Knowledge Base  >   Firewall  > 

Force LAN Clients to use Bing and DuckDuckGo SafeSearch

SafeSearch is a service that helps you block inappropriate images or contents from the search results. Not only Google, other search engines like Bing or DuckDuckGo have their own SafeSearch server for doing the filters also. We can use the LAN DNS feature on Vigor Router to force LAN clients to use SafeSearch when they use Bing Search and Duckduckgo Search. There are two kinds of methods for LAN DNS, IP Address and CNAME. This article demonstrates how to use IP Address and CNAME on LAN DNS profile to force the LAN users to filter by SafeSearch.

Use IP Address (Take Bing SafeSearch for example) :

1. Check the IP address of SafeSearch in your area: For Windows users, run Command Prompt and enter the command " nslookup strict.bing.com " and record the answer.

2. On Vigor Router, set up LAN DNS for Bing Search: Go to Applications >> LAN DNS/DNS Forwarding, and click on an index number to edit a profile.

  • Check Enable.
  • Enter a Profile name.
  • Select LAN DNS for Type.
  • Enter " *.bing.com " on Domain Name.
  • In IP Address List, click Add. In the pop-up window, enter the IP address of SafeSearch in the Host's IP Address, and click OK.
  • Click OK to save.

3. With the LAN DNS configuration, when LAN clients open Bing Search, they will be redirected to Bing SafeSearch. If a LAN user searches for improper content, the page will show the message below.

Use CNAME (Take Duckduckgo SafeSearch for example) :

1. On Vigor Router, set up LAN DNS for Duckduckgo Search: Go to Applications >> LAN DNS/DNS Forwarding, and click on an index number to edit a profile.

  • Check Enable.
  • Enter a Profile name.
  • Select LAN DNS for Type.
  • Enter " *.duckduckgo.com " on Domain Name.
  • In CNAME, click Add. Enter " safe.duckduckgo.com "
  • Click OK to save.

2. With the LAN DNS configuration, when LAN clients open Duckduckgo Search, they will be redirected to Duckduckgo SafeSearch. If a LAN user searches for improper content, the page will show the message below.

Troubleshooting :

If SafeSearch doesn't take effect as expected. please try the following :

1. Clear DNS cache on the LAN hosts for the LAN DNS to work. For Windows users, this may be done by entering the command ipconfig/flushdns in the Command Prompt.

2. Clear the browser's history and cookies.

SafeSearch is a feature offered by major search engines—such as YouTube, Google, Bing, and DuckDuckGo. It helps filter out inappropriate or explicit content from search results. By using the LAN DNS feature, network administrators can enforce SafeSearch for all LAN clients, ensuring that searches across these platforms automatically apply content filtering.

Compared to DrayOS 4, where users had to manually map IP addresses or CNAMEs through the LAN DNS function, DrayOS 5 offers a dedicated SafeSearch option. Administrators can now apply SafeSearch to LAN clients with just a few simple selections and checkmarks.

Router Setup
  1. Enable Force DNS Redirection. Go to Configuration > LAN, click More Settings to view the Force DNS Redirection setting. Toggle the Enabled button to enable Force DNS Redirection.
  2. Create a Keyword Object. Go to Configurations > Objects > Keyword Object, click +Add to include the public DoH DNS server domain names below:
    • Google: dns.google
    • Cloudflare: cloudflare-dns.com
    • OpenDNS: doh.opendns.com
    • NextDNS: dns.nextdns.io
    • Quad9: dns.quad9.net
    • CleanBrowsing: doh.cleanbrowsing.org
  3. Create a Content Filter rule to block the connections that match the keyword objects via Security > Content Filters.
  4. Create Service Objects for UDP Port 443 (used by some DNSCrypt servers) and TCP Port 853 (DNS over TLS) via Configurations > Objects > Service Object.
  5. Create an IP Filter rule to block UDP Port 443 and TCP Port 853 via Security > IP Filters.
  6. Set up LAN DNS SafeSearch profile for Bing and DuckDuckGo Search on Vigor Router: Go to Configuration >> DNS >> LAN DNS / Forwarding, and click + Add to add a new profile.
Verification

With the LAN DNS SafeSearch configurations, when a LAN client opens Bing Search, they will be redirected to Bing SafeSearch. If a LAN user searches for improper content, the search results will be filtered and the page may display a warning message.

Troubleshooting

If SafeSearch is not turned on as expected, please try the following:

  1. Use ping to verify if the ping to www.bing.com is redirected to strict.bing.com successfully. If not, try using ipconfig /flushdns to clear the DNS cache and check if the DNS query goes through the Vigor Router.
  2. If the ping redirection works but SafeSearch is still not enabled, the client may have enabled DoH or DoT secure DNS servers. Clear the browser cache and check the syslog to verify whether the firewall settings have blocked the secure DNS servers.

Published On:2025-12-17 

Share

Was this helpful?   

book icon

Knowledge Base