Home Admin & Settings Setting Up DNS Filtering

Setting Up DNS Filtering

Last updated on Jul 10, 2026

Setting Up DNS Filtering

DNS filtering is the fastest way to add KyberGate protection to an entire network — including devices you don't manage (guest Wi-Fi, BYOD, staff laptops, smart boards). Instead of installing anything on each device, you point your network's DNS at KyberGate's filtering resolvers.

This guide walks through the full setup, in order. Do not skip Step 2 — it's the step most people miss, and without it none of your devices will be able to browse.

Before You Begin

  • You need the Admin role or higher in KyberGate
  • Access to your firewall, router, or DHCP server (or your networking team)
  • Five minutes to test on a single network segment before rolling out widely

How KyberGate DNS Filtering Works

When a device on your network looks up a website, the request goes to KyberGate's DNS resolvers. KyberGate:

  • Returns the real address for allowed sites
  • Returns a block page for sites in categories you've blocked
  • Enforces SafeSearch on Google, Bing, and YouTube automatically

Because filtering happens at the network level, it covers every device on that network — managed or not. This makes it ideal for guest networks and mixed-device environments.

Important: KyberGate's DNS resolvers only answer requests coming from IP addresses you've registered to your organization. This prevents anyone else on the internet from using your filtering as an open resolver. If your network's public IP isn't registered, KyberGate will refuse every request and your devices will show errors like DNS_PROBE_FINISHED_BAD_CONFIG or "server IP address could not be found." Step 2 registers that IP.

Step 1: Get Your KyberGate DNS Server Addresses

In your dashboard, go to Settings → Network. Your organization's KyberGate DNS resolver addresses are listed there. You'll enter these into your firewall/router in Step 3.

Step 2: Register Your Public IP (Required)

This is the step that makes everything work. KyberGate needs to know which networks belong to you.

  1. From the network you're going to filter, open a browser and visit whatismyip.com
  2. Copy the public IPv4 address it shows
  3. In your dashboard, go to Settings → Network → Campus Network IPs
  4. Paste the IP, add a label (e.g. "Guest Network"), and click Add IP (or press Enter)

You can add multiple IPs — for example, one for your main network and one for your guest network — if they leave your building through different public addresses.

Tip: If you filter more than one network segment and they use different internet connections, register each segment's public IP separately. If they share one internet connection, one IP covers them all.

Step 3: Point Your Network at KyberGate DNS

Set your KyberGate DNS resolver addresses (from Step 1) as the DNS servers on the network you want to filter. Where you do this depends on your equipment:

On a firewall (Meraki, FortiGate, SonicWall, etc.)

  1. Open your DHCP or DNS settings for the network/VLAN you want to filter
  2. Replace the existing DNS servers with your KyberGate resolver addresses
  3. Save and apply

On a router or Wi-Fi controller

  1. Find the DHCP settings for the SSID or network
  2. Set the DNS servers to your KyberGate resolver addresses
  3. Save

Devices pick up the new DNS when they reconnect or renew their DHCP lease. Reboot a test device to apply it immediately.

Step 4: Test on One Network First

Don't switch your whole school at once. Start with your guest network or a single test VLAN.

  1. Connect a test device to the filtered network
  2. Confirm the KyberGate DNS servers appear in the device's network settings
  3. Browse to a normal site (e.g. wikipedia.org) — it should load
  4. Browse to a site in a blocked category — you should see the KyberGate block page
  5. Try a Google search — it should be locked to SafeSearch

If normal sites don't load and you see a DNS error, the most common cause is that this network's public IP hasn't been registered yet — go back to Step 2.

Troubleshooting

"server IP address could not be found" / DNS_PROBE_FINISHED_BAD_CONFIG Your network's public IP isn't registered under Settings → Network → Campus Network IPs, so KyberGate is refusing the requests. Confirm the public IP (whatismyip.com from that network) is added. If your ISP changed your public IP, re-check and update it.

Some sites load, others don't This is usually a blocked category, not a DNS problem — check your policy under Filtering. Sites in blocked categories are supposed to return the block page.

Nothing changed after updating DNS Devices may still be holding the old DNS. Reboot the test device or renew its DHCP lease. Some devices (and some browsers) cache DNS aggressively.

I want to filter managed devices with more detail DNS filtering sets a strong network-wide baseline. For per-user policies, screen viewing, and full HTTPS content inspection on managed devices, deploy the KyberGate proxy or agent as well (see Network and Proxy Settings). DNS filtering and proxy/agent filtering work together.

When to Use DNS Filtering

  • Guest networks — protect visitors and BYOD without installing anything
  • Unmanaged / mixed-device networks — smart boards, IoT, personal devices
  • A network-wide safety baseline — layered under your managed-device filtering

For 1:1 managed fleets where you want per-student policies and monitoring, pair DNS filtering with the proxy or device agent.

Why Blocked HTTPS Sites Show a Browser Error (Not the Block Page)

With DNS filtering, sites in a blocked category (gambling, adult, etc.) will usually show the browser's own "This site can't be reached" error instead of KyberGate's branded block page. This is expected — the site is blocked.

Here's why: nearly all modern sites use HTTPS. To display a custom block page over an HTTPS connection, the device has to trust KyberGate's inspection certificate — and that only happens with the proxy or device agent methods, which decrypt and inspect traffic. DNS filtering blocks the site at the lookup stage without decrypting it, so it can't render a page on that HTTPS connection.

Bottom line: a browser "can't be reached" error on a gambling/adult site means DNS filtering is working. If you want a branded block page on HTTPS for managed devices, deploy the proxy or agent alongside DNS filtering.