanBrowsing filter
8Click Install on confirmation page
9Click Install on second confirmation page
10Entersystem password to install profile

Use our Apple DNS Configuration Profile Generator to create a custom profile with your filter and device name.

Terminal

1Click on the Search in top toolbar.
2Type Terminal
3Click on Terminal
4Copy and Paste the command below and press Enter inside the terminal window

									
										sudo networksetup -setdnsservers "Wi-Fi" 185.228.168.168 185.228.169.168 2a0d:2a00:1:: 2a0d:2a00:2::

AND

Terminal (PAYING CUSTOMERS)

Paying customers need to configure a scheduler so the system can track the public IP when using IPv4.

1Click on the Search in top toolbar.
2Type Terminal
3Click on Terminal
4Copy and Paste the command below and press Enter inside the terminal window


										$ crontab -e

5Copy and Paste the command below and press Enter inside the terminal window


										*/10 * * * * /usr/bin/curl -fsS https://my.cleanbrowsing.org/dynip/MYCODE >/dev/null 2>&1

Update MYCODE with the code provided in your dashboard.

OPTIONAL

DNS Lockdown (Advanced)

Requires familiarity with Terminal and sudo (administrator) rights.

This script installs a background service that locks your DNS settings to CleanBrowsing. If anyone changes the DNS on this device, the service will automatically revert it back within 60 seconds. It configures both IPv4 and IPv6, and for paid accounts it also keeps your public IP registered with CleanBrowsing.

1Open Terminal (Search > Terminal)
2Copy and paste the command below and press Enter:

									
										sudo bash -c "$(curl -sL https://cleanbrowsing.org/download/macos/cb-macos-lockdown.sh)"

3Enter your system password when prompted
4Select an option and follow the prompts:
- 1) Family — Blocks adult content, mixed content, malware, and phishing
- 2) Adult — Blocks adult content, malware, and phishing
- 3) Paid Account — Enter your Custom Code from the CleanBrowsing dashboard
- 4) Uninstall — Remove the lockdown (requires a support code)
5Follow the on-screen prompts to complete the setup

That's it. The service starts immediately and persists across reboots. For the strongest protection, use a Standard (non-admin) account for daily use.

To uninstall, run the same command, select option 4, and contact support@cleanbrowsing.org for your support code.

CleanBrowsing for Android

Android 9 or higher

Configuring DNS filtering on Android can be tricky. You have two options: use the CleanBrowsing app to automate the setup (note: some Android versions restrict sideloaded apps), or configure Private DNS manually without any app.

Option 1: CleanBrowsing App

Recommended

Install the CleanBrowsing App (v8.1)

Automates Private DNS + VPN fallback

The CleanBrowsing Android app automates DNS filtering setup, provides VPN fallback when Private DNS is blocked, and locks down settings to prevent tampering.

1Download CleanBrowsing v8.1 and install it.
2Android 13+: Allow restricted settings first (required for sideloaded apps).
3Follow the in-app wizard to grant Accessibility and Device Admin permissions.
4Select your filter (Family, Adult, or enter your paid activation code).
5Set a PIN to lock the settings.

For full setup instructions, see the Android App Setup Guide. For a complete feature overview, see Android App — Features and Overview.

Option 2: Manual Private DNS

Configure Android using Private DNS

No app required — Android 9 or higher

1Go to Settings → Network & internet → Advanced → Private DNS.
2Select the Private DNS provider hostname option.
3Enter custom[code].dot.cleanbrowsing.org and hit Save.

See our Android Private DNS guide for detailed instructions with free filter hostnames.

If you're not using the app, see our Lock Down Mobile Settings guide for ways to prevent users from changing DNS settings manually.

CleanBrowsing for iOS

Only works on routers that can run executables

Our Help repository at CleanBrowsing Help provides specific instructions for different iOS configurations.

We use the Free Filtering service in the examples below. Paying customers should use the values issued in the dashboard.

