Bedtimes, Blocklists and Broken Promises: Making the LAN Kid-Safe

There’s a particular flavour of motivation that turns a casual homelabber into a determined one, and for me it was this: I wanted the home network to be a place I’d actually let my kids loose on.

Not just “the Wi-Fi works.” I wanted guardrails. Content that wasn’t appropriate, blocked. Access that switched off at bedtime so the tablet stopped being a 2am companion. A network that was safe by design, not by hoping everyone made good choices at midnight.

This was one of the real driving forces behind the whole Omada move. And it’s where I learned that “powerful business networking gear” and “good at parenting your children’s screen time” are not the same sentence.

The assumption that got me

Here was my logic, and see if you can spot the flaw: the cheap router from my ISP has parental controls built in. Omada is far more capable than that router. Therefore Omada will have parental controls that are at least as good.

Reasonable. Also wrong.

Consumer routers are built for households, so they treat “parental controls” as a headline feature — pick a child’s profile, set a bedtime, tick some content categories, done. Some even have a literal “Bed Time on School Nights” toggle. (TP-Link consumer parental control guide.)

Business and “prosumer” gear like Omada is built for a different customer: offices, cafés, small businesses. Those customers don’t ask for bedtimes. They ask for VLANs, ACLs, URL filtering, and guest portals. So that’s what the platform optimises for. In fact, TP-Link’s own community has been blunt about it — there is no consumer-style parental control on the business products, and that’s not an oversight they intend to fix. (TP-Link Business Community.)

So the friendly “set up Junior’s bedtime” wizard I was expecting? Doesn’t exist. What Omada gives you instead is a box of more powerful, more general tools — and it’s up to you to assemble parental controls out of them. Which is either a downgrade or an upgrade, depending entirely on how much you enjoy this sort of thing. (Reader, I enjoy this sort of thing.)

The tools Omada actually gives you

Once I let go of the wizard fantasy, here’s the toolkit I found — and it’s genuinely capable, just raw.

URL Filtering. Omada can block websites by URL or keyword. Two things to know before you lean on it:

• It’s blacklist by nature — you specify what to block. You can’t easily flip it into “allow only these sites and nothing else” mode. (TP-Link URL filtering FAQ.)
• There’s a cap of 32 keywords for content blocking, so you’re curating a focused blocklist, not boiling the ocean. (TP-Link URL filtering FAQ.)

Time-based access via ACL rules. This is how you build a bedtime — and it’s cleverer and more fiddly than a toggle.

ACL = Access Control List. A set of rules that say “this source can/can’t reach that destination,” optionally only during certain hours. It’s the bouncer for your network.

Here’s the catch that cost me an evening: an ACL’s time range only controls when the rule is enabled. So a single “deny internet during bedtime” rule doesn’t cleanly do what you’d hope. The working pattern the community landed on is a two-rule sandwich: first a permit rule that’s active during allowed hours, then a deny rule sitting below it with no time range to catch everything else. Order matters, because the rules are read top-down. (Lawrence Systems forum, TP-Link Business Community.)

It works. It works well, once it’s set up. But you can see the gap between this and a checkbox labelled “Bedtime: 8pm.” I wasn’t ticking a box; I was writing access policy like a tiny corporate IT department whose only employees are under the age of ten.

The detail that shaped everything: rules attach to SSIDs

Now here’s the single fact that ended up dictating the entire physical design of my network, so I’m putting it in bold: when you apply these wireless rules in Omada, the source is the SSID. (TP-Link URL filtering FAQ.)

SSID = the name of a Wi-Fi network — the thing you tap to connect. “HomeLab_Main,” “HomeLab_Guest,” and so on.

In other words, the cleanest way to say “this schedule and these blocks apply to this person or device” is to give them their own SSID and hang the rules off it. Want a different bedtime for each child? That points you toward a separate SSID per child. Want the smart TVs on a different schedule from the kids’ tablets? That’s another SSID.

You can feel where this is going. My tidy dream of one Wi-Fi network with per-device profiles quietly turned into a list of SSIDs — one per kid, plus dedicated ones for the IoT devices — each carrying its own schedule and filtering rules. It’s not elegant. It is, however, completely functional, and it’s a direct consequence of how the platform decides “who” a rule applies to.

There’s a more elegant way to do this — assign devices to VLANs and write the rules against the VLAN instead of the SSID. I tried to go down that road. And that’s exactly where a £20 switch reached up and stopped me, which is the story of Part 5.

Belt and braces: DNS filtering

One more layer worth mentioning, because it does a lot of quiet heavy lifting: DNS-level filtering. Alongside Omada’s own tools, I run AdGuard Home as my network’s DNS resolver. Every device that asks “where is this website?” goes through AdGuard first, which blocks ads, trackers, and known-nasty domains for the whole network before a request ever leaves the house.

It’s not a replacement for the per-child scheduling — it’s the always-on background filter that catches the obvious stuff so the targeted rules can focus on the specifics. Defence in layers. (Full AdGuard build coming as its own guide.)

What I’d tell past me

If you’re setting out to make a homelab network kid-safe, here’s the honest summary:

• Business gear doesn’t hand you parental controls — it hands you the parts to build them. URL filtering, ACLs with time ranges, VLANs, DNS filtering. More powerful, less convenient.
• Know the limits before you design around them: blacklist-only filtering, a 32-keyword cap, and the two-rule sandwich for time-based access.
• Wireless rules attach to the SSID, so your “who does this apply to” question gets answered in how you lay out your Wi-Fi — unless you go the VLAN route.
• Layer your defences. DNS filtering for the whole network, targeted rules for the specifics.

Is it more work than the toggle I expected? Massively. Do I trust it more because I built it and understand every rule in it? Also massively.

In Part 5, the finale: the cheap switch that couldn’t do the one thing I needed, the multi-SSID field fix I built to route around it, and the single lesson that would have saved me this entire series.

---

Previous: ← Enter Omada · Next: The £20 Switch That Forced My Hand →

A note on the heavy stuff: parental controls touch on keeping kids safe online, which matters more than any networking tidiness. Network-level tools are one layer — they work best alongside conversations, device-level controls, and the rest. No firewall rule replaces knowing what your kids are up to.