Deployment Scheme

DNS Safety can be deployed both within your network (on-premises) and in the public Internet.

On-Premises

In this case, a virtual machine of DNS Safety is deployed within your network. IP address of the DNS Safety machine should be used as primary DNS server for all clients within the network. DNS requests from the clients will then be sent to DNS Safety for filtering or forwarding to internal servers (e.g. Active Directory) or public DNS upstreams.

The following diagram illustrates typical deployment in a small Active Directory integrated network. Deployment in home network is even simpler.

Public Internet with VPN

In this case, DNS Safety is deployed on a host in the public Internet (for example Microsoft Azure, Amazon AWS, Hetzner, DigitalOcean or Linode).

The VPN module in Admin UI is used to add users, generate Wireguard VPN profiles for them and configure mobile devices to access that VPN server. Upon establishing VPN connection, DNS Safety applies filtering policies to all DNS requests coming from such mobile devices. This allows it to block ads, filter adult only sites and protect browsing sessions in cellular 4G/5G networks.

This simple tutorial explains several steps you need to follow to configure DNS filtering in mobile networks.