Yes, a porn filter can keep working with a VPN switched on, but only if it lives in the right place. Filters positioned on the network, your router, a filtering DNS service, go blind the moment traffic enters a tunnel, which is why the block “quietly stops working” the night a VPN appears. TKO’T approaches it from the device instead: block the tunnels before they open, pin the settings they would change, and keep an on-device screen layer watching what actually renders, which no tunnel in the world can hide. Free, on Mac and iPhone, and defense-only by design: this page describes the doors just enough to close them.
Why network filters die in a tunnel
A router filter or DNS service works by seeing your traffic’s destinations and refusing the bad ones. A VPN’s entire purpose is to make destinations invisible to whatever sits between you and the internet, and a web proxy or mirror site does the same job inside a single tab. Neither is malicious technology, but both have the side effect that matters here: the filter that guarded the network can no longer see what it is supposed to judge.
This is a position problem, not a strength problem. A guard at the gate cannot inspect a sealed truck. No amount of better guarding at the same gate fixes that, which is why the answer is never a longer blocklist on the router. You move the guard inside.
Change layers, not lists
Two on-device layers together make the tunnel question irrelevant:
- Before the tunnel opens: block VPN and proxy as categories, the apps from being installed, the proxy and mirror sites from resolving. Category blocking matters because these services spawn addresses daily; you block the family, not the members.
- After anything gets through: an on-device screen layer judges the content that actually renders, reading the screen rather than the address. A tunnel can hide where a page came from; it cannot hide the page from the person looking at it, and the screen layer sits exactly there, closing the window in under 80 milliseconds.
That second layer is what answers the Mac-specific version of this search, a blocker that blocks the actual video player, not just domains: at the screen, a video window served through a proxy is just explicit content rendering, and it gets closed like any other.
Close the doors before they open
Block the installs on iPhone. Apple’s restrictions can block app installs outright, which closes the download-a-VPN route for a kid’s phone, or your own. Lock the setting behind a passcode someone else holds, the tamper-resistance rules apply in full.
Pin the DNS. A device profile can fix the resolver so apps and browsers cannot quietly point lookups elsewhere; Apple documents the managed DNS settings payload that makes the choice stick. Pair it with a family-filtering resolver like 1.1.1.1 for Families and the default path is clean before any app loads.
Block proxy and mirror categories. Nobody can type every mirror by hand, and nobody should try. Category-level DNS blocking covers the known mass; the screen layer covers whatever was registered this morning. The same one-two answers remote-access routes: blocking remote-desktop and screen-sharing app categories closes the connect-to-an-unfiltered-machine door, and casting to the living-room TV is just another screen the device-level setup should own.
For parents: stop chasing the router
If your son keeps getting around router limits, you are losing an away game: the router cannot see cellular data, cannot stop a tunnel, and resets the contest every time he learns one more trick than you. Move the block onto the device itself, where it rides every connection, and make it tamper-resistant with the unlock code in your pocket, not his. The shared family iPhone guide walks the setup; the principle is that the device travels with the kid, so the protection has to travel too.
One honest note for everyone, parents included: blocking every VPN on earth is an arms race you do not need to win. You need the tunnel route to be slower and louder than the urge is long, while the screen layer makes the prize disappear even when a route works. That combination ends the game without requiring perfection from any single wall.
Frequently asked questions
Is there a free filter that still works when a VPN is on?
Yes, if it works on the device instead of the network. TKO’T keeps holding under a tunnel because its screen layer judges what actually renders, not where it came from, while its category blocking stops most VPN and proxy routes from opening at all. It is free forever, on Mac and iPhone, with no card and no subscription.
How do I block proxy and mirror sites permanently without typing them all?
Block them as a category at the DNS level rather than as individual addresses, then let an on-device screen layer catch the mirrors that did not exist yesterday. Hand-maintaining a list loses by design; category blocking plus render-time detection is the pairing that does not.
How do I stop VPN apps from being installed on an iPhone?
Use the built-in restrictions to block app installs, then lock that setting behind a Screen Time passcode held by someone else, a parent for a kid’s phone, a trusted person for your own. With installs closed and the setting passcode-locked, the download-a-tunnel route stays shut instead of becoming a nightly negotiation.
Is there a blocker for Mac that blocks the actual video player, not just domains?
Yes, that is exactly what screen-layer detection is for. Domain filters never see a player streaming through a proxy or an embedded window, but at the screen the video is just explicit content rendering, and an on-device watcher closes the window in real time regardless of which route served it.
How do I block remote desktop or casting routes to unfiltered screens?
Treat them as categories: block remote-desktop and screen-sharing apps from running or installing on the protected device, and disable open casting so media cannot be thrown to the living-room TV. They are ordinary side doors, close them once at the device level and they stay closed.
Should I try to block every VPN that exists?
No, and anyone promising a complete list is overselling. New tunnels appear constantly; chasing them all is the whack-a-mole this whole approach replaces. Block the category to make tunnels slow and obvious, pin your DNS, and let the screen layer make the content disappear even when a route slips through. The goal is a door slower than the urge, not a perfect wall.