@schveiguy,

You are correct in saying that it is the browser causing the behavior; essentially it will be able to mask any website as another form of traffic. 

From reading other forums, it may be that your son is using the Private Browser for Brave, which is powered by Tor. Tor is a Peer-to-Peer Web Browser, making it near impossible for a user's traffic to be traced. Brave is actually one of the furthest things from a default browser as the focus for the browser is privacy, VPNs, and Avoiding Content Restrictions; meaning it will be difficult to continue blocking services with the default settings. While the Browser does a great job of masking your network traffic, it also will mask the network traffic from your Router's parental controls.

Fortunately, it appears as though there are additional settings, such as group policies that can be set that disable certain privacy-blocking features, or the Tor version of the Private Browser. I would recommend looking at the Brave Support Site for related forum posts, as their team has provided a few solutions to help with parental controls.

  @schveiguy,

I am trying to go through some of the documentation regarding the privacy features of Brave, but there are a lot to look over. The browser seems to be one of the most feature-packed browsers that I have seen. It seems as though the Brave Browser has a lot of features for masking IP addresses and sending web traffic to their own servers as a proxy, rather than directly to a site. If the Parental Controls feature is looking at the IP address of the request, it's possible that it is not identifying the request as coming from that computer. I would not be surprised to find that if a site is blocked, the browser will route the connection through their own means to access the site.

A quick check for a proxy in the Windows Settings on the PC and the Browser is also worth a check, as these are features that are installed on the browser that can circumvent blocks.

There are even features included by default that randomizes the properties of your PC, such as Screen Size or browser version, in order to circumvent tracking. 

Any changes that would alter this behavior would be found in the browser settings, and can potentially be changed with an advanced configuration. While this applies to the TOR private mode, the article linked by the Brave Team details a method of preventing the installation of the browser via non-admin access.

Right now, it appears as though the Bedtime feature is an internet restriction, rather than a network(LAN) restriction. 

What I would recommend is looking at the actual parental controls on the PC. Windows provides features for parents for this very situation that would essentially block the network from functioning and can require the user to request an unblock for additional time. When it comes to actively circumventing Parental Controls, your safest and the most reliable bet will be on the device itself. Microsoft has an entire suite of controls available under Microsoft Family. 

---

I am still attempting to find the feature that would allow the traffic to pass through the network, rather than be blocked by the router. Please double-check that there are no network settings that have been set to reroute connections through a VPN or Proxy server.

When setting a content block for a site, is the browser still able to access the site?

For a site that you know is working on the computer when it shouldn't be, it may be worth your time to run a tracert from the command prompy to the web address and see where the request is being routed through.

  @schveiguy,

I will look into the questions, but I just finished a conversation with our IT department, and they think that a device may have been set up on the network that the traffic may be getting routed through alternatively. If possible, try connecting the PC to the guest network. From the control panel on the router, there are two options for allowing devices to see each other, and an option to allow devices on the guest network to see the devices connected to the main network. This way, you can see if there are any devices connected that you were unaware of that may have been connected to the network and not under the profile.

I believe that brave used to enable a VPN by default, but moved that to a paid feature and now uses its own proxies by default.

I do not know how thorough the traffic monitor and system log is in the Tether App, however, the WebGUI of the router has both a Traffic Monitor that needs to be enabled and a System Log that may help identify how the traffic is being sent. Other users have definitely been able to diagnose the network behaviors that they are experiencing with the PC version of WireShark, so it is worth a try if you are willing.