How to Stop VPN and Proxy Bypass of Your Filter: A Guide for Families and Businesses

TL;DR: There are four common ways around a filter: changing the device's DNS setting, turning on a VPN app, using a proxy site or extension, and Tor. Guardino's bypass protection blocks the domain names of these tools and of public DNS resolvers at the resolver. An app that cannot find its server by name usually cannot connect. The protection holds roughly 17,000 rules and is on by default on every profile, the free plan included. For a child, it turns "how do I get past the filter" into something a downloaded app no longer answers. For a business, it keeps working-hours rules and the security filter the same for everyone. It cannot stop a VPN that is already running or tools that connect straight to an IP address, so use it together with device settings.

A filter is only as strong as its easiest way around. You have blocked adult content at home, or paused social media during working hours at the office, and the rule is in place. Then one day your 12-year-old downloads a free VPN a friend mentioned. Or an employee installs a browser extension sold as "unblock any site". The rule is still there, just not for that device.

This guide covers the ways filters are most often bypassed, which of them Guardino's bypass protection closes and which it cannot. Then it looks at what that means in practice for a family and for a business, and ends with a three-minute test you can run yourself.

What is filter bypass (DNS bypass)?

Filter bypass is a device sending its DNS questions, or all of its traffic, somewhere the filter on the network cannot see.

The reason is easy to see once you remember what DNS does. Before an app connects to a server, it asks for that server's address by name. A DNS filter is what answers those questions, and it declines to answer for harmful or blocked names. If you want that foundation in plain English, start with how DNS filtering works.

Every bypass method rests on one idea: don't ask the filter. Either the question goes to a different resolver, or all traffic goes into an encrypted tunnel the filter cannot look into.

Four bypass routes and what bypass protection does about them

1. Changing the DNS setting. Another provider is typed into the phone's Private DNS setting or the browser's secure DNS setting. Bypass protection: the names of public resolvers are blocked, so a setting made by name usually fails to connect.
2. A VPN app. All traffic goes through an encrypted tunnel to a server elsewhere. Bypass protection: if the app cannot find its server by name, the tunnel never forms.
3. Proxy sites and extensions. Another site opens the blocked page and shows it to you. Bypass protection: the names of known proxy services are blocked.
4. Tor. Traffic passes through relays run by volunteers. Bypass protection: known Tor-related domain names are blocked; an installed Tor Browser can also reach its relays by IP address.

The key point: most VPN and proxy apps look up their own servers, login and licence services by name before the tunnel opens. If those questions get no answer, the app says it cannot connect. The tunnel never forms, so the filter stays in charge.

Is this protection optional?

Not today. In Guardino, bypass protection is on by default on every profile and every plan, the free plan included, and there is no setting you need to switch on. The list has been loaded on all of our resolvers since August 2026 and holds roughly 17,000 rules. The number changes as the list is updated.

There is no per-profile off switch yet. If a legitimate service you need gets caught, you add a single allow rule for that domain on the Custom rules screen in your dashboard. The rule can apply to one profile or to the whole account.

There is one optional extra layer: iCloud Private Relay. While this Apple feature is on, Safari traffic goes through Apple's relay servers and the DNS filter on your network does not see it. That is why Apple publishes separate guidance for network administrators. The simplest fix is to switch Private Relay off on your child's device. In the Guardino dashboard, iCloud Private Relay is also one of the services you can block per profile, in the Privacy tools group under Content and apps.

What bypass protection cannot stop

Knowing what a security product cannot do matters as much as knowing what it does. Protection that works at the DNS layer cannot stop:

• A VPN that is already running. Once the tunnel is up, all traffic is encrypted and the DNS filter no longer sees that device's questions. Bypass protection makes the tunnel harder to set up; it does not tear down one that exists.
• Tools that connect straight to an IP address. A VPN that finds its server by IP address rather than by name, or an installed Tor Browser, can connect without asking DNS anything.
• DNS typed in by hand as an IP address. If the Wi-Fi settings point DNS at an IP address, the question never reaches the filter. If your router supports it, a firewall rule that stops devices sending DNS straight out (port 53) prevents this.
• A different network. Protection on the router covers that home or office. For mobile data or a friend's hotspot, the device itself needs a profile.

