One filter for an 11-year-old and a 16-year-old would be wrong for both.
Tight. The harmful categories blocked, SafeSearch and restricted YouTube forced, modest daily budgets. A fence around a kid who still wants one.
Block the harmful, keep the social. Social media stays reachable and visible in the logs, budgets are roomier, and the conversation matters more than the filter.
Deliberately light. Over-blocking a 16-year-old just pushes them to mobile data and wrecks trust. Block only the seriously harmful, skip the blanket time cap, focus on transparency and alerts.
Visiting mates get filtered internet and nothing else: no reach into the house, no per-person logging, and pausable separately from your own kids.
How the filtering actually works. The Genkan box is the island's DNS server, running AdGuard Home, so every name a device looks up is answered in your house by a policy you set. Each person is a client of their own, so the eleven-year-old's tablet and the sixteen-year-old's laptop get genuinely different answers on the same wifi. Ads, trackers and malware go for the whole household. Adult content, gambling, drugs, self-harm and weapons go by tier. SafeSearch and restricted YouTube are forced on the younger tiers at the network, not asked for politely in an app a kid can uninstall.
Devices are pinned to the box's DNS whether they like it or not. Hardcoded public resolvers are redirected back, and the encrypted-DNS shortcuts a browser might reach for are closed off. That is one of the reasons the bug bounty below exists: it is a genuinely interesting thing for a teenager to poke at, and we would rather they poked at it in the open.
Under the bonnetWho is allowed to lift a block
Every block carries a set_by column, and that one column decides who may undo it. A bedtime lifts only what a bedtime set. Earning time lifts only an out-of-time block. A parent's block outranks all of them and is still there in the morning.
It sounds like bookkeeping and it is the difference between a working bedtime and a broken one: before the rule was written down, a quiz passed at half past ten bought its way straight through a 9pm bedtime, because "give them their time back" and "let them online" were the same instruction.
Some doors never lock. The youth help lines sit on an always-allow list above every other rule in the firewall. Not blocked at bedtime, not blocked during a cut, not blocked when the budget hits zero, not blocked by any tier. If a kid is switched off in every other sense, that list is still reachable. It is the one rule the project will never weaken.
Meter the doom-scroll, never the music.
The problem was never "the internet". It is Shorts at midnight and one more round of Roblox. So the clock runs per category, per kid, and plenty of things are free.
One daily budget across the lot, so an evening of one is an evening less of another.
Its own separate budget. A film should not cost a round with mates, and it doesn't.
Along with schoolwork sites and messaging a parent. The point was never less screen, it was more of the good stuff.
These marks are our own artwork: a brand colour and the service's name, with nothing lifted from anyone's logo. The category lists are plain files in the repo, so you can move any service between them, or add whatever your kids found last week.
Modes make it surgical. Study mode: internet on, gaming and video off, Spotify still playing. Kill gaming: Roblox dies, the chess site and Google Docs live on. Dinner: one word pauses every kid at once, then resumes. Nobody has to nuke the whole internet to reclaim one evening.
And running out is not a wall. When a kid's budget is spent, their web traffic lands on a friendly page served from the box itself, the same way a hotel wifi page pops up. It says which category ran out, how long until the reset, and what they can do about it right now. No mystery, no spinning loader, no shouting down the hallway asking whether the internet is broken.
Why per-category, and not just "two hours of internet". Because the problem was never the internet. A blanket cap punishes the kid reading about volcanoes exactly as hard as the one on their ninth hour of Shorts, and it teaches nothing except that the timer is arbitrary. Metering the two categories that are engineered to be bottomless, and leaving the rest free, is a rule a child can actually agree is fair. Rules kids think are fair need enforcing far less often.
Minutes you can work for beat minutes you have to beg for.
The screen going quiet is the start of a negotiation in most houses. Here it is the start of a quiz, and behind that quiz sits 42 banks and 2,081 questions from Year 1 to NCEA.
