I do not have a great networking knowledge, and I want to block some websites on my home router, I did some search and I found that I Could change the DNS

so all devices will not be able to enter those websites , but I realize that the dns could be changed on the device configuration or using a vpn so the dns in the router will be ignored.

Is there a solution to block websites in a router so all devices connected to this router will not connect to those websites ?

  • There is no straightforward way to block the website which does not bypass the VPN, you need to install a firewall for that in your network.
    – smali
    Mar 26, 2018 at 9:14

1 Answer 1


The DNS on a router is responsible for taking a website URL and resolving the IP address and routing path which allows the site to be reached and loaded.

The VPN works on the back of your existing network, and requires that the connection be established through your router before the VPN connection can be started.

The solution here (well, the workaround) would be to block any websites you need to prevent access to using your routers' site filtering configuration, then prevent all VPNs from connecting through the router.

VPN is a pretty broad term (like vehicle, or plant), and the specific method used to establish a VPN connection can vary wildly from one application to another.

A good place to start would be to try blocking the IKE protocol which is used to establish a secure IPSEC tunnel.

IPSEC creates an encrypted connection between two end points, and all data sent over the connection is routed through this tunnel. It's a safe bet that if you are connecting to a VPN, IPSEC is probably the mechanism used to provide it (although to prevent the barrage of corrections, I am fully aware that IPSEC is not the only way this could be done, it's just pretty likely).

IKE (Internet Key Exchange) is the protocol used to securely swap encryption keys used to encrypt the tunnel. Block that, and you stop the tunnel being established.

IKE uses UDP port 500 during stage 1 connection, so blocking this port on the router's firewall may be sufficient.

It is possible to get around this, but with all network security concerns, it's a matter of balancing the risk against the effort of implementing a solution.

Blocking the port should be enough to stop most people from connecting to VPN, and would be sufficient for a home network certainly. As an extra level of security, you can enable MAC address filtering on your router so that only known devices can connect wirelessly.

  • Thanks, if I understand I have to block VPN use by blocking IKE protocol, but what should I do to force all devices to use router dns
    – M.A.Bell
    Mar 26, 2018 at 22:01
  • If you set the DNS server on a machine connected to the network, it still has to go through your router. Can you provide the make and model of the router you're using please? There's probably a way to enforce blocking on it which may or may not use the DNS, the big issue is how to stop people getting around it.
    – Alex
    Mar 27, 2018 at 10:32
  • The mark is D-LINK the model is DSL 2750 U
    – M.A.Bell
    Mar 29, 2018 at 22:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .