A while ago, my mom’s godson (ten years old) showed me explicit gore on his phone, with the same casual energy someone might use to show you a meme, a funny clip, or some completely irrelevant TikTok trend.

He didn’t look surprised, scared, or even aware that maybe that wasn’t something he should be watching.

It was just normal.

And that’s where it all started.

My first reaction wasn’t “how do I block one specific site?” It was how to keep that kind of content from becoming everyday background noise. How to make the internet a little safer — or at least a place where certain things don’t show up so easily.

The catch is I’m AppSec during the day, and at night I usually break things in my homelab, so my idea of “making the internet safer” was nowhere near sitting down for a calm talk about online risks.

Instead, I thought about infrastructure.

I thought about DNS, logs, blocks, firewall rules, traffic, dashboards, domain lists, and observability. In other words, I tried to solve a human problem in the least human way possible.

I believed infrastructure could fix it.

It wasn’t a fully improvised idea. I already had a homelab where I constantly create, delete, and recreate VMs and LXCs, usually with the excuse of learning something new. I also had a MikroTik, Pi-hole, and about thirty meters of ethernet cable dragged into a three-by-three room.

So I had every ingredient I needed to become, once again, a meme.

The initial idea was simple: if I could control where traffic on my network went, I could also control what content was reachable from it.

Internet would come in from the ISP, pass through the MikroTik — router, gateway, and DHCP — while every DNS query would be resolved by Pi-hole. From there I could block malicious domains, ads, trackers, adult content, and anything else I didn’t want circulating through the house.

And it sounds great.

Almost as if I knew exactly what I was doing.

On top of that, Pi-hole would let me resolve my own local .home domains, so I could hit services like pi.home while watching a dashboard of everything happening on the network.

Centralized blocking, stats, DNS queries, lists with an absurd number of domains, and the feeling that if something crossed my network, at least I could see it.

For a while, that felt like having control.

But there was a problem.

The internet doesn’t only live inside my network, and devices don’t seem particularly interested in respecting the decisions of whoever pays for the router.

Strange DNS queries started showing up, apps talking to services I’d never asked for, smart TVs sending traffic in the middle of the night, and devices doing their own thing as if my house were a zoo connected by DHCP.

The more I watched, the more I wanted to block.

And the more I blocked, the more things stopped working.

Some apps simply broke. Others used their own resolvers. Some ignored the network DNS entirely, while others started using DNS over HTTPS, encrypting queries and skipping a good chunk of traditional filtering.

Then came something even simpler: mobile data.

I could set rules, redirects, filters, and blocks inside the house, but turning off Wi-Fi was enough to shrink that whole infrastructure into a pretty set of dashboards.

And that’s where I found something security people often try to ignore.

The user always wins.

It doesn’t matter how many restrictions exist, how many apps get blocked, or how many firewall rules you have. If someone really wants to reach something, they’ll eventually find a way.

Even at ten years old.

The more rigid the system became, the more creative the workarounds got. At some point I stopped building a safer environment and started running a competition between my infrastructure and the people using the network.

A fairly absurd competition, considering the goal should never have been to win.

Because security is not the same as control.

It took me a while to get that, mainly because in infrastructure control often feels good. Seeing everything tidy, devices correctly identified, queries going where they should, and policies applying centrally brings a certain calm.

But that calm can be fake.

I could block millions of domains and still fail to teach why a link might be dangerous. I could shrink access to certain apps and still not explain how recommendation algorithms work. I could keep specific content off my network and still not stop it from showing up at a friend’s house, on another device, or over mobile data.

The problem was never only the content.

It was also infinite attention, constant overstimulation, algorithms designed to retain users, and a feed that never ends. Platforms competing all day for a few more seconds of attention, recommending ever more extreme content because, often, that’s what gets a reaction.

The internet never stops trying.

And there is no firewall rule that can fix that.

That said, it doesn’t mean all the technical work was useless. Reducing exposure still matters. Fewer apps, fewer trackers, less advertising, fewer unnecessary services, and fewer dangerous defaults clearly help.

Blocking malicious content helps.

Forcing certain devices onto a controlled DNS helps.

Having visibility into what happens on the network also helps.

But none of those things work on their own.

The other part — probably the most important, and also the least interesting to show on a dashboard — is talking about technology: explaining phishing, how recommendations work, why an app wants to keep us staring at the screen, and why not everything on the internet deserves our attention.

It sounds fairly obvious written this way.

In practice, it can be much harder than configuring a MikroTik, and that already says a lot.

In the end, my attempt to build a “safe internet” taught me something quite different. The goal was never to control the internet, because the internet doesn’t seem especially interested in being controlled.

The goal was to reduce exposure, accompany, and teach how to navigate it.

Pi-hole is still running. The MikroTik is still bossing the network around. The thirty meters of cable are still there, and I’ll probably keep adding rules, lists, and new ideas I don’t need.

But now I understand that all of that infrastructure is only one layer.

A tool.

Not a complete solution.

Maybe we’ll never control the internet.

But we can still teach how to navigate it.