You set up parental controls. You configured DNS filtering. You thought everything was locked down. Then you discovered your kid installed a VPN app and bypassed all of it.
Don't worry — this is fixable. VPN bypass is the most common way tech-savvy kids get around parental controls, and it's also one of the easiest to prevent once you know where to look. This guide covers how to detect VPN usage, remove it, and block it from being installed again on both iPhone and Android.
1. How to Detect VPN Usage
Before you block anything, you need to know if your kid is actually using a VPN. Here are the telltale signs:
Check for VPN configuration
Go to Settings → General → VPN & Device Management. If any VPN profiles are listed here, they're installed and may be active. A "VPN" indicator also appears in the status bar when a VPN is connected.
Check for VPN in settings
Go to Settings → Network & Internet → VPN. Any configured VPN connections will appear here. Look for a key icon in the status bar — this appears when a VPN is active.
Check DNS analytics (if using NextDNS)
If you have NextDNS configured, check your analytics dashboard. A sudden drop in queries from a specific device — or queries to known VPN domains — indicates VPN usage. NextDNS can also detect and block VPN-related domains if you enable the bypass methods category.
2. VPN Apps to Look For
Kids don't always use apps that say "VPN" in the name. Some disguise themselves as utility or security apps. Here are the most common ones:
Common VPN apps kids use
Cloudflare's 1.1.1.1 app (WARP)
This is one of the sneakiest because it doesn't look like a traditional VPN — it's marketed as a "faster internet" app. But WARP mode encrypts all traffic and completely bypasses DNS filtering. This app is free, requires no account, and is extremely popular among teens who share bypass tips.
3. Block VPN on iPhone / iPad
Apple gives parents multiple layers of control. Here's the most effective approach:
Remove any existing VPN apps
Delete any VPN apps you find on the device. Then go to Settings → General → VPN & Device Management and remove any VPN profiles that remain. Some VPN apps install system-level profiles that persist even after the app is deleted.
Block new app installations via Screen Time
The most reliable method. Go to Screen Time → Content & Privacy Restrictions → iTunes & App Store Purchases → Installing Apps → Don't Allow. This completely prevents installing any new apps from the App Store. When your child needs a new app, they use Ask to Buy and you approve from your phone.
Enable Ask to Buy
In your Family Sharing settings, make sure Ask to Buy is enabled for this child. Every app installation (including free apps) requires your approval. You can review the app before approving — reject anything that looks like a VPN or proxy.
Restrict VPN configuration changes
Go to Content & Privacy Restrictions → Allow Changes → VPN Configurations → Don't Allow. This prevents the child from adding VPN profiles manually, even if they somehow get a VPN app installed.
Prevent account changes
Under Content & Privacy → Allow Changes → Account Changes → Don't Allow. This prevents the child from signing out of their Apple ID and signing into a different one (which would bypass Family Sharing and Ask to Buy).
Keeping track of all these settings across every device?
CyberDaddy monitors your parental control settings and alerts you when VPN apps are detected, settings are changed, or new bypass methods appear.
Join the Waitlist — Free4. Block VPN on Android
Google Family Link gives you similar controls, though the approach is slightly different.
Remove existing VPN apps via Family Link
Open Family Link → Your Child → Controls → App Limits. Find any VPN apps and tap Block. This removes the app and prevents reinstallation. Also check Settings → Network & Internet → VPN on the child's device and remove any VPN configurations.
Require approval for new app installs
Family Link → Controls → Google Play → Require approval for → set to "All content". Now every app your child tries to install — including free ones — sends you an approval request. Review carefully and reject any VPN apps.
Block sideloading (install from unknown sources)
Family Link blocks sideloading by default for supervised accounts, but verify it. On the child's device, check Settings → Apps → Special App Access → Install Unknown Apps — every app should show "Not allowed." If the child's account is properly supervised through Family Link, they can't change this.
Block the Settings app access (optional, nuclear)
In Family Link, you can set time limits on the Settings app itself, effectively preventing your child from manually configuring VPN connections. This is aggressive but effective for younger children.
5. Network-Level VPN Blocking
Even with app-level blocking, a determined kid might find workarounds. Network-level blocking adds a second layer that's much harder to bypass.
Use CleanBrowsing Family Filter or NextDNS
CleanBrowsing's Family filter blocks VPN and proxy domains by default — meaning even if a VPN app gets installed, it can't connect to its servers. NextDNS offers a "bypass methods" category you can enable that blocks VPN, proxy, and Tor-related domains. See our DNS filtering guide for setup instructions.
Disable DNS-over-HTTPS on all browsers
DNS-over-HTTPS lets browsers bypass your DNS filtering entirely. On each child's device: Chrome → Settings → Privacy → turn OFF "Use secure DNS". Firefox → Settings → Privacy → turn OFF "DNS over HTTPS". Safari uses the system DNS by default and doesn't have this issue.
Advanced: Block VPN protocols at the router
If your router supports firewall rules (Asus, Ubiquiti, pfSense), you can block common VPN protocols by port: block outbound traffic on ports 1194 (OpenVPN), 500/4500 (IPSec), and 51820 (WireGuard). This won't catch all VPNs (some use port 443 to disguise themselves) but stops most consumer VPN apps.
6. Having the Conversation
Technical controls are important, but they work best alongside open communication. If you discover your child used a VPN to bypass controls, this is actually an opportunity.
Don't panic or punish first. Kids bypass controls because they're curious, because they feel the restrictions are unfair, or because their friends told them how. Understanding the "why" matters more than the "what."
Explain the "why" behind your controls. "I'm not trying to spy on you — I'm trying to make sure you don't accidentally see something that's hard to unsee" is more effective than "because I said so."
Acknowledge their growing independence. For teens especially, consider relaxing some controls in exchange for transparency. "I'll unblock social media if we can have a weekly check-in about what you're seeing online" creates trust rather than an arms race.
Make consequences proportional. Bypassing controls should be addressed, but the response should be proportional. Temporarily losing a device for a few days is reasonable; permanent punishment creates resentment and more secretive behavior.
Frequently Asked Questions
VPN detection, automated.
CyberDaddy monitors all your devices for VPN installations, DNS bypass attempts, and settings changes — and alerts you before your kid gets around your controls.
Get Early Access — Free