A real curriculum, not ten trivia questions
Twenty-nine banks covering New Zealand Years 1 to 3, 4 to 6, 7 and 8, 9 and 10 and NCEA, plus banks aimed at the United Kingdom, Australia and the United States, plus the ones that are nobody's syllabus: astronomy, chess, world flags, the road code. Plain readable files you can check before you install anything.
Every question explains itself
All 1,408 of them carry a written explanation, aimed at the kid who got it wrong rather than the one confirming they were right. The checker refuses a bank that is missing any. That explanation is not decoration, it is the study material.
Read up, before or after
Every bank has a study page listing each question, its answer and why. A child who scored three out of ten has somewhere to go that is not "try again and hope". There is a badge for reading the page and then passing a round, which is the one habit most worth encouraging.
The library stays open
Forty-one reference sites survive a total cut: Wikipedia, Te Ara, the national libraries, NASA, museums and curriculum authorities across four countries. Without that, learn to earn only pays for recall. With it, a child can go and genuinely learn something and then cash it in.
Quizzes, credited instantly
Marked on your box in a fraction of a second, minutes on the clock before the kid has put the tablet down. A pass is worth ten minutes and a perfect round adds five, by default. All four earn numbers are settings, per household and optionally per child.
A ramp, not a cliff
Every question carries a difficulty from one to five, and a round is built easy to hard, adapting to how that child has been going lately. A round always opens with the easiest questions it has, and a round is always passable. A kid who opens on the hardest one in the bank quits and goes to find a screen you do not control.
Write your own on the couch
A parent can type a bank straight into the dashboard: this week's spelling list, the times tables one child keeps stumbling on. It lives in your household's own database rather than the repository, so updating Genkan can never delete it, and it goes live once it holds one full round.
Or ask your AI for one
Your kid is deep in Ancient Egypt, or netball rules, or the periodic table. Ask whichever AI you already use to write a bank on it, drop the file in, and it is on the menu tonight. The runbook that tells your agent exactly how ships with the project.
Badges, and no leaderboard
Ten badges, each measured against a child's own history, so the youngest and the oldest can both hold all ten. No streaks, no ranks, nothing scarce. The one place siblings are compared is a board of four categories chosen so being oldest is not a win condition, and it is off by default.
Chores, with a parent in the loop
A kid claims "put the bins out" from their portal and it waits for your tap. Instant feedback where a machine can judge it, human judgement where only you can. Both land in the same history, so where an extra hour came from always has an answer.
Not a grinding machine
Each bank has a rest between goes and there is a daily cap on earned minutes, so nobody farms the same ten questions all afternoon. Earning is meant to be worth something, which means it has to be finite.
A parent still outranks it
Earning lifts an "out of time" block and nothing else. If you have paused the internet for dinner, for a family day, or because of a conversation you are having, no quiz in the world undoes that. The kid is never put in charge of your decision.
The honest hole in it. Recall is cheap and learning is not, and right now they pay the same. A child who already knew the answers earns exactly what a child who spent forty minutes reading first earns. Time spent reading is not measured yet. The fixes are obvious and none of them is built, because every one of them turns learning into a puzzle a clever kid will optimise. The full list of what is not built.
A home is not a list of children.
It is children, the adults who live here, a friend's kid over for the afternoon, grandparents staying the week, and a pile of gadgets that belong to nobody. So Genkan knows four roles, and the controls are written against them.
| Role | Who | Time budget | Can earn | Caught by a kids' control |
|---|---|---|---|---|
| child | A kid who lives here | Yes, their tier's allowance | Yes | Yes |
| guest-child | A friend's kid, visiting | No | No | Yes |
| guest-adult | A visiting parent or grandparent | No | No | Never |
| adult | A grown-up who lives here | No | No | Never |
The eleven o'clock test. There are four kids in the lounge and two of them are somebody else's. Upstairs, the grandparents are halfway through a film. "Streaming off for the kids" has to reach all four children, including the visitors, and leave the grandparents entirely alone. One role field, and that just works.
