Here's the uncomfortable thing about being a developer and trying to block your own internet access.
You know exactly how every solution works. And therefore exactly how to break it.
Browser extension? I know it's just a manifest.json with a declarativeNetRequest rule. I can disable it in the chrome://extensions page in 4 seconds.
Hosts file blocker? I literally edit hosts files for local development. I can undo it in one terminal command.
Screen Time? I know it only hooks into Safari's WKWebView. Chrome doesn't use WKWebView. It bypasses it completely.
Router DNS? I know how to change my device's DNS settings. Takes 10 seconds on any OS.
Every consumer-grade blocker I tried, I broke within 48 hours. Not because I was trying to — because understanding the implementation made bypassing it obvious.
So I went to the one layer I couldn't easily circumvent myself.
DNS filtering via a VPN tunnel
The architecture that actually held:
All DNS queries from the device route through a WireGuard-based VPN tunnel to a filtering gateway. The gateway (Cloudflare Zero Trust in my case) evaluates every query against a blocklist before resolving. Blocked domains return NXDOMAIN or a block page IP.
The key properties that make this hard to bypass:
The VPN tunnel overrides system DNS — changing DNS settings in network preferences does nothing because the tunnel intercepts before the OS resolver gets involved
Works on every network — WiFi, cellular, hotspot. Not tied to home router
Catches every app simultaneously — not just one browser, because every DNS query goes through the tunnel regardless of which process made it
"Anonymizer/VPN" category blocks VPN apps — the bypass tool is itself blocked
VPN lockdown mode on Android kills all internet if the tunnel is removed — no tunnel, no internet
The part that required the most thought: removing my own admin access
The technical layer was actually the easy part. The harder problem was that I still had the admin credentials. I could log into the dashboard and change rules anytime.
The solution: Guardian Mode. A trusted person holds the dashboard credentials or must approve any rule changes. I can't modify my own filter without their explicit approval.
This is a commitment device at the infrastructure level. You're not relying on willpower — you're architecturally removing the ability to make a bad decision in a weak moment.
The stack if you want to replicate this
Cloudflare Zero Trust Gateway (free tier covers this)
Cloudflare WARP client on device
Gateway policies using wirefilter expressions for category and domain blocking
A second Cloudflare account or trusted person holding admin access
Android VPN lockdown mode enabled (Settings → Network → VPN → lockdown)
Screen Time on iOS to prevent WARP app deletion
I eventually wrapped all of this into a product — noori.fun — because the raw Cloudflare setup takes 2-3 hours and requires understanding Zero Trust concepts that most people don't have. The product handles all the CF configuration automatically and adds the Guardian Mode, tamper alerts, and family management on top.
But the architecture is fully replicable if you want to DIY it. Happy to answer questions on the Cloudflare Zero Trust setup specifically — wirefilter expression syntax, policy ordering, split tunnel config, any of it.
Top comments (0)