Three hops, and the house never notices.
The internet, through your normal router
Nothing changes upstream. Your own devices, your work, your telly all stay exactly where they are, on the grown-ups' network.
The Genkan box
A spare computer with a second network port. It is the kids' island's only gateway: it hands out addresses, answers DNS, filters, meters time, and keeps the logs. All of it runs in a sealed container that holds only the island's own network interfaces, so a bad rule can degrade the island but can never touch the house.
The kids' filtered network
An access point (and a switch for wired PCs and consoles) plugs into the Genkan box. Phones, tablets, laptops and visiting mates all land on this one island. Per kid, per category, per minute: all your call, from your phone.
Under the bonnetHow the box is actually put together
A Docker container owns its own network namespace with exactly two interfaces: the uplink, and the USB network card the kids' access point plugs into. The firewall (nftables), the DHCP and DNS server (AdGuard Home) and the children's portal all live inside that namespace, so they physically cannot reach the host, the rest of your home network or your VPN. Not "are configured not to". Cannot.
Postgres holds the desired state. The gateway rebuilds the firewall from it every fifteen seconds, which is why a phone plugged in at 9pm is covered by 9:00:15pm and why a reboot cannot forget that somebody is out of time. The parent dashboard runs on the host, outside the island, so the thing you control it with is not on the network it controls.
Under the bonnetHow it tells Roblox from homework without reading anything
It never inspects traffic. It reads its own DNS answers. When a device asks for a name, the addresses that come back get filed into an nftables set for that category, and a counter attached to that set is what the meter counts. So a category is a measurement of where packets actually went, not a guess about what was inside them, and it works identically in an app and in a browser.
The honest blind spot: services that share a CDN address can be mis-tagged, which is why there is an apex-domain guard, and why the counts are described as close rather than exact.
Fail-closed, on purpose. Worst case, if the box dies, the kids' island goes down and the main house network is untouched. The gateway also refuses to start at all if the wiring looks wrong, rather than fight your router. Boring, safe defaults everywhere.
And the data stops right there. Every log, every DNS answer and every minute counted is written on the box in your house. There is no Genkan cloud, no account and no telemetry, so the project's authors cannot see your kids' traffic. Not because we promise not to look, but because it is never sent anywhere. It is MIT licensed too: point your own AI at the repo and ask it whether anything leaves the building.
The rest of the house, on the same box. Once a gateway you own is sitting there, it may as well guard the cameras, the doorbell, the lock and the plugs as well. They get the opposite treatment to a teenager's tablet: no clock, no bedtime, never cut, but walled off so nothing on the internet can reach them and they cannot roam sideways into your laptop. The camera still backs up to its own cloud, and your phone still opens the app. How the household rules work.
It knows the difference between Roblox and homework, without reading anything.
Because the Genkan box is the island's DNS server, it sees which names each device looks up, and so which internet addresses belong to which app. When a tablet asks where YouTube lives and then starts pulling data from those addresses, that traffic can be tagged video. When a PC resolves Roblox, that is gaming. All without decrypting a single byte of what anyone actually watches, says or plays.
That is what makes per-category time possible: gaming and video each get a daily budget, while music, schoolwork and messaging the parents are never on the clock. It is also why we can be precise about the limits below, because the same mechanism that makes this work is the mechanism that bounds it.
Daily budget, shared across the lot.
Its own budget, so a film is not a round of Roblox.
Never on the clock, along with schoolwork and messaging a parent.
These marks are our own artwork: a brand colour and the service name, nothing lifted from anyone's logo. Categories are plain files in the repo, so you can move any service between them, or add the one your kids found last week.
What a gateway sees, and what it never will.
Genkan sees domains, not content. We would rather you know exactly where the line is than discover it later.
Which sites and apps each device reaches, when, and roughly how heavily. Enough to meter, filter and spot trouble.
What is inside the apps. Messages in Snapchat, Instagram or Discord are end-to-end encrypted. Watching for in-app bullying needs a consenting on-device tool, not a network box.
Active use versus idle. Per-minute traffic counters tell "actively watching" from "left open in a tab" about nine times out of ten. We say about, because it is about.
Mobile data. Cellular goes phone, tower, internet, and never enters your house. The lever there is the phone itself, via Google Family Link and friends.
Every device on the island, including visitors, each controllable on its own.
Shorts split from the rest of YouTube. Same domains, same category. A few edges like this exist and we document every one rather than pretend.
Transparency over surveillance. Genkan monitors at the level of "flag genuinely harmful", not "read their DMs". Reading a teenager's everything destroys trust and pushes them off your network entirely, and then you have nothing. The kids can be told exactly what the box sees, because the answer is not embarrassing.
Some doors never lock.
Youth help lines (in New Zealand: 1737, Youthline, Kidsline) are never blocked. Not at bedtime, not during a cut, not when the time budget hits zero. The allowlist that keeps them reachable is refreshed hourly and sits above every other rule in the firewall, and searches that look like self-harm raise an urgent alert to a parent regardless of age tier or time of day.
And when a kid is blocked or out of time, pages don't just silently fail. Their screen shows a friendly page: here is why, here is how to earn more, here is who to talk to.