Protection for every screen you own. Even the old ones.

iPhone and iPad

One tap installs the Breaking Chains filter profile. It encrypts and filters every DNS lookup on Wi-Fi and cellular, so the protection rides along to any network.

1. Tap the button above, then Allow the download.
2. Open Settings — you will see Profile Downloaded at the top. Tap it, then Install.
3. Done. Verify safely at breakingchains.me/test — it checks every category for you, no real sites involved.

Older iPad (up to ~10 years old)

Same profile as above. iPads from 2018 onward run it natively. If your iPad is older and Settings says the profile "cannot be installed," use the per-network fallback:

1. First, try the normal install: download the profile and follow the iPhone steps. If it installs, you are done.
2. Fallback for very old iPads: Settings > Wi-Fi, tap the (i) next to your network, scroll to Configure DNS, switch to Manual.
3. Delete the existing servers and add these two:
   185.228.168.168
   185.228.169.168
4. Repeat once for each Wi-Fi network the iPad uses. At home behind the Gateway it is covered automatically.Covered at home either way

Android — modern or ancient

Any Android (2013 or newer): we use Google's free, open-source Intra app pointed at the Breaking Chains resolver. This covers every app on every network, including hotspots, and works the same on a brand-new Pixel or a decade-old phone.

1. Install Intra from the Play Store (by Jigsaw, a Google company — free).
2. Open Intra, tap the gear icon > Select DNS over HTTPS Server > Custom server URL, and paste:
   https://dns.breakingchains.me/dns-query
3. Return and tap the big ON button. Intra runs as a lightweight VPN so the filter covers every app.

Amazon Fire tablet

Fire tablets hide the Private DNS toggle, so the cleanest device-level filter is per-network DNS plus Amazon's built-in controls:

1. Settings > Internet, long-press your Wi-Fi network > Modify network (or tap the gear, then the pencil).
2. Expand Advanced options, change IP settings from DHCP to Static.
3. Leave the IP fields as shown, and set:
   DNS 1: 185.228.168.168
   DNS 2: 185.228.169.168
4. Then turn on Amazon's own guardrails: Settings > Parental Controls — set a PIN your accountability partner holds, and restrict the Silk browser if the tablet is for kids.

Repeat step 1-3 for each Wi-Fi network the tablet joins. At home behind the Gateway, every Fire tablet is covered the moment it connects.Covered at home automatically

Chromebook

Two layers, use both when you can:

1. Browser filter (any Chromebook): open Chrome > Settings > Privacy and security > Security > scroll to Use secure DNS > choose Custom and paste:
   https://dns.breakingchains.me/dns-query
2. Whole-device (network level): click the clock > gear icon > Network > your Wi-Fi > Network, set Name servers to Custom:
   185.228.168.168 and 185.228.169.168
3. For a child's or accountability Chromebook: add Google Family Link — forced SafeSearch, site blocking, no incognito, no guest mode. This is the only layer a determined user cannot flip back.

PlayStation (PS4 and PS5)

The PlayStation has a hidden web browser reachable through apps and manuals, so it gets the same treatment as the Xbox. At home behind the Gateway it is already covered; the manual lock makes it stick:

1. Settings > Network > Settings > Set Up Internet Connection, choose your network, then Advanced Settings.
2. Set DNS Settings to Manual:
   Primary: 185.228.168.168  Secondary: 185.228.169.168
3. Then lock it: Settings > Family and Parental Controls > set a console restriction passcode your accountability partner holds, and restrict the web browser under content restrictions.

Covered at home automatically

Nintendo Switch (and Switch 2)

The Switch has no open browser, but its hidden one can be reached through workarounds, so we close the door anyway:

1. System Settings > Internet > Internet Settings, choose your network > Change Settings.
2. Set DNS Settings to Manual:
   Primary: 185.228.168.168  Secondary: 185.228.169.168
3. For kids' consoles, add the free Nintendo Switch Parental Controls app - it locks settings changes behind the parent's phone.

Covered at home automatically

Smart TVs, Fire TV, Roku, Apple TV

Every one of these has a browser or sideload path. They live at home, so the Gateway covers them all automatically - that is the honest headline. Belt-and-suspenders locks where the device allows it:

1. Apple TV: Settings > Network > your Wi-Fi > Configure DNS > Manual > 185.228.168.168. Then Settings > General > Restrictions with a partner-held passcode.
2. Fire TV Stick: Settings > My Fire TV > About > Network to note your gateway, then Settings > Network > your Wi-Fi, re-enter with Advanced to set static DNS 185.228.168.168 / 185.228.169.168. Add Settings > Parental Controls PIN.
3. Roku: no per-device DNS setting exists - it is covered by the home network layer only. Roku's own PIN (account settings) limits channel installs.
4. Samsung / LG / other smart TVs: Network settings > your Wi-Fi > Expert or Advanced > DNS setting > Enter manually > 185.228.168.168.

All covered at home automatically

VR headsets, Steam Deck, Kindle

The quiet loopholes. A VR headset has a private browser two inches from your eyes; a Steam Deck is a full Linux PC; a Kindle has a web browser behind the bookstore.

1. Meta Quest: Settings > Wi-Fi > your network > Advanced > set Static IP off, DNS manual where offered: 185.228.168.168. On family headsets add a Meta parental supervision link from a parent's phone. At home, the Gateway covers it regardless.
2. Steam Deck: in Desktop Mode, click the network icon > your Wi-Fi > IPv4 tab > Method Automatic (Only Addresses) > DNS Servers: 185.228.168.168, 185.228.169.168. Steam's own Family View PIN locks the store and browser.
3. Kindle e-reader: no DNS setting exists. Settings > Parental Controls > restrict the Experimental Browser behind a partner-held PIN. Covered by the home network otherwise.

Covered at home automatically

Xbox (One, Series S, Series X)

The Xbox has a full web browser in disguise (Edge), so it belongs in the protection plan. If it lives at home behind the Gateway or a filtered router, it is already covered. Add the manual lock so the coverage holds no matter what:

1. Press the Xbox button > Profile & system > Settings > General > Network settings.
2. Choose Advanced settings > DNS settings > Manual.
3. Primary: 185.228.168.168  Secondary: 185.228.169.168
4. Then set content limits that survive settings changes: Settings > Account > Family settings > add a passkey your accountability partner holds, and restrict web browsing under Content restrictions.

Covered at home automatically

Windows laptop and Mac

Mac: the same one-tap profile as the iPhone works: download it, open it from Downloads, then approve in System Settings > Privacy & Security > Profiles.

Windows 11: Settings > Network & internet > Wi-Fi > Hardware properties > DNS server assignment Edit > Manual > IPv4 on:

185.228.168.168  185.228.169.168  (set DNS over HTTPS to On (automatic) where offered)

Members on Brother and above get named per-device profiles instead, so your reports say which device did what — that setup happens in your member app.

Every OS version we support, in one honest table

Filters love to say "works on everything." Here is what that actually means, version by version. Where a device is too old for the modern encrypted path, we name the fallback instead of pretending.

Swipe the table sideways to see every column.