How to set up a content filter on your school's Wi‑Fi

One DNS setting on your router or firewall covers every device on campus: Chromebooks, laptops, tablets and students' own phones.

Updated November 11, 2026·2 min read

Short answer

Create a free Sheepdog Filter for Schools account, then set your router's or firewall's DNS server to your Sheepdog Filter address, block outbound DNS to anything else, and turn off IPv6 DNS (or point it at us too). Every device on your network is filtered within minutes, with strict student rules on from the start.

Before you start

You'll need admin access to the router, firewall or DHCP server that hands out DNS on your network, and to be on the school network when you start, so we can link your connection to your account. Allow about thirty minutes.

Create your school's account. Students start strict: adult content, gambling, games (including "unblocked games" mirrors), social media, VPNs, proxies and AI companion apps are blocked, and SafeSearch and YouTube Restricted Mode are on. On the dashboard, tap Set up next to Student Wi‑Fi. That links your public IP address and shows the DNS address to use.

Step 1: Hand out our DNS address

Set the DNS server your network gives to devices to your Sheepdog Filter address. Where this lives depends on your gear:

  • Firewall or UTM (Fortinet, Sophos, SonicWall, pfSense, Meraki): the DHCP server's DNS setting for each student VLAN, or a DNS forwarder pointing to us.
  • Windows Server DNS: set a conditional or default forwarder to us, so domain lookups still work locally.
  • A simple router: the Primary DNS setting, usually under Internet, WAN or LAN.

Leave the secondary empty or set it to the same address. Never use Google (8.8.8.8) or your internet provider's DNS as a backup, or devices slip around the filter.

Step 2: Close the side doors

Students' apps sometimes ignore the DNS they're given. On your firewall:

  1. Block outbound DNS (port 53, TCP and UDP) to every address except ours.
  2. Block DNS over TLS (port 853) except to us.
  3. Sheepdog Filter already blocks the well-known encrypted DNS services (DNS over HTTPS) that browsers use to go around a filter.
  4. IPv6: either turn it off on student networks, or hand out an IPv6 DNS address from your dashboard as well.

Step 3: Separate staff

If staff have their own network or VLAN, give it the Staff address from your dashboard: scam and malware protection only. CIPA allows schools to relax filtering for adults.

Step 4: Check it worked

Your dashboard turns green within a minute or two. On a student device, try a game site like coolmathgames.com: it won't load. For managed Chromebooks that leave campus, see the Google Admin guide.

Sheepdog Filter

The filter students can't get around.

Games, unblocked-games mirrors, proxies, VPNs and social media blocked on your network and every managed Chromebook. Free to start, live in an afternoon.

Set up our school, free

Questions school IT asks

Does it slow the network down?

No. A DNS lookup takes a few milliseconds, once per site. Video, testing and downloads go straight to the internet as normal.

Do we need to install certificates?

No. Sheepdog Filter doesn't decrypt traffic, so there's nothing to install and nothing that breaks Google Classroom, testing apps or banking for staff.

We have several buildings. Is that one account?

Yes. Add a campus in the dashboard for each building or internet connection, and each gets its own address and report.

Keep reading