This list is here on purpose. A determined person with the know-how can find a way around any filter. The job of bypass protection is not to make that impossible, it is to close the easiest and most common routes.

For children: putting distance between curiosity and harmful content

Bypass protection does not remove a child's curiosity. What it does is lengthen the shortest path between that curiosity and harmful content.

Attempts to get past a filter often start with a moment of curiosity rather than a long plan. A friend names an app, a video opens with "how to get past the school filter", and a free VPN downloads from the app store in seconds. On a network with bypass protection, that app usually cannot connect. The impulse hits a wall, and that wall buys you time to talk.

How close that route is became visible in the UK in summer 2025. When age checks for adult content took effect on 25 July, Proton VPN reported an hourly signup increase of 1,400% over its baseline. This guide is not about whether that law is right. The point is this: once a child has learned to install a VPN, the same app switches off every filter at home. The adult content filter, the gambling block and SafeSearch all stop working on that device at once.

Free VPNs carry their own risks. Of 283 Android VPN apps examined in 2016 by researchers from CSIRO, UNSW and UC Berkeley:

• 38% showed some malware presence when checked by a virus scanning service.
• 18% did not encrypt the tunnel at all.
• 75% used third-party tracking libraries.
• 82% requested access to sensitive data such as contacts and text messages.

The study is from 2016 and today's figures may differ. But a free VPN has to pay for itself somehow, and once connected, all of the child's traffic runs through that unknown server. Bypass protection makes the tunnel harder to set up; it does not remove the app from the phone. That is why requiring approval for app installs belongs in the plan too.

Worth knowing as well: in Guardino, a child profile turns on SafeSearch at the resolver. It covers Google, Bing, DuckDuckGo and YouTube, and switching browsers or reinstalling an app does not turn it off. Bypass protection makes it harder for a VPN to switch that layer off in one move.

A technical lock is not enough on its own. Talking with your child about why the filter is there, and deciding together what gets blocked at which age, works better over time. Talking about device rules by age and what to block at 7, 11 and 15 are practical places to start. If you have already met the usual failure modes, why most adult content blockers fail covers them one by one. All the family settings are on the families page.

For businesses: a rule that applies to everyone protects focus

A company sets internet rules for two reasons: to limit distracting services during working hours and to keep devices away from harmful sites. Both share the same weakness. The rule only applies to people who don't know how to install a VPN.

What a broken focus costs

Measurements by Gloria Mark at the University of California, Irvine found that in 2004 office workers stayed on one screen for about two and a half minutes on average before switching. In a 2016 study that figure had fallen to 47 seconds. In a 2005 study by the same researcher, workers who returned to an interrupted task on the same day took an average of 25 minutes and 26 seconds to get back to it, handling an average of 2.26 other tasks along the way.

These figures measure how easily attention breaks, not the effect of a VPN. But that is exactly why a company pauses social media or video platforms during working hours. In Guardino, Focus mode blocks social media and other distracting services. Without bypass protection, that rule disappears in seconds for anyone who installs an extension.

Worked example: how many hours do the minutes add up to?

The figures below are an assumption for you to adjust to your own office, not a measurement:

Input	Assumption
Employees	20
Daily time per person on blocked services via VPN or proxy	15 minutes
Working days per month	22

20 × 15 × 22 = 6,600 minutes, or 110 hours a month. At 8 hours a day that is roughly 14 full working days. The calculation leaves out the cost of getting back into interrupted work.

Formula for your own numbers: employees × daily minutes × working days per month ÷ 60 = hours per month.

Bypass protection does not win all of those hours back. What it does is make the rule you set apply equally to the person who installs a VPN and the person who does not. A rule that applies to everyone is fairer and gets argued about less. For setting that rule without turning it into surveillance, how to set a workplace screen policy without becoming the police lays out a detailed framework.

