The UniFi Dream Machine SE has no single parental controls switch like a consumer router, but its content filtering, traffic rules and client blocking give a strong and flexible set of tools, and when a restriction does not behave it is usually a matter of rule order, the scope or devices that bypass it. Open the UniFi Network app and look in Settings, Security, Content Filtering, where you can block categories of sites, such as adult content, and apply the filter to selected networks or devices.
The checks in more detail
Choose the networks, or create a separate network or VLAN for children's devices, which makes the rules easier. Add the devices' names to a group so that the filter and schedules apply to them only. For time limits, use Traffic rules or a schedule on the client: you can block a device or a group during chosen hours, such as bedtime. In the client list, you can also block a device outright.
Rules are applied in order, so a general allow rule above your block can defeat it; check that the specific block comes first. Make sure the devices are in the group, and check that their addresses are fixed or reserved, so the rule follows them. Randomised Wi-Fi addresses make a device look new, so turn off private address for your home network on the child's device. The known ways around a router filter are a VPN, secure DNS in the browser, mobile data and a hotspot.
Block the common VPN and DNS-over-HTTPS services with the gateway's traffic rules, and use the device's own screen time settings for the rest. Check that the gateway's DNS filtering is enabled and that devices use the gateway for DNS rather than a hard-coded one; a rule redirecting DNS to the gateway helps. Update the firmware, as content filtering lists improve. Test with the child's device on the home Wi-Fi and a site that should be blocked. Keep the admin account private. Use the community and Ubiquiti's help pages for details.
Differential
Likely causes of “Ubiquiti UniFi Dream Machine Special Edition parental controls”, and how to tell them apart
- 1
A rule in the wrong order
What separates it A general allow defeats the block
How to confirm Put the specific block first
- 2
Devices not in the group or with changing addresses
What separates it A device is not controlled
How to confirm Add them to the group and reserve addresses
- 3
A randomised Wi-Fi address
What separates it The device looks new
How to confirm Turn off private address on the child's device
- 4
A VPN or secure DNS
What separates it Filters are bypassed
How to confirm Block them in traffic rules and use device screen time
- 5
DNS not forced through the gateway
What separates it The filter does not apply
How to confirm Redirect DNS to the gateway
Before you touch a setting
Record this first — changing settings destroys the evidence
- The rule order
- The group and devices
- Whether the device uses a VPN or mobile data
- The filter categories
Try in this order
0 of 6 completedCreate a group or network
ReversibleFor the children's devices.
Enable content filtering
ReversibleFor that scope.
Add a schedule rule
ReversibleFor bedtime.
Put blocks above allows
ReversibleIn rule order.
Redirect DNS to the gateway
ReversibleAnd block bypasses.
Test a blocked site
ReversibleOn the home Wi-Fi.
Model-specific
What is true of this model and not of its siblings
- Rule order
- Specific blocks go first.
- Groups
- Make rules easier.
Stop boundary
When this stops being a self-service repair
- !Ask Ubiquiti's community with the rule set
- !Use device screen time as a second layer
- !Update the firmware
Evidence ledger
Sources behind this answer
Exact questions
Common questions
Does the UDM SE have parental controls?+
It has content filtering and traffic rules.
How do I set a bedtime?+
A schedule or traffic rule for a group.
Why is a site not blocked?+
Rule order or a bypass.
Does it work away from home?+
No.