---
title: "WireGuard for safe browsing on kids' devices - Martin Hicks"
description: "Configuring WireGuard so children's devices always route DNS through home filtering, even on school Wi-Fi, friends' houses and mobile data."
canonical: https://martinhicks.dev/articles/wireguard-safe-browsing-kids
last-updated: 2026-05-02
---

![Illustration of a lock surrounded by device icons connected through a VPN tunnel](https://martinhicks.dev/images/articles/wireguard-kids-vpn.png)28th July 2025

# WireGuard for safe browsing on kids' devices

After setting up [AdGuard Home and Unbound](https://martinhicks.dev/articles/adguard-unbound-dns-home) on my [home server](https://martinhicks.dev/articles/n100-home-server-build), DNS filtering was working perfectly for every device on the home network. But children's devices don't stay on the home network. They go to school, to friends' houses, connect to public Wi-Fi, and use mobile data. In all of those situations, the home DNS filtering was being bypassed entirely.

The solution was **WireGuard VPN**, configured so that children's devices always route their DNS queries back through the home server, regardless of which network they're on.

## Why WireGuard

I've used OpenVPN in the past and it works, but WireGuard is a different league:

-   **Fast.** Built into the Linux kernel, minimal overhead. You don't notice it's running.
-   **Simple.** The entire codebase is around 4,000 lines of code. OpenVPN is over 100,000.
-   **Battery friendly.** It only sends packets when there's traffic. No keepalive polling draining the battery.
-   **Reliable.** Handles network changes gracefully. Switch from Wi-Fi to mobile data and the tunnel reconnects silently.

The N100's hardware AES-NI support means encryption overhead is essentially zero. WireGuard throughput on this box easily saturates the home broadband connection.

## DNS-only vs full tunnel

This is the key design decision. There are two approaches:

**Full tunnel** routes _all_ traffic through the VPN. Every web request, every app connection, everything goes home first and then out to the internet. This gives you full control but means all traffic takes a round trip through your home broadband, which adds latency and uses upload bandwidth.

**DNS-only routing** sends _only DNS queries_ through the VPN. The actual browsing traffic goes directly to the internet via whatever network the device is on. But because DNS is resolved at home, AdGuard Home's filtering still applies everywhere.

I went with **DNS-only routing** for the children's devices. The filtering is the point, not inspecting traffic. This keeps browsing fast while still blocking ads, trackers and inappropriate content on every network.

## Server setup

### Install WireGuard

```bash
sudo apt install wireguard
```

### Generate server keys

```bash
wg genkey | tee /etc/wireguard/server_private.key | wg pubkey > /etc/wireguard/server_public.key
chmod 600 /etc/wireguard/server_private.key
```

### Server configuration

`/etc/wireguard/wg0.conf`:

Note: replace `enp1s0` below with your server's actual NIC name. Run `ip -br link` to find it - modern Debian uses predictable names like `enp1s0` or `eno1`, not `eth0`.

```ini
[Interface]
Address = 10.10.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>

# NAT for VPN clients
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o enp1s0 -j MASQUERADE

# Child's iPad
[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.10.0.2/32
```

Enable IP forwarding:

```bash
echo "net.ipv4.ip_forward = 1" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p
```

Start and enable the service:

```bash
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
```

### Port forwarding

You'll need to forward UDP port 51820 on your router to the server's local IP. This is the only port WireGuard needs.

## Client configuration

For each child's device, generate a key pair:

```bash
wg genkey | tee client_private.key | wg pubkey > client_public.key
```

The client configuration is where the DNS-only routing magic happens:

```ini
[Interface]
PrivateKey = <client_private_key>
Address = 10.10.0.2/24
DNS = 10.10.0.1

[Peer]
PublicKey = <server_public_key>
Endpoint = your-home-ip:51820
AllowedIPs = 10.10.0.0/24
PersistentKeepalive = 25
```

The `PersistentKeepalive = 25` line tells the client to send a packet every 25 seconds. Without it, mobile carrier NATs quietly drop the connection's state after a minute or two of silence and the server can no longer reach the device until the device sends something first.

The critical line is `AllowedIPs = 10.10.0.0/24`. This tells WireGuard to only route traffic destined for the VPN subnet through the tunnel. Since `DNS = 10.10.0.1` points to the server's VPN address, DNS queries go through the tunnel and hit AdGuard Home. Everything else goes direct.

If you wanted a full tunnel instead, you'd set `AllowedIPs = 0.0.0.0/0` which routes everything through the VPN.

### Getting it onto the devices

The easiest way is to generate a QR code:

```bash
sudo apt install qrencode
qrencode -t ansiutf8 < client.conf
```

Open the WireGuard app on iOS or Android, tap "Add tunnel", scan the QR code, done. The whole process takes about 30 seconds per device.

## AdGuard Home integration

For this to work properly, AdGuard Home needs to listen on the WireGuard interface too. In AdGuard Home's settings, make sure it's bound to `0.0.0.0` (all interfaces) or specifically includes `10.10.0.1`.

You can also configure AdGuard Home with per-client settings. I have the children's VPN IPs set up with stricter filtering rules (safe search enforced, adult content blocked) while my own devices have a lighter touch.

## On-demand VPN on iOS

WireGuard's iOS app supports On-Demand activation per-network. In the app, edit the tunnel, enable On-Demand, and add your home Wi-Fi SSIDs to the _Disconnect on demand_ list. The result: the tunnel comes up automatically anywhere except home, where the LAN already has filtered DNS via the router. iOS sometimes takes a few seconds to bring the tunnel up after a network change - but it's reliable enough that I haven't had to think about it for months.

## The result

Whether a device is at home, on school Wi-Fi, at a friend's house, or using mobile data, DNS queries go through the home filtering system. Ads are blocked, trackers are blocked, and inappropriate content is filtered. All without installing any software beyond the WireGuard app, and with no noticeable impact on browsing speed.

The whole stack (N100 server, Debian, AdGuard Home, Unbound, WireGuard) has been running for months now without intervention. It's the kind of infrastructure that just fades into the background and works, which is exactly the point.

---

_This is the final article in my home server series. Previously: [building the N100 server](https://martinhicks.dev/articles/n100-home-server-build) and [AdGuard Home with Unbound for private DNS](https://martinhicks.dev/articles/adguard-unbound-dns-home)._

## Further reading

-    [A year with my Intel N100 home server: what changed
    
    A year on from the £250 Intel N100 home server build. What's still earning its keep, what I removed, what I added, and what I'd do differently.](https://martinhicks.dev/articles/n100-home-server-a-year-on)
-    [Running AdGuard Home and Unbound on a home server
    
    Using AdGuard Home and Unbound together for fast, private DNS resolution and network-wide ad blocking.](https://martinhicks.dev/articles/adguard-unbound-dns-home)
-    [Building a tiny Intel N100 home server
    
    A small, quiet, power-efficient home server build using an Intel N100 board for backups, DNS, VPN and development services.](https://martinhicks.dev/articles/n100-home-server-build)

---

Source: https://martinhicks.dev/articles/wireguard-safe-browsing-kids