Configuration Details

Recommended

Configure the Apple iOS device using a configuration profile.

iOS 14 or higher

1Download the configuration profile.
2Save profile to Files (or preferred location)
3Open Files, navigate to where you saved the profile.
4Click on the downloaded profile (should read “profile downloaded“)
5Click Close
6Open the Settings app
7Click Profile Downloaded
8Click Install (top right)
9Enter device code
10Click Install
11Click Done

Use our Apple DNS Configuration Profile Generator to create a custom profile with your filter and device name.

CleanBrowsing for Chromebook

ChromeOS devices (personal and managed)

Our Help repository at CleanBrowsing Help provides detailed instructions for Chromebook configurations.

We use the Free Filtering service in the examples below. Paying customers should use the values issued in the dashboard.

Configuration Details

Recommended

Individual Chromebook (Wi-Fi DNS)

Personal or unmanaged Chromebooks

1Click the clock/status area in the bottom-right corner, then click the gear icon to open Settings.
2Click Network in the left sidebar.
3Click Wi-Fi, then click the network that shows "Connected".
4Scroll down to the Network section and change Name servers from "Automatic" to Custom name servers.
5Enter 185.228.168.168 as Name server 1 and 185.228.169.168 as Name server 2.
6Close the settings — changes save automatically.

Note: If you connect to a different Wi-Fi network, you will need to repeat these steps for that network.

Managed Chromebooks (Google Workspace Admin)

Fleet deployment via Google Workspace Admin Console (DoH)

1Log in to the Google Workspace Admin Console.
2Navigate to Devices > Chrome > Settings > Users & Browsers.
3Select the organizational unit you want to apply the policy to.
4Search for "DNS" and locate the DNS-over-HTTPS setting.
5Set to "Enable DNS-over-HTTPS with insecure fallback" and paste your custom DoH URL from the CleanBrowsing dashboard.
6Click Save. The policy will push to managed devices automatically.

For the full step-by-step guide with verification steps, see our Google Workspace Chrome DoH guide.

AND

IPv4 (Paying Customers)

1Log into the CleanBrowsing Dashboard.
2Click Your Network.
3Add public IP to the Your Network card
4Click Add IP Address or Domain Name.

CleanBrowsing for Apple TV

tvOS 15 or higher

Apple TV supports DNS configuration profiles, the same .mobileconfig files used on iPhone and Mac. You can push a profile from another Apple device or use Apple Configurator.

Configuration Details

Recommended

Configuration Profile (via iPhone or Mac)

Requires another Apple device signed into the same Apple ID

1On your iPhone or Mac, use the Apple DNS Profile Generator to download a .mobileconfig profile.
2Install the profile on the iPhone or Mac first.
3On your Apple TV, go to Settings > General > Privacy & Security > Profiles.
4The profile should appear automatically (synced via iCloud). Select it and choose Install.

Note: Both devices must be signed into the same Apple ID and connected to the internet for the profile to sync.

Apple Configurator (Managed Deployment)

For schools, businesses, or bulk device management

1Download a .mobileconfig profile from the Apple DNS Profile Generator.
2Open Apple Configurator on your Mac.
3Connect your Apple TV via USB-C.
4Drag the .mobileconfig file onto the Apple TV in Apple Configurator.
5The profile will be installed automatically.

Router-Level DNS

Covers all devices on the network including Apple TV

1Configure CleanBrowsing DNS on your router using the Router setup guide.
2All devices on the network, including Apple TV, will use CleanBrowsing DNS automatically.

This approach protects every device on the network but does not encrypt DNS queries unless your router supports DoH/DoT.

CleanBrowsing for Linux

Multiple configuration methods available

Choose the method that best fits your Linux distribution and setup. We use the Free Filtering service in the examples below. Paying customers should use the values issued in the dashboard.

Configuration Details

Recommended

systemd-resolved

Most modern Linux distributions (Ubuntu 18.04+, Fedora, Arch, etc.)