Guests are treated as guests in the other direction too. A visiting adult gets malware and adult-content filtering and nothing more: no time limit, no metering, no per-person query log. Somebody who borrowed your wifi has not agreed to be monitored, and Genkan says that out loud rather than quietly hoovering them up. Nothing about a visit outlives the visit.
Claiming beats logging in, and the thing worth building is not a password.
Every household network has this problem and almost nobody names it: a device that belongs to nobody in particular quietly gets treated better than a device that belongs to a child.
The problem, stated plainly. On an ordinary setup, any device that gets an address on the network is a known device. A device belonging to nobody is in no child's rules, has no clock, and has no filter tier. It gets full, unfiltered, unmetered internet. On the house this was written in, six of thirteen active devices belonged to nobody, and two of those were ordinary personal phones.
The obvious answer is a password each, and it is the wrong one. Per-user wifi keys need hardware most homes do not have. A secret one teenager holds is a secret all of them hold within a week, which makes the audit trail a lie that looks like the truth. And there is no moment to log in at: a home device reconnects silently a hundred times a week, forever. A phone lent to a sibling is still logged in as its owner.
So the problem is not authentication, it is attribution. Binding a device to a person, and surviving the address changing underneath it.
An unclaimed device gets almost nothing
Turn claiming on and a device nobody has named gets three things: the ability to look up addresses, the portal page, and the safety net so a help line always works. Nothing else. Not being claimed becomes useless rather than advantageous.
The kid claims it in ten seconds
The portal asks whose device this is. They tap their name. It inherits their filter level and their clock, and it appears on your dashboard. The device name it announces is used to pre-fill the answer, never to decide it, because renaming a phone to somebody else's takes about fifteen seconds.
Rotating the address stops being a bypass
Phones randomise their network address, and it changes when somebody forgets the network and rejoins. That was an accidental way out. Now the phone simply reappears as new, gets the restricted lane, and has to be claimed again. A device that needs re-claiming often is itself worth noticing.
Watch first, block later
Three settings: off, observe and enforce. Observe counts what would have been restricted and blocks nothing, because the first thing a parent wants to know is how many devices this would catch before it catches any.
A guest just works
Connect, get a page, say who you are, get the guest tier. No new password to hand out and nothing to change back afterwards.
An optional PIN, if you want it
A four-digit code per child, so a sibling cannot claim your device and spend your minutes. It stays optional because for most families it is friction with no gain, and because a PIN a child holds is a PIN their siblings will eventually know. It raises the effort. It does not create certainty.
Make declaring yourself the path of least resistance, so devices get named without an enforcement conversation.
Prove identity. A determined child can claim a device as a sibling. The PIN raises the effort and nothing makes it certain.
Work with no new hardware, no shared password and nothing to leak.
Say anything about who is holding the device. Nothing can. And mobile data is still mobile data.
Off by default. A household running happily today should not wake up with its devices in a restricted lane. You turn it on deliberately, once the family knows what it does, which is the same rule the smart-home policy follows.
Put a camera in your baby's room and know nobody outside your walls can ever see it.
This is the part that turns a kid monitor into a household gateway. Cameras, doorbells, locks, plugs, speakers, the vacuum, the printer: the box knows what each kind of thing has any business talking to.
One idea does most of the work: who is allowed to start the conversation. A camera has to be able to ring its own manufacturer, because that is how you watch it from the bus and why a stolen camera has already uploaded footage of the person who stole it. Nothing on the internet needs to be able to ring the camera. And the camera has no business ringing your laptop, your phone, or the robot vacuum. Once a conversation is permitted the replies flow back automatically, so "my phone may reach my camera" means the video arrives, and only the very first packet is ever judged.
| Device | Out to the internet | In from the internet | To other gadgets | From your phone |
|---|---|---|---|---|
| Camera, doorbell | its vendor's cloud only | never | no | yes |
| Smart lock | its vendor's cloud only | never | no | yes |
| Robot vacuum | its vendor's cloud only | never | no | yes |
| Smart speaker | the ordinary internet | never | no | yes |
| Lights, plugs, thermostat | vendor cloud only | never | no | yes |
| Printer | nothing at all | never | no | yes |
The cloud backup survives
Plenty of good advice says put your cameras on a network with no internet access, which throws away the best feature a cheap camera has. Genkan gives the camera an allowlist instead: the addresses that belong to its maker, and nothing else. Cloud recording, remote viewing and firmware updates all keep working. What stops working is the camera chatting to a machine in another country that has nothing to do with its manufacturer.
