How to use the DNSFilter integration with Guardian Firewall
Learn how to use the DNSFilter Integration for DoH and enhanced network security

Our DNSFilter integration offers protection from threats to your privacy online, such as phishing and malware, at the DNS level without requiring the use of a VPN. There are a few different ways to use the integration which can be found below.

DNS over HTTPS

DNS over HTTPS (DoH) is one of the simplest ways to take advantage of the DNSFilter integration included with your Guardian Pro account. First, if you want to use DoH across your entire network, check if your router supports DoH settings.

Some routers with DoH capabilities are listed below.

  • ASUS: Most recent ASUS router models support DoH and DoT
  • eero: can be enabled using the Custom DNS input in the eero app
  • GL.iNet: The GL-AR750 (Creta) supports DoT and DNSCrypt Proxy, with newer firmware (4.5.x and later) supporting Oblivious DoH
  • Keenetic: Some Keenetic routers have a dedicated NextDNS add-on for DoH
  • Netgear: Netgear routers can support DoH, but the functionality may be enabled through firmware updates, especially for accessing the router's web interface using www.routerlogin.net
  • TP-Link: The Archer BE550, Archer BE800, and Archer AX55 routers are examples of TP-Link models that support DoH

Once you have determined your router is compatible with DoH, you will need to log into your Guardian account to access the web dashboard and look for DNSFilter Integration.

Here you will see options to enable protection in different ways. For specifically DNS over HTTPS (DoH), or Option 1, you will need to select “Generate DNS-over-HTTPS URL”. This creates a DoH URL that is paired with your Guardian Pro account. By adding the URL to your router settings, you'll enable DNSFilter Advanced Security for every device on your network.

Router Settings: To enable DoH, you may have to navigate to the advanced network settings in the router's web interface and enter your preferred DoH server URL.

DNS-over-HTTPS for individual devices

If you are looking to protect your Apple devices instead of setting up a router, you can also choose to “Download Apple Configuration” from the DNSFilter Integration page of the user dashboard. After the configuration is downloaded to your device, please follow the steps below:

macOS

1. Click the Apple in the top left corner and select System Settings > Privacy & Security > Profiles

2. Double click on the profile to review and then click Install.

3. You may be asked for your computer password.

4. Check that the configuration is set up as expected by opening a Browser and navigating to debug.dnsfilter.com to see the blocked categories of the standard policy in red.

iOS and iPadOS

1. Navigate to device Settings
2. Tap on the downloaded configuration to install.
3. Check that the configuration is set up as expected by opening a Browser and navigating to debug.dnsfilter.com to see the standard policy with blocked categories in red.

View the interactive setup demo here. DoH Integration on iOS Demo

Windows:

1. Click on the Windows icon and click on Settings > Network & Internet > Wi-Fi > Your Wi-Fi SSID
2. Scroll to DNS server assignment and click edit
3. Select Manual from the dropdown menu.
4. Turn on IPV4
5. Enter the DNSFilter DoH server address 103.247.36.150
6. Select DNS over HTTPS and choose On (manual template)
7. From the DNSFilter Integration page, copy the generated DoH URL and paste the generated DoH URL in the box under DNS over HTTPS template

After enabling DoH, if resolution appears slow, disable IPv6 Network stack on Windows

If your ISP and local network support IPv6, your DNS resolution time may feel slow due to network timeouts. The DNSFilter DoH service currently only supports IPv4 connections, but you can resolve this problem by following the steps below..

1. Click on the Windows icon and click on Settings > Network & Internet > Wi-Fi > Hardware Properties > More adapter options
2. A new window will open with a list of protocol options. Scroll until your find Internet Protocol, Version 6 (TCP/IPv6)
3. Uncheck Internet Protocol, Version 6 (TCP/IPv6)
4. Confirm by clicking Ok to close the window

Unable to use DNS-over-HTTPS? Click here to learn how to enable access to DNSFilter via your IP address.

Additional related articles:

Designate specific networks as “trusted”.

Learn how to configure WireGuard on a Linux device using the wg-quick tool.