Your home network's DNS resolver is the first checkpoint every domain lookup passes through — and CleanBrowsing exploits that to block adult content, malware domains, and phishing sites before a single byte of content loads. Unlike browser-level parental controls that kids can toggle off or work around in incognito mode, DNS filtering operates at the network layer and catches every device, every app, and every browser simultaneously. This guide covers the exact IP addresses, admin panel paths, and terminal commands needed to enforce CleanBrowsing's Family Filter on your router and individual devices in 2026.
Which CleanBrowsing Filter Is Right for You
CleanBrowsing publishes three filter tiers, each with its own pair of resolver IPs:
- Family Filter — blocks adult content, proxies, and VPNs (to prevent bypass), and enforces SafeSearch on Google, Bing, and YouTube Restricted Mode. Use this for households with children.
- Adult Filter — blocks adult content only; does not enforce SafeSearch. Suitable for adult households wanting a content guardrail without locking down search results.
- Security Filter — blocks malware, phishing, and cryptojacking domains only; no content filtering. Good for businesses or advanced users who want threat protection with no content restrictions.
For most family setups, you want the Family Filter. The resolver addresses are:
Set Up CleanBrowsing on Your Router
Configuring the router is the single most effective approach — all devices on the network, including smart TVs, gaming consoles, and guest devices, inherit the filter without any per-device work.
ASUS Routers (AsusWRT firmware)
Open a browser and go to http://asusrouter.com or 192.168.1.1. Navigate to WAN → WAN DNS Setting. Set Connect to DNS Server automatically to No. Enter 185.228.168.168 in the DNS Server 1 field and 185.228.169.168 in DNS Server 2. Click Apply. If your router has IPv6 enabled — most ASUS routers do — go to IPv6 → DNS Settings and add the IPv6 Family Filter addresses listed above.
TP-Link Routers (Archer series)
Go to http://tplinkwifi.net or 192.168.0.1. Navigate to Advanced → Network → Internet (or Basic → Internet on older firmware). Scroll to the DNS section and uncheck Get DNS server automatically. Enter both Family Filter IPs and save. On newer Archer AX and BE series running post-2024 firmware, the path is Advanced → DHCP Server → DNS Settings — this sets the DNS pushed to all DHCP clients, which is the right place to change it.
Netgear Routers (Orbi and Nighthawk)
Go to http://routerlogin.net or 192.168.1.1. Navigate to Advanced → Setup → Internet Setup. Under Domain Name Server (DNS) Address, select Use These DNS Servers and fill in both Family Filter IPs. For Orbi mesh systems, go to http://orbilogin.com then follow the same Advanced → Setup → Internet Setup path — the fields are identical.
Linksys Routers
Go to http://linksyssmartwifi.com or 192.168.1.1. Navigate to Connectivity → Internet Settings → IPv4. Under DNS, choose Static DNS and enter both IPs. On the Velop mesh UI, the path is Wi-Fi Settings → Advanced Settings → Local Network where you'll find the DHCP DNS fields.
Xiaomi / Mi Routers
Go to http://miwifi.com or 192.168.31.1. Navigate to More Settings → DHCP and enter the CleanBrowsing IPs in the primary and secondary DNS fields. Xiaomi stock firmware does not expose WAN DNS settings separately — the DHCP field is what controls downstream devices.
OpenWrt / DD-WRT (Third-Party Firmware)
On OpenWrt: go to Network → DHCP and DNS → General Settings and add both servers to the DNS forwardings field. Or edit /etc/config/dhcp directly:
Restart with service dnsmasq restart. On DD-WRT: go to Setup → Basic Setup → Network Address Server Settings (DHCP) and fill in the Static DNS 1 and DNS 2 fields.
Set Up CleanBrowsing on Windows 11 and 10
Router-level filtering is ideal, but for per-machine enforcement on shared or managed networks, configure DNS per adapter.
