OpenDNS FamilyShield Setup Guide for Home Networks

OpenDNS FamilyShield is one of the fastest, most reliable ways to block adult content across every device on your home network without installing software on each phone, tablet, or laptop. It works at the DNS layer, which means the filtering happens before a browser even loads a page. No subscriptions, no complex firewall rules, just two DNS server addresses and about ten minutes of configuration. This guide covers exactly how to configure it on your router, on individual devices, and how to confirm it is actually working.

What OpenDNS FamilyShield Is and How It Works

OpenDNS FamilyShield is a free DNS resolver service operated by Cisco. Instead of pointing your devices at your ISP's default DNS servers, you point them at OpenDNS's servers. When a device on your network tries to resolve a domain name, OpenDNS checks that domain against its categorization database. If the domain is tagged as adult content, pornography, or a similar category, OpenDNS returns a block page instead of the real IP address. The site never loads.

The two FamilyShield DNS server addresses are:

These are different from the standard OpenDNS Home addresses (208.67.222.222 / 208.67.220.220). The FamilyShield addresses come with adult content filtering pre-enabled at no cost and with no account required. You can also create a free OpenDNS account to customize additional categories, see basic stats, and whitelist specific domains.

Why the Router Is the Best Place to Configure This

If you configure FamilyShield only on a single device, every other device on the network remains unprotected. A router-level change applies to every device that connects to your Wi-Fi or wired network automatically, including smart TVs, gaming consoles, and guest devices. This is the correct place to make the change unless you specifically need per-device control.

Step-by-Step Router Configuration

The exact screens differ between router brands, but the principle is identical: find the DNS settings in your router's admin panel and replace whatever is there with the two FamilyShield addresses.

Accessing Your Router Admin Panel

Open a browser on any device connected to your network and navigate to your router's admin URL. Common addresses by brand:

• Linksys: 192.168.1.1
• Netgear: routerlogin.net or 192.168.1.1
• TP-Link: tplinkwifi.net or 192.168.0.1
• ASUS: asusrouter.com or 192.168.1.1
• D-Link: 192.168.0.1
• Eero, Google Nest, Orbi: use the companion mobile app

If none of those work, open a command prompt and run:

Log in with your admin credentials. If you have never changed them, check the label on the bottom of your router for default username and password. Common defaults are admin/admin or admin/password.

Linksys Routers

1. Log in at 192.168.1.1.
2. Go to Setup > Basic Setup.
3. Under the Network Setup section, look for Static DNS 1 and Static DNS 2.
4. Enter 208.67.222.123 in DNS 1 and 208.67.220.123 in DNS 2.
5. Click Save Settings.

Netgear Routers

1. Log in at routerlogin.net.
2. Go to Advanced > Setup > Internet Setup.
3. Scroll to Domain Name Server (DNS) Address.
4. Select Use These DNS Servers.
5. Enter 208.67.222.123 as Primary and 208.67.220.123 as Secondary.
6. Click Apply.

TP-Link Routers

1. Log in at tplinkwifi.net.
2. Go to Advanced > Network > Internet.
3. Change Primary DNS to 208.67.222.123.
4. Change Secondary DNS to 208.67.220.123.
5. Click Save.

ASUS Routers

1. Log in at asusrouter.com.
2. Go to WAN > Internet Connection.
3. Set Connect to DNS Server automatically to No.
4. Enter 208.67.222.123 in DNS Server 1 and 208.67.220.123 in DNS Server 2.
5. Click Apply.

After Saving Router Settings

Restart the router if required. On any device that was already connected, release and renew the DHCP lease to pick up the new DNS assignment immediately:

Configuring FamilyShield on Individual Devices

If you cannot or do not want to change the router — for example, if you are on a rented router from your ISP — you can configure individual devices instead. This also works for laptops that travel outside the home network.

Windows 10 and 11

1. Open Settings > Network and Internet > Change adapter options.
2. Right-click your active adapter (Wi-Fi or Ethernet) and choose Properties.
3. Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
4. Choose Use the following DNS server addresses.
5. Preferred: 208.67.222.123, Alternate: 208.67.220.123.
6. Click OK twice.

macOS

1. Open System Settings > Network.
2. Select your active connection and click Details.
3. Click the DNS tab.
4. Remove any existing DNS entries using the minus button.
5. Add 208.67.222.123 and 208.67.220.123 using the plus button.
6. Click OK then Apply.

