# Router setup

Setting GraceDNS on your router protects every device on your network at once: phones, laptops, smart TVs, consoles and IoT devices, with nothing to install on each one.

## How it works

Most routers only speak classic DNS (port 53), which carries no configuration id. GraceDNS identifies your network by its public IP address instead: you link your network's IP range to your configuration, and every query arriving from it gets your rules.

## Steps

1. Find your network's public IPv4 address (your router's status page shows it, or search "what is my IP").
2. In your GraceDNS configuration, add that address as a linked client IP (a single address is fine; use a range if your provider gives you one).
3. On your router's admin page, find the DNS server setting. It is usually under Internet, WAN or DHCP settings.
4. Set the DNS server to the GraceDNS resolver address shown in your configuration's setup panel, and remove any other DNS servers so traffic cannot fall back around the filter.
5. Renew the DHCP lease on a device (or reboot it) and test: visit a domain on your denylist; it should no longer resolve.

## Dynamic IP addresses

Home connections often change their public IP. If your IP changes, queries from your network fall back to the default (unfiltered baseline) configuration until you update the linked IP. Options:

- Update the linked IP via the API (it is one call, easy to automate from a script on your router or a Raspberry Pi).
- Prefer per-device encrypted DNS where possible: [Android Private DNS](android.md) and [browser DoH](browser-doh.md) carry your configuration id in the connection itself and are immune to IP changes.

## Routers with encrypted DNS support

If your router supports DNS over TLS (recent Fritz!Box, OpenWrt, pfSense, OPNsense, Unifi), use it instead of plain DNS: set the DoT server name to `<configid>.dns.gracedns.eu`. This both encrypts your queries and identifies your configuration without any IP linking.

## Make the filter stick (optional but recommended)

Devices and apps with hardcoded DNS can bypass your router's setting. To enforce the filter, add firewall rules that block outbound TCP/UDP port 53 to any destination except your router. See [What DNS filtering cannot do](../limitations.md) for the honest limits of enforcement.

Back to [docs](../index.md).