Security: a filter only protects what it can see

Guardino's malware, phishing and scam lists work only when the DNS question reaches Guardino. An employee who turns on a personal VPN takes that computer outside the company's security layer for as long as it runs. A phishing link clicked during that time is not filtered, and company data passes through a server run by nobody you know. Bypass protection makes that gap harder to open, with no agent to install on devices and no mobile device management system to run.

A note on GDPR: Blocking does not require recording who visited what, and query logging in Guardino is off until you turn it on. Opinion 2/2017 on data processing at work, from the Article 29 Working Party (the group of EU data protection authorities that preceded today's European Data Protection Board), says that "prevention should be given much more weight than detection", and that where misuse can be prevented by blocking certain websites, blocking should be chosen over continuously monitoring communications. If you do turn logging on, those logs are personal data about your staff: employees must be told in advance what is recorded, why and for how long. This note is not legal advice; ask your own counsel about your situation.

For schools and companies, the Team plan adds an organisation with members and roles. Setup and pricing are arranged with us directly; details are on the business page.

Test it yourself: a three-minute check

You do not need to install a VPN to see the protection working on your network:

1. On a device where Guardino is set up, open the connection check. It should show that the device's DNS goes through Guardino.
2. In a browser on the same device, try to open the website of a public DNS provider or a well-known VPN service. The page should not open. If you have only just set things up, close and reopen the browser first; old answers can stay cached for a while.
3. If the page opens, the device may be asking somewhere else. The DNS leak test shows which resolvers answer your device.
4. If a service you need for work is caught, add an allow rule for that domain on the Custom rules screen in your dashboard.

What to do to switch the protection on

There is no switch to flip for bypass protection. What you need to do is make sure devices actually send their DNS questions to Guardino:

1. Home or office network. Enter your profile's DoT hostname or DoH address in your router's encrypted DNS (DoT or DoH) setting. Many routers supplied by internet providers have no such setting; in that case you can put a router that has one behind the provider's router. The steps are on the setup page.
2. Phones and laptops. Install the Guardino profile on the device. Protection then continues on mobile data and other Wi-Fi networks.
3. Require approval for app installs on children's devices. Ask to Buy in Apple's Family Sharing and Google Play purchase approvals in Family Link stop a new VPN app from being installed without you knowing.
4. Add a router rule against DNS changed by hand. If your router supports it, stop devices sending DNS straight out.

What sets Guardino apart here

• Baseline protection, not an extra setting. Bypass protection is on from the start on every profile, the free plan included. No family or company is left exposed because someone forgot to switch it on. Plans are on the pricing page.
• Blocks without watching. Query logging is off until you turn it on. You can set limits without recording what your child or your staff visit. What we can and cannot see is spelled out on the transparency page.
• One setup, the whole network. A profile set up on the router with encrypted DNS covers every device at home or in the office. There is no agent to install.
• States its limits. That is what the "cannot stop" section above is for.

If you want the difference between the two tools in one place, DNS filtering vs a VPN compares what each actually protects.

Where to go from here

No filter is enough on its own against a determined user. But many bypasses start with hearing the name of an app, not with a determined plan. Bypass protection closes that shortest route; device settings and a conversation do the rest.

You don't need a card to try Guardino. Set it up on one phone from the setup page first to see how it works, then move it to your router.

Sources

• Ikram, Vallina-Rodriguez, Seneviratne, Kaafar and Paxson, An Analysis of the Privacy and Security Risks of Android VPN Permission-enabled Apps, CSIRO Data61, UNSW and UC Berkeley, 2016
• Gloria Mark, Attention Span, 2023; summary of the screen attention measurements
• Mark, Gonzalez and Harris, No Task Left Behind? Examining the Nature of Fragmented Work, ACM CHI, 2005
• Article 29 Data Protection Working Party, Opinion 2/2017 on data processing at work, 8 June 2017
• UKTN, Proton VPN reports surge in UK users after OSA, August 2025
• Apple, Prepare your network or web server for iCloud Private Relay
• Apple Support, Approve what your child can purchase and download with Ask to Buy
• Google For Families Help, Purchase approvals on Google Play