Android

1. Go to Settings > Wi-Fi, long-press your connected network, and select Modify network.
2. Switch IP settings from DHCP to Static.
3. Set DNS 1 to 208.67.222.123 and DNS 2 to 208.67.220.123.
4. Save.

Android 9 and later also supports Private DNS. Go to Settings > Network > Private DNS and enter familyshield.opendns.com for encrypted DNS-over-TLS filtering.

iOS and iPadOS

1. Go to Settings > Wi-Fi, tap the information icon next to your network.
2. Scroll to DNS and tap Configure DNS.
3. Switch to Manual, remove existing servers, and add 208.67.222.123 and 208.67.220.123.
4. Tap Save.

How to Verify FamilyShield Is Working

OpenDNS provides a built-in test page. Open a browser and go to:

If FamilyShield is active, you will see an OpenDNS block page instead of the site loading. You can also use the DNS Lookup tool to confirm your DNS resolvers are returning the correct FamilyShield block IP (146.112.61.106) for a known blocked domain.

To check which DNS server your device is actually using:

You can also visit welcome.opendns.com in a browser. OpenDNS will display a welcome banner confirming your network is using their service.

Common Problems and How to Fix Them

Filtering Is Not Working After Router Change

The most common cause is that individual devices have manually configured DNS addresses that override the router's DHCP-assigned ones. Check the network settings on each device and remove any hard-coded DNS entries so devices fall back to DHCP. A second cause is an ISP-provided modem-router combo that ignores DNS settings entered in the secondary router. In that case, configure DNS on the modem itself or contact your ISP for bridge mode instructions.

A Specific Site Is Blocked That Should Not Be

FamilyShield's categorization is not perfect. To unblock a legitimate site, you need a free OpenDNS account. Sign up at opendns.com, register your network's IP address under Settings > Add a network, then go to Settings > Whitelist and add the domain. Changes take effect within a few minutes.

Someone Changed the DNS Back

Older children or technically capable users can bypass router-level filtering by manually entering alternative DNS addresses (like 8.8.8.8) on their device. To prevent this on Windows devices in a home environment, remove the user's administrator privileges. For mobile devices, use your router's parental controls to restrict access to the device settings page, or consider a dedicated parental control app that complements DNS filtering.

VPN Bypasses the Filter

A VPN tunnels DNS queries through an encrypted channel that bypasses your router's DNS settings entirely. If this is a concern, block VPN protocols at the router firewall level, or use a DNS filtering service that also deploys a lightweight agent on each device for enforcement regardless of VPN use.

Upgrading to OpenDNS Home for More Control

FamilyShield blocks adult content by default with zero configuration beyond the DNS addresses. If you want to customize which categories are blocked, add your own blocked or allowed domains, or see a dashboard of DNS query history, upgrade to the free OpenDNS Home service. The standard OpenDNS Home DNS addresses are:

After creating an account and linking your network's IP, you configure filtering through the OpenDNS dashboard under Settings > Web Content Filtering. You can choose preset levels (Low, Moderate, High) or build a fully custom block list by category.

Note that home IP addresses are often dynamic and change periodically. If your IP changes, your custom dashboard settings will stop applying. OpenDNS provides a free dynamic DNS updater client that keeps your registered IP current automatically. Install it on any always-on device on your network, such as a desktop PC or a Raspberry Pi.

Limitations to Be Aware Of

• DNS-over-HTTPS (DoH) bypass: Browsers like Firefox can use their own DoH resolvers, bypassing your router's DNS entirely. Disable browser-level DoH in the browser settings under privacy or networking options.
• HTTPS content filtering: FamilyShield blocks domains, not specific URLs. If a domain serves both safe and unsafe content under the same name, blocking is all-or-nothing.
• Mobile data: When a phone leaves your Wi-Fi and uses a cellular data connection, it is entirely outside your router's control. Mobile devices need individual configuration or a mobile parental control app.
• Encrypted SNI: Emerging technologies can obscure which domain is being visited, potentially reducing effectiveness of DNS-only filtering over time. Pairing DNS filtering with router-level content inspection provides a stronger safety net.

Summary of the Key DNS Addresses

Keep these addresses handy. FamilyShield is pre-configured with adult content blocking and requires no account:

Setting up FamilyShield takes under ten minutes and immediately adds a meaningful layer of protection across your entire household network. It is not a complete parental control solution on its own, but as a first line of defense at the DNS layer it is one of the easiest and most effective tools available at no cost.