Use the following in /etc/systemd/resolved.conf:

									[Resolve]
DNS=185.228.168.168#family-filter-dns.cleanbrowsing.org
DNS=2a0d:2a00:1::#family-filter-dns.cleanbrowsing.org
DNS=185.228.169.168#family-filter-dns.cleanbrowsing.org
DNS=2a0d:2a00:2::#family-filter-dns.cleanbrowsing.org
DNSOverTLS=yes
								

Then restart the service:

sudo systemctl restart systemd-resolved

IPv4

Simple DNS configuration via resolv.conf or NetworkManager

Change your DNS servers to 185.228.168.168 and 185.228.169.168.

Or edit /etc/resolv.conf directly:

									nameserver 185.228.168.168
nameserver 185.228.169.168
								

IPv6

If your network supports IPv6

Change your DNS servers to 2a0d:2a00:1:: and 2a0d:2a00:2::.

dnsmasq

Lightweight DNS forwarder, commonly used on routers and servers

Use the following in dnsmasq.conf:

									no-resolv
bogus-priv
strict-order
server=2a0d:2a00:2::
server=185.228.169.168
server=2a0d:2a00:1::
server=185.228.168.168
								

Stubby

DNS Privacy stub resolver using DNS-over-TLS

Use the following in stubby.yml:

									round_robin_upstreams: 1
upstream_recursive_servers:
  - address_data: 185.228.168.168
    tls_auth_name: "family-filter-dns.cleanbrowsing.org"
  - address_data: 2a0d:2a00:1::
    tls_auth_name: "family-filter-dns.cleanbrowsing.org"
  - address_data: 185.228.169.168
    tls_auth_name: "family-filter-dns.cleanbrowsing.org"
  - address_data: 2a0d:2a00:2::
    tls_auth_name: "family-filter-dns.cleanbrowsing.org"
								

Make sure Stubby is linked with OpenSSL 1.1.1 or higher.

DNSCrypt

Encrypted DNS proxy supporting multiple protocols

Use the following in dnscrypt-proxy.toml:

									server_names = ['cleanbrowsing-family']

[static]
  [static.'cleanbrowsing-family']
  stamp = 'sdns://AgMAAAAAAAAAAAAVZG9oLmNsZWFuYnJvd3Npbmcub3JnEy9kb2gvZmFtaWx5LWZpbHRlci8'
								

For more configuration options, visit our DNSCrypt with CleanBrowsing guide.

Knot Resolver

High-performance recursive DNS resolver with TLS forwarding

Use the following in /etc/kresd/custom.conf:

									policy.add(policy.all(policy.TLS_FORWARD({
  {'185.228.168.168', hostname='family-filter-dns.cleanbrowsing.org'},
  {'2a0d:2a00:1::', hostname='family-filter-dns.cleanbrowsing.org'},
  {'185.228.169.168', hostname='family-filter-dns.cleanbrowsing.org'},
  {'2a0d:2a00:2::', hostname='family-filter-dns.cleanbrowsing.org'}
})))
								

cloudflared

Cloudflare's DNS-over-HTTPS proxy daemon

Use the following in /usr/local/etc/cloudflared/config.yml:

									proxy-dns: true
proxy-dns-upstream:
 - https://doh.cleanbrowsing.org/doh/family-filter/
								

Unbound

Validating, recursive, and caching DNS resolver

Use the following in unbound.conf:

									forward-zone:
  name: "."
  forward-tls-upstream: yes
  forward-addr: 185.228.168.168#family-filter-dns.cleanbrowsing.org
  forward-addr: 2a0d:2a00:1::#family-filter-dns.cleanbrowsing.org
  forward-addr: 185.228.169.168#family-filter-dns.cleanbrowsing.org
  forward-addr: 2a0d:2a00:2::#family-filter-dns.cleanbrowsing.org
								

As a recursive resolver, Unbound chases CNAMEs. This may result in unexpected behavior when used with a blocking DNS resolver. See github.com/NLnetLabs/unbound/issues/132.

