--- title: "Closing the cellular-data and hotspot bypass" description: "Turning off wifi for cellular, or tethering to a friend's hotspot, walks straight around any router filter. Why on-device blocking is the only fix that travels." url: https://tkot.com/journal/close-cellular-data-and-hotspot-bypass/ canonical: https://tkot.com/journal/close-cellular-data-and-hotspot-bypass/ author: "Arya Stark" published: 2026-06-07 updated: 2026-06-07 category: "Loopholes" tags: ["cellular data", "hotspot", "tethering", "side doors", "block porn"] lang: en --- # Closing the cellular-data and hotspot bypass > **TL;DR** Switching from wifi to cellular data, or tethering to someone else's hotspot, defeats any router or home-network filter instantly, because the device just leaves the filtered network. The only fix that travels with the phone is on-device blocking: a system-level filter and screen layer that ride every connection, wifi or cellular. On a kid's phone, managed policy can also restrict hotspot connections. TKO'T filters on the device, so the network it is on stops mattering. A home-network filter has one fatal blind spot: the device can leave the network. Turn off wifi and the phone falls back to cellular data, untouched by your router. Connect to a friend's hotspot and you are on a network with no filter at all. Either move takes one tap, which is why router-level filtering, useful as it is, can never be the whole answer. The only thing that holds is filtering that lives on the device itself and rides every connection it makes, which is exactly how [TKO'T](/#download) works, free: the network the phone is on simply stops mattering. Defense-only, naming the route only to close it. ## Why the network layer cannot win alone A router or home-DNS filter protects traffic that flows through it. The instant a phone switches to cellular or joins a different network, none of that traffic passes through your router anymore, so the filter has nothing to act on. This is not a weakness you can patch at the router; it is the definition of how networks work. The lesson repeats from the [side-door map](/journal/side-doors-most-porn-blockers-miss/): a filter positioned at the network loses the moment the device steps off the network, the same way it [loses inside a VPN tunnel](/journal/block-porn-even-with-vpn-or-proxy/). So the question is never "how do I make the router cover cellular" (it cannot) but "how do I put the filter somewhere the phone carries with it." ## The fix that travels: on-device filtering A system-level blocker installed on the phone applies to whatever connection the phone is using, home wifi, cellular, a coffee-shop network, a friend's hotspot, because it filters at the device, before traffic reaches any network. Two layers do the work: DNS filtering pinned on the device through a [configuration profile](https://support.apple.com/guide/security/configuration-profile-enforcement-secf6fb9f053/web) (pointed at a [family resolver](https://developers.cloudflare.com/1.1.1.1/setup/)) so it rides cellular too, and an [on-device screen layer](/journal/blockers-that-detect-explicit-content-on-screen/) that judges rendered content regardless of how it arrived. Pin the profile and lock it so the network settings cannot simply be switched back, the same discipline as [locking DNS so it stays put](/journal/lock-dns-settings-so-they-cant-be-changed-back/). That is the entire structural answer for an adult locking their own phone: stop relying on the router, put the wall on the device. ## For parents: the hotspot problem specifically A child tethering to a classmate's hotspot is the hardest version, because the filtered home wifi is irrelevant when the phone is on someone else's connection. Two moves help. First, on-device filtering on the kid's phone via a [managed profile](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies), so the block travels with the device onto any network. Second, [managed policy](https://developers.google.com/android/management/reference/rest/v1/enterprises.policies) can restrict which networks the device may join or disable connecting to hotspots and tethering on the managed phone, set by the controlling account a parent holds. The honest limit, stated plainly: a determined teen with a second unmanaged device defeats any control on the first one, so this is one layer of a [wider family setup](/journal/how-to-block-adult-sites-on-a-shared-family-iphone/) and a conversation, not a sealed cage. ## The self-discipline version If the route is your own, turning off wifi to use unfiltered data, the answer is the same with a different emphasis: on-device filtering removes the payoff (cellular is filtered too), and [tamper resistance](/journal/tamper-resistant-porn-blocker-that-survives-weak-moments/) plus a held passcode keep you from disabling the on-device filter in the weak moment that prompted the wifi switch in the first place. The wifi toggle stops being a bypass when both networks hit the same wall. That is the whole point of moving the filter onto the device: there is no longer a clean network to escape to. ## Frequently asked questions ### How do I stop myself from turning off wifi to use cellular data as a bypass? Move the filter onto the device so cellular is filtered too: a system-level blocker with a pinned DNS profile and an on-device screen layer rides every connection, so switching off wifi changes nothing. TKO'T does this for free, and with tamper resistance plus a passcode held by someone you trust, you also cannot disable the on-device filter in the moment that prompted the switch. ### How do I stop my son from tethering to a friend's hotspot to bypass the family wifi? The home wifi filter cannot reach another network, so put the block on his phone instead: on-device filtering through a managed profile travels onto any network, including a classmate's hotspot. Managed policy can also restrict joining hotspots or tethering on his device. Be honest that a second unmanaged device beats any single-phone control, so pair it with a conversation. ### Does a router filter work over cellular data? No, and it structurally cannot: a router only filters traffic that passes through it, and cellular data does not. The instant the phone leaves the wifi, the router filter is irrelevant. The only filtering that covers cellular is on-device, applied at the phone before traffic reaches any network, which is why on-device blocking is essential for any device that leaves the house. ### Can I block hotspot and tethering connections on a managed phone? Yes, on a managed device the controlling account can restrict which networks the phone joins and disable tethering or hotspot use, set by the parent or trusted person who holds that account. Combine it with on-device content filtering so that even a permitted network is still filtered. Remember the ceiling: a separate unmanaged device is outside any of these controls. ### Isn't on-device filtering pointless if someone can just use another phone? A second unmanaged device is a real limit, and honest tools admit it, but it does not make on-device filtering pointless, it makes it necessary and incomplete. For an adult locking their own phone, on-device filtering closes the cellular bypass entirely. For a determined teen it closes the easy route and leaves the hard one, which is exactly where the conversation and the wider setup take over. --- Source: https://tkot.com/journal/close-cellular-data-and-hotspot-bypass/ Author: Arya Stark