Router setup

Changing the DNS servers on your router applies the filter to every device that joins your Wi-Fi, including smart TVs and game consoles.

1. Choose the addresses

Filter	Primary / secondary IPv4	IPv6
Family Filter	`1.1.1.3` `1.0.0.3`	`2606:4700:4700::1113` `2606:4700:4700::1003`
Adult Filter	`1.1.1.3` `1.0.0.3`	`2606:4700:4700::1113` `2606:4700:4700::1003`

Adult and Family share router addresses today. The Family filter's extra YouTube and proxy rules apply on the DoH endpoint and will reach routers when Die Ratel's own resolver IPs launch.

2. Open your router's admin page

Usually http://192.168.0.1, http://192.168.1.1 or http://10.0.0.1. The login is printed on a sticker under the router if you never changed it.

3. Find the DNS setting

Look under LAN, DHCP, Internet or WAN for fields named DNS server, Primary DNS or DNS 1 / DNS 2. Replace what is there (often "automatic" or your ISP's servers) with the two IPv4 addresses, and the IPv6 pair if there is an IPv6 field.

South African fibre routers. Huawei HG8145/HG8245 (Vumatel, Openserve): LAN → DHCP Server Configuration → Primary/Secondary DNS. ZTE F660/F670: Network → LAN → DHCP Server. TP-Link Archer: Advanced → Network → DHCP Server → Primary DNS. MikroTik: IP → DNS → Servers, then untick "Allow remote requests" unless you need it. Some ISP-managed routers lock the DNS fields; if yours does, set DNS on each device instead or ask the ISP to unlock it.

4. Save, then reconnect

Save or apply the settings. Devices pick up the new DNS the next time they connect, so turn Wi-Fi off and on, or reboot the router to be sure.

5. Stop devices from bypassing the router

Turn off "secure DNS" / DoH in browsers, or point it at a Die Ratel DoH endpoint (see browser setup).
If your router has a firewall, block outbound port 53 and 853 to anything except the addresses above.
On children's phones, also set Private DNS or the iOS profile and lock the setting, so the filter follows them onto mobile data.

Check that it works