Browser Secure DNS Configuration

Configure DNS-over-HTTPS directly in your browser

Most modern browsers support Secure DNS (DoH) natively. This protects your DNS queries on that specific browser, regardless of the system DNS settings.

Configuration Details

Recommended

Google Chrome

1Go to Settings.
2In the Privacy and security section, click on Security.
3In the Advanced section, enable Use secure DNS.
4Select With: Custom, then enter https://doh.cleanbrowsing.org/doh/family-filter/

Firefox

Windows, macOS, and Linux

1Open Preferences (or Settings).
2Click Privacy & Security.
3Scroll down to Enable DNS over HTTPS.
4Choose Increased Protection or Max Protection.
5Select Custom in the provider menu.
6Enter https://doh.cleanbrowsing.org/doh/family-filter/

Microsoft Edge

1Open Settings.
2Go to the Privacy, search, and services section.
3Under Security, enable Use secure DNS to specify how to lookup the network address for websites.
4Select Choose a service provider, then enter https://doh.cleanbrowsing.org/doh/family-filter/

Brave

1Open Settings.
2In the Privacy and security section (under Additional settings), go to Security.
3In the Advanced section, enable Use secure DNS.
4Select With: Custom, then enter https://doh.cleanbrowsing.org/doh/family-filter/

Paid Customers

Using a Custom DoH URL

Paid customers should replace the DoH URL above with their custom URL from the CleanBrowsing Dashboard:

https://doh.cleanbrowsing.org/doh/custom-filter/[code]

Replace [code] with the code from your dashboard.

Encrypted DNS (DoH & DoT)

Secure your DNS queries with encryption

Encrypted DNS prevents your DNS queries from being intercepted or modified. CleanBrowsing supports both DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT). Learn more in our What is Encrypted DNS? guide.

Configuration Details

Recommended

DNS-over-HTTPS (DoH)

Sends DNS queries over HTTPS (port 443) — Learn more about DoH

1Family Filter: https://doh.cleanbrowsing.org/doh/family-filter/

AND

DNS-over-TLS (DoT)

Sends DNS queries over TLS (port 853) — Learn more about DoT

1Family Filter: family-filter-dns.cleanbrowsing.org

Learn More

Related Guides

→What is DNS over HTTPS (DoH)? — How DoH works and why it matters
→What is DNS over TLS (DoT)? — How DoT works and why it matters
→What is Encrypted DNS? — Overview of DoH, DoT, and DNSCrypt
→Encrypted DNS Setup — Full configuration walkthrough
→DNSCrypt with CleanBrowsing — Advanced encryption option

Setup Guide

CleanBrowsing for Routers

IPv4

IPv4 (Paying Customers)

IPv6

CleanBrowsing for Windows

Desktop App (v1.7.0)

DNS over HTTPS

IPv6

Powershell

Command Prompt

CleanBrowsing for MacOS

Configuration Profile

CleanBrowsing for macOS

Terminal

Terminal (PAYING CUSTOMERS)

DNS Lockdown (Advanced)

CleanBrowsing for Android

Install the CleanBrowsing App (v8.1)

Configure Android using Private DNS

CleanBrowsing for iOS

Configure the Apple iOS device using a configuration profile.

CleanBrowsing for iOS

CleanBrowsing for Chromebook

Individual Chromebook (Wi-Fi DNS)

Managed Chromebooks (Google Workspace Admin)

IPv4 (Paying Customers)

CleanBrowsing for Apple TV

Configuration Profile (via iPhone or Mac)

Apple Configurator (Managed Deployment)

Router-Level DNS

CleanBrowsing for Linux

systemd-resolved

IPv4

IPv6

dnsmasq

Stubby

DNSCrypt

Knot Resolver

cloudflared

Unbound

Browser Secure DNS Configuration

Google Chrome

Firefox

Microsoft Edge

Brave

Using a Custom DoH URL

Encrypted DNS (DoH & DoT)

DNS-over-HTTPS (DoH)

DNS-over-TLS (DoT)

Related Guides

Lock Down Your Settings

iOS

Android

Manage Preferences