Culmen Content Filtering

Layered content filtering for subscriber networks, with per-plan policy rather than one blunt rule for everyone.

Five independent layers

• DNS redirection — subscriber queries are forced to a resolver you control
• Local filtering resolver with category policy per plan
• DNS-over-HTTPS blocking — known DoH resolver addresses are blocked on 443, so a browser cannot quietly route around you
• QUIC blocking — udp/443 rejected for filtered tiers, because QUIC is the other way out. Rejected rather than dropped: a silent drop leaves browsers waiting on HTTP/3, a reject makes them fall back at once
• Per-tier scope — filtering applies to the plans you choose and leaves the others alone

Why five and not one

DNS redirection on its own stopped working years ago. A modern browser will fall back to DNS-over-HTTPS, and if you close that it will use QUIC. Any filter that does not close all three is decorative. Closing them in the wrong order locks out the customers you did not mean to touch, so scope is a first-class setting here rather than an afterthought.