On Windows 11: open Settings → Network & Internet → (Wi-Fi or Ethernet) → Hardware properties → DNS server assignment → Edit. Switch to Manual, enable IPv4, and enter 185.228.168.168 as Preferred and 185.228.169.168 as Alternate. To also enforce DoH, add the provider via PowerShell:
On Windows 10: go to Control Panel → Network and Sharing Center → Change adapter settings. Right-click your active adapter, choose Properties → Internet Protocol Version 4 (TCP/IPv4) → Properties. Select Use the following DNS server addresses and enter both IPs. Click OK twice.
Set Up CleanBrowsing on macOS
Open System Settings → Network (Ventura, Sonoma, Sequoia) or System Preferences → Network on older versions. Select your active interface, click Details (Ventura and later) or Advanced. Go to the DNS tab. Click + and add 185.228.168.168, then add 185.228.169.168. Remove any existing ISP resolver entries to prevent fallback. Click OK, then Apply.
Verify from Terminal:
Both CleanBrowsing IPs should appear in the output.
Set Up CleanBrowsing on iOS and iPadOS
iOS does not expose a single global DNS toggle, but you have two solid options depending on how strict you need the enforcement to be.
Per-Wi-Fi network: Go to Settings → Wi-Fi → tap the ⓘ next to your network → Configure DNS → Manual. Delete existing servers and add 185.228.168.168 and 185.228.169.168. This only applies on that specific Wi-Fi network.
Device-wide via DoH profile (iOS 14+): Apple supports encrypted DNS configuration profiles. CleanBrowsing provides signed .mobileconfig files from their website. Download the Family Filter profile, open it, and install it via Settings → General → VPN & Device Management → (the downloaded profile) → Install. This enforces CleanBrowsing over both Wi-Fi and cellular and is the strongest per-device control available on iOS.
Set Up CleanBrowsing on Android
Android 9 and later includes a system-level Private DNS feature that uses DNS over TLS (DoT) on port 853 — and it works across both Wi-Fi and mobile data.
Go to Settings → Network & Internet → Advanced → Private DNS. The exact path varies by manufacturer: Samsung buries it under Connections → More connection settings → Private DNS; Pixel devices follow the path above. Select Private DNS provider hostname and enter:
Tap Save. Android immediately validates the TLS connection to CleanBrowsing and switches all DNS queries to go through the Family Filter. Because this is a system setting rather than a per-network setting, it cannot be bypassed by switching Wi-Fi networks.
On Android 8 and earlier, set DNS per Wi-Fi connection: long-press the connected network, choose Modify network → Advanced options → IP settings: Static, then fill DNS 1 and DNS 2 manually.
Set Up CleanBrowsing on Linux
The correct approach depends on which network manager your distribution uses.
systemd-resolved (Ubuntu 20.04+, Fedora, most modern distros):
Add or modify the Resolve section:
Then restart: sudo systemctl restart systemd-resolved. Setting DNSOverTLS=yes upgrades queries to encrypted DoT automatically.
NetworkManager (GNOME desktops): Go to Settings → Network → gear icon on your connection → IPv4 → DNS. Enter both IPs separated by a comma and disable automatic DNS.
Headless servers via /etc/resolv.conf:
On systems managed by resolvconf or systemd-resolved, direct edits to /etc/resolv.conf are overwritten on restart. Use the manager-level approach for persistence.
Verify the Filter Is Working
CleanBrowsing provides a test page at http://test.cleanbrowsing.org that reports your current filter level. The most reliable CLI test is to query a known-blocked domain against CleanBrowsing's resolver and compare it with a neutral resolver:
The first query should return CleanBrowsing's block-page IP; the second returns the real address. If both return the same result, the filter is not active.
On Windows, use nslookup:
On Linux with systemd-resolved, check which resolver is active:
Preventing Bypass
A DNS filter is only as strong as your enforcement. Several bypass methods are well-known:
- Manually changing device DNS — counter this by blocking outbound port 53 (UDP/TCP) to all destinations except the CleanBrowsing IPs in your router's firewall rules. Any DNS query that doesn't go to CleanBrowsing gets dropped.
