Users on your network can bypass DNS filtering by changing their device's DNS settings. This guide shows how to use router firewall rules to force all DNS traffic through CleanBrowsing.
DNS filtering works by intercepting domain lookups at the DNS resolver level. However, any user or application can change the DNS settings on their device to use a different resolver (like Google's 8.8.8.8 or Cloudflare's 1.1.1.1), completely bypassing your filtering.
Router firewall rules solve this by only allowing DNS traffic to your approved CleanBrowsing resolvers and blocking all other DNS traffic on port 53.
Log into your router or firewall appliance's admin panel. The firewall settings location varies by device:
You need to create two outbound rules — one to allow CleanBrowsing DNS, and one to block everything else on port 53.
Create an Allow rule with the following settings:
CleanBrowsing DNS IP addresses:
| Filter | Primary | Secondary |
|---|---|---|
| Security | 185.228.168.9 | 185.228.169.9 |
| Adult | 185.228.168.10 | 185.228.169.11 |
| Family | 185.228.168.168 | 185.228.169.168 |
Create a Block rule with the following settings:
This catches any DNS traffic that didn't match Rule 1 (i.e., traffic to unauthorized DNS resolvers) and blocks it.
For reference, here are popular public DNS resolvers that users may try to switch to:
| Provider | Primary IP | Secondary IP |
|---|---|---|
| Google DNS | 8.8.8.8 | 8.8.4.4 |
| Cloudflare | 1.1.1.1 | 1.0.0.1 |
| OpenDNS | 208.67.222.222 | 208.67.220.220 |
| Quad9 | 9.9.9.9 | 149.112.112.112 |
| Comodo | 8.26.56.26 | 8.20.247.20 |
The block-all rule on port 53 (Step 4) handles all of these automatically — you don't need to block each one individually.
Test from a device on your network:
8.8.8.8 (Google DNS).You can also verify using the command line:
nslookup google.com 8.8.8.8This should time out if the firewall rules are working correctly.
Comprehensive guide to stopping DNS, DoH, and VPN bypass techniques.
Prevent users from changing DNS settings on their devices.
Universal guide for configuring DNS on most routers.