Never on a clock
No time budget, no bedtime rule and no "dinner" pause ever touches a camera, a lock or a smoke alarm. Safety devices stay up, always. The kids' clock and the household firewall are the same box, and they are deliberately not the same rules.
The kids' island, in reverse
Nothing on the kids' network can reach your work laptop, your files, or the Genkan box's own controls. That isolation comes from the shape of the system rather than a checkbox, and it is covered by automated tests that fire real packets at it before anything ships.
Speakers get a longer lead, on purpose
An Echo or a Sonos talks to a dozen content networks that change weekly. Pinning it to a domain list produces a broken speaker and an unhappy house, and it is the device with the least to lose: there is no video of your front door on it. It still cannot reach your phones or the other gadgets.
Switched on deliberately. The household device policy ships installed but turned off, because the day it goes live is a day you want to be standing in the house. Turn it on when you have ten minutes to walk around and check the doorbell still rings, rather than discovering it during a work call. Honest defaults beat clever ones.
Enough to parent with. Not enough to snoop with.
Everything below is rendered by the box in your house, from data that never leaves it.
A page per child
Their devices, their time left in each category, what they earned today and how, their goals, and the controls for that one kid. The question "what is going on with this child" has one page, not a hunt.
Right now, live
Traffic charts that tick as it happens, filterable by person and by class of device. Useful for the ordinary domestic mystery: who is hammering the connection, and is that tablet actually being watched or just left open on the bed.
The weekly digest
A short read at the end of the week: hours by category, what changed, the earn and spend balance per kid. There is a plain-text version made to be pasted into a message, because the point of it is a conversation, not a scoreboard.
The naming queue
New devices land in a list waiting to be told who they belong to, with the name the device announced pre-filled as a hint. Switch device claiming on and an unnamed device gets nothing but the portal and the safety net until somebody says whose it is. How claiming works.
Whether the box itself is well
Genkan runs on a machine, and that machine is the single point of failure for the family's internet. The System page shows processor, memory, disk, load, uptime, temperature and the network over time, read straight from the kernel rather than by spawning programs on a timer, because a family gateway can be a Raspberry Pi. Every reading that cannot be taken says so instead of inventing a zero.
A speed test in the house
Built in, running on the island itself, and it times both legs separately: your device to the box (your wifi and access point), and the box out to the world (your actual connection). So you can tell "my wifi is the limit" from "my internet is the limit" instead of guessing, and prove the gateway is not the thing slowing anyone down.
Works with the lights out
The dashboard is server rendered, so the numbers and charts still come up with no internet and with JavaScript switched off. It is a household appliance. It should behave like one.
The line we hold. Genkan shows you domains, categories and minutes. It does not show you your teenager's messages, and it never will: reading their everything destroys the trust that makes any of this work, and pushes them onto mobile data where you can see nothing at all. Enough visibility to notice something is wrong, and not one inch more.
There is a live demo of every screen above, with a made-up household in it: three children on three filter levels, six weeks of history, guests in the house, and an approvals queue. It is the same code that would run in your hallway, pointed at invented data, so nothing you press changes anybody's network.
The household bug bounty: beat the filter, win a prize.