- VPN use — VPNs tunnel traffic outside your DNS filter entirely. Block common VPN protocols at the router: L2TP/IPSec UDP 500/4500, OpenVPN UDP 1194, WireGuard UDP 51820.
- Browser-native DoH — Chrome and Firefox can send encrypted DNS directly to Google or Cloudflare, bypassing your resolver. Disable browser DoH or redirect it to CleanBrowsing's own DoH endpoint (details in the 2026 section below).
- Mobile data hotspot — DNS filtering does not apply to cellular connections unless you've configured the DoH profile on iOS or Private DNS on Android as described above.
On OpenWrt, you can force all LAN DNS traffic through CleanBrowsing regardless of what IP the device tries to use:
Common Misdiagnoses
"CleanBrowsing isn't blocking anything." Most often the router is still forwarding to the ISP resolver. Run ipconfig /all on Windows or cat /etc/resolv.conf on Linux/Mac on a connected device. If you see your router's LAN IP (192.168.x.x) as the DNS server, the router is acting as a DNS forwarder — you need to change the router's upstream DNS setting, not the client's.
"YouTube is still showing unrestricted results." The Family Filter enforces YouTube Restricted Mode by intercepting requests to www.youtube.com and redirecting them to restrictedYT.com. If this isn't working, the device has a stale DNS cache. Flush it:
"Legitimate sites are blocked." CleanBrowsing can over-block domains that share CDN infrastructure with adult content. Log in to your CleanBrowsing dashboard and submit a false-positive report. Free accounts can submit reports; paid accounts receive faster resolution and can add immediate whitelist exceptions.
"Google still shows adult SafeSearch suggestions in some apps." CleanBrowsing enforces SafeSearch by returning a CNAME pointing to forcesafesearch.google.com for Google's domains. This works for standard web searches but will not affect third-party apps that load Google content in embedded web views with their own DNS caching layer.
Free Tier vs Paid Tier
The public Family Filter IP addresses are free with no account required. No registration, no API key — just update your DNS settings and the filter is live. The free tier handles billions of queries per day with strong uptime and no rate limiting for typical home use.
The paid tier (currently $24–$150/year) adds a dashboard with per-device query logs, custom allow and block lists so you can whitelist a mis-blocked site without turning off the filter, multiple filter profiles per account, and DNSSEC validation enforcement. For a household with school-age children, the entry-level paid plan is worth considering for the whitelist capability alone. Current pricing and feature comparison is at cleanbrowsing.org/filters.
2026 Notes: IPv6, DoH, and DNSSEC
If your ISP delivers native IPv6 — most do now — devices will prefer IPv6 DNS if the router advertises IPv6 resolvers. Configure both the IPv4 and IPv6 CleanBrowsing addresses at the router level, or a device with working IPv6 connectivity may fall back to your ISP's IPv6 resolver and bypass the filter entirely. The IPv6 Family Filter addresses are 2a0d:2a00:1:: and 2a0d:2a00:2::.
Browsers shipping with DoH enabled by default — Firefox since 2020, Chrome and Edge since 2022 — can bypass router-level DNS by sending queries directly to Cloudflare or Google's DoH endpoints over HTTPS. As of 2026, Firefox respects a network's resolver if the router signals it via a special canary domain (use-application-dns.net returning NXDOMAIN), but Chrome does not honour this signal on consumer devices. The safest approach: disable browser-native DoH and point it to CleanBrowsing's own endpoint instead:
- Firefox: Settings → Privacy & Security → DNS over HTTPS → Choose provider → Custom → enter
https://doh.cleanbrowsing.org/doh/family-filter/ - Chrome/Edge: Settings → Privacy and security → Security → Use secure DNS → With a custom provider → enter the same DoH URL
CleanBrowsing supports DNSSEC validation on all filter tiers. Queries for DNSSEC-signed domains are cryptographically validated end-to-end; if a domain's DNSSEC chain is broken or tampered with, the resolver returns SERVFAIL rather than a poisoned answer. This provides meaningful protection against DNS cache poisoning, which remains an active attack vector in 2026. For the technical foundation, see the DNSSEC introduction in RFC 4033.