Your teenager will try to get around it. So Genkan ships with a house rule that turns that energy into learning: find a bypass, don't quietly use it, show a parent how it works, earn a reward, and fix it together. That is responsible disclosure, the way real security teams work, and every hole a kid finds makes the open-source project stronger for every other family.
| Level | Challenge | What it teaches | Bounty |
|---|---|---|---|
| 1 | Point your device at 8.8.8.8 and still get blocked. Work out why. | What DNS is | +15 min |
| 2 | Try "Secure DNS" in the browser or Private DNS on Android. | Encrypted DNS (DoH/DoT) | +30 min |
| 3 | Give your device a static IP to dodge a block. | DHCP versus static addressing | +30 min |
| 4 | Spoof your device's MAC address. | What a MAC address is | +45 min |
| Boss | Tunnel out with a VPN or your own hotspot. | VPNs, tunnelling, NAT | +60 min and bragging rights |
Quietly abusing a hole you found closes the hole and forfeits the bounty. Showing your working pays. Same as the real thing.
Set up by your agent, run by a sentence.
Genkan is agent-first. The entire control surface is one command-line tool plus plain-language runbooks, written so that any AI agent that can run shell commands can drive it: Claude, ChatGPT, Gemini, or a local model. Your family uses whatever it already has. Setting up is telling your agent to read the manual; running it day to day is "dinner", "kill gaming", "give Ben 30 more minutes" from your phone.
This is also the reason a normal parent can have any of this. What Genkan sets up is real network infrastructure: two interfaces, a container with its own network namespace, a firewall reconciled from a database, DNS with per-person policy. In 2020 that was a weekend and a friend who does this for a living. In 2026 you say a sentence and read what the agent did. The complexity did not go away, it just stopped being yours to type.
The roadmap keeps going the same direction: a voice assistant that answers to your house rather than a corporation, with every voice-granted action confirmed to a parent's phone, and home automation on the same box. All local, all optional.
MIT licensed, no telemetry, nothing to subscribe to.
You do not have to take our word for it. That is the part we are proudest of. Clone the repo, open whatever AI you already use inside the folder, and ask it plainly: what does this code do, and does anything here send data out of my house? An honest project should survive that question, and this one is built to be read.
The practical shape of it: the box sits by your router, in your house, on hardware you own. Every log, every DNS answer and every minute counted is written there and stays there. No account, no subscription, no server of ours in the loop. Compare that with a commercial parental-control service, which needs a monthly payment and a copy of everywhere your kids go. We would rather have neither.
Not a product you subscribe to. A garden you build, inside your own walls.
Every filtering service asks you to accept somebody else's idea of what your children may see, and to send them the evidence. This one hands you the walls and the gate and lets you decide what grows inside. It takes an evening to put up. After that it is yours, and it does exactly what you told it to.
Built the way you want it
Four filter tiers is the starting point, not the ceiling. Change what a category means. Write a rule for one child and not the others. Decide that audiobooks are free and that Discord is not. Every one of those lives in a database on your box, in plain rows you can read, and none of it needs anyone's permission to change.
What you can set →Other parents are building it with you
The quiz banks came from people who wanted their own kids to learn something specific: the road code, the periodic table, Kiwi birds, how to mix a colour. Somebody who teaches model aeroplanes can write a bank about model aeroplanes, send it in, and it turns up in your house too. The content grows because parents keep adding to it, not because a company scheduled a release.
Write one for your kid →Inside your own walls
There is no account, no telemetry and no cloud. The record of what your children looked at lives on a hard drive in your house and is deleted on a schedule you set. Nobody at any company can read it, subpoena it, lose it in a breach or change their mind about it in three years, because nobody else has ever had a copy.
What never leaves →The box is in your house. Your kids' browsing never leaves it.
There is no Genkan cloud, because there is no company sitting in the middle. The gateway runs on your own hardware, next to your router, and the DNS answers, the logs and the time clock all stay on it. We cannot see your kids' traffic, because it is never sent anywhere. That is not a promise you have to take on trust, it is simply where the software runs.
It is MIT licensed, and every line is readable. You do not have to take our word for any of it either: point your own AI at the repo and ask it to explain what the code does, or to check whether anything sends data out of your house. That is a fair question, and the answer should be something you can check yourself.
Commercial parental-control services want a subscription and a copy of everywhere your kids go. Genkan wants neither. If this project disappeared tomorrow